5664fb4271d5d100d7ffecdf964d25689a93f13d24a601bec7bd66a1b362f011

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v2.0.html
Size 210KB
Sample260702-ev9cbsbw91
SHA256 5664fb4271d5d100d7ffecdf964d25689a93f13d24a601bec7bd66a1b362f011
MD5 01571f289c20f72709f42ebfd1dcffb6
SHA1 7a6c5acbec66d9cc48817c6a00d16a2305bbcf9d
SHA512 0f7cd5cba18de737217843da86d31a3cd13976d0501a5cf47de9f7445e91a754c88939f9e6e53342462434e62df403575a3ad700c7ac8be031fc06d74e003681
SSDEEP 6144:1dU1tNhfpZwz/JZI7xqdn5pjUsvVm7MVqWX8ijE9WMdWeJ5PTQYbeHxHA7op9hrd:nU1tNhfpZwz/JZI7xqdn5pjUsvVm7MVh
TLSH
T1BA24A570A178627D016F268AF6709B14D7ABE31BEB4852E5B53FC2F857D3C84EA43058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274394481560217"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
708	chrome.exe
708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe
Token: SeShutdownPrivilege	3100	chrome.exe
Token: SeCreatePagefilePrivilege	3100	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe
3100	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2544	3100	chrome.exe	88
PID 3100 wrote to memory of 3768	3100	chrome.exe	90
PID 3100 wrote to memory of 2508	3100	chrome.exe	89
PID 3100 wrote to memory of 2508	3100	chrome.exe	89
PID 3100 wrote to memory of 1872	3100	chrome.exe	92
PID 3100 wrote to memory of 1872	3100	chrome.exe	92
PID 3100 wrote to memory of 4812	3100	chrome.exe	94
PID 3100 wrote to memory of 3116	3100	chrome.exe	93
PID 3100 wrote to memory of 4812	3100	chrome.exe	94
PID 3100 wrote to memory of 3116	3100	chrome.exe	93
PID 3100 wrote to memory of 2388	3100	chrome.exe	95
PID 3100 wrote to memory of 5720	3100	chrome.exe	96
PID 3100 wrote to memory of 5720	3100	chrome.exe	96
PID 3100 wrote to memory of 1732	3100	chrome.exe	97
PID 3100 wrote to memory of 1732	3100	chrome.exe	97
PID 3100 wrote to memory of 2476	3100	chrome.exe	101
PID 3100 wrote to memory of 2476	3100	chrome.exe	101
PID 3100 wrote to memory of 6012	3100	chrome.exe	102
PID 3100 wrote to memory of 6012	3100	chrome.exe	102
PID 3100 wrote to memory of 3012	3100	chrome.exe	103
PID 3100 wrote to memory of 5648	3100	chrome.exe	104
PID 3100 wrote to memory of 3012	3100	chrome.exe	103
PID 3100 wrote to memory of 5648	3100	chrome.exe	104
PID 3100 wrote to memory of 4676	3100	chrome.exe	106
PID 3100 wrote to memory of 4420	3100	chrome.exe	105
PID 3100 wrote to memory of 4676	3100	chrome.exe	106
PID 3100 wrote to memory of 4420	3100	chrome.exe	105
PID 3100 wrote to memory of 5932	3100	chrome.exe	108
PID 3100 wrote to memory of 2800	3100	chrome.exe	109
PID 3100 wrote to memory of 5668	3100	chrome.exe	110
PID 3100 wrote to memory of 708	3100	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\v2.0.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8d21ec728,0x7ff8d21ec734,0x7ff8d21ec740
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,17322891172076758666,10206996330135624328,262144 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,15951640490982952726,16206855677074315967,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,4825081867062100841,4931246043978760543,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,16915157153788583383,1164538161189221425,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,13272827734799607267,6094313819080560684,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,3582248517228847727,11001089019392661588,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5240,i,3417600088991722136,14414960643027951441,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5268,i,4294414035892990048,5732612755568832483,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,6725734382527262732,2836883255447576174,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5792,i,18274786393015275458,10978678478594307084,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,5578718028537512416,12056638702593645826,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5852,i,10199966953965987008,5846566793354010736,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5468,i,17789418604312097347,4939790737554813622,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5840,i,5845864179443475838,13398572506544900260,2097152 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,1195295177342056998,9717422238252158652,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,11447665165608290531,11469546786100938595,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,3083983020154313965,4340326816211207640,524288 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=788,i,7973665708176448748,2050854619281576438,262144 --field-trial-handle=1880,i,14561133569613443675,3179517503175131004,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86771899-c409-4146-8203-eb305345e7cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\86771899-c409-4146-8203-eb305345e7cc.tmp
Size 11KB
SHA256 e2546538be2a1d292f8d58c6a43480e1af134cd0c0a602b327bcec61166b5b5b
MD5 df098580ab86413f9bd6d47f1b5e716f
SHA1 8bda2305f0fc5abde1cb9fe9a8ad1424f821b206
SHA512 4faf935fbfc4a7156e0d633c029439cf7dd3be397394fe18cdd6c7dccdb6f7ea7070f3c9e5bb3cc3ecce56354883c3f6757ba6f02fe0eb6311e9c72573771292
SSDEEP 192:eIH4K6mc7KxkXqK4I40pUZNCgVLHrKHfFKslErA+XzKD/JE+ErUkKN9uGlwZA9NS:VHjxc7KxkXqKf/pUZNCgVLH2Hfgslp+x
TLSH
T17332F927948D9A3F4FD8D50DCC12AB4B6CB5029766780D2497FB9D0803A97CE114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8d7c074edcd9ee6bdcd5c7affae879d00b3ce3dab1b5a7728f00cd70f501fec2
MD5 8c4d7488906899f92948a865ea45587e
SHA1 3a7fdeec56e031dece3822638f00d034bed3885f
SHA512 403c332170bf05f40cdcb5716e9059902e05fb3f6af26bf20f43e01b42784580784b6dd6c1faec10ac294d9749b3d2476cdafb0083ebc75cef2423e51ec40e79
TLSH
T15DE02B9BDC21ED3708FD1719A0544747E75013672740554F7E3CD2098FBA63A4196C7C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3be7264e-7050-4203-939e-046f9635b102.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3be7264e-7050-4203-939e-046f9635b102.tmp
Size 2KB
SHA256 32a0b6edbe5b0a786beeee6ebf7a588f716a18b7d45db072cde415c75d4181d3
MD5 bc0db75a3fade13659c4c01b1eeb0100
SHA1 ce1a6c4f4ec5d2a3fea32e234438959aa8220cbb
SHA512 5ea73874bf9bed9438d2c735ba47af1f04a9ea576798b9a00db5c0a9685832f14db4bc59189018ad8b2ea8eaa9da9068e0a1a469c80c95a6eff5f2c49cec5454
TLSH
T1D1516CF7C7E44A7D891156F4EB156E1BCE2D0915832C3C66C8E4AF1BA7E2871D24029F
MD5 SHA1 SHA512 TLSH

Submit Download

973ecf2e-aa1d-47fa-9057-35532e1b963b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\973ecf2e-aa1d-47fa-9057-35532e1b963b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6c7f66754d41dfdd530ca55f9d8f9c30718574a14af7d9c51af02f5987954027
MD5 c8bd13e5252fea40f810194e7329ae37
SHA1 8caa44d70bb4a6bee8b0d7d071f1bdc8fa113f0c
SHA512 7c1892e23dd534172b9ac26d49afed1af5045fea8e47819b3a7ac154844d8ad3e4101bb346f5bc9e423a74e32a8546474eca8d43f856ae069ee3083739b49ca0
SSDEEP 192:0RmCZfb7/v7CvAPRp23iM91Hsb+WNneSPYdeRpVyIsnAUge:0RmWT7Xm6X9MLwjP7Pe
TLSH
T13032B52EAD50653B5CCBD61AFE65B767D7F5102125D42E80EAFC8A2C12E76CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 445833da34c839882f624b4184849a8281d1200ae718769871eece91ab293c8e
MD5 79d117630c886a461310c49302fdcb1d
SHA1 e0013cecac0363261dc6d6d4e3396d3cca154d0e
SHA512 6f32f544857a51daf9bfea15a800f56f133c099056b3f01a280ce6ff3dac4f73a4e9d238b8977f0a381e11ba5389c71708f255b0d1d887632fcd68158776f811
SSDEEP 192:0RmCZfb7/v7Cv3PRpH3iM91Hsb+WNneSPbde40pVyIsnAUgE:0RmWT7XmHXSMLwjPUPE
TLSH
T12532B62EAD50653B9CCBD619FD65BB67E7F5102125942F80EAFC8A2C12E76CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8f5901011139d2a5069f2a4954cb01606753777d1d6b2c375cd11cf657f26fce
MD5 3a98bcaa8025afcdfcbb3eeede107b48
SHA1 dfcdd0bcd561ff30fc9509f4a24f8707ef2cad3c
SHA512 330064a1ec2423de19256468574424fffc825d8c0716c4529c27aa76d782054ffe0eb4aa2b56079b7215f184e5c5bb6d705a7e419c2f1432ca25ff1bc497ae3c
SSDEEP 96:ObJ0d+R07wEk/0a3kCfYGi83Sl8h4otop5wpUPDWB6sXGyvfoHUrXjzkp+RNC396:Ot0K07wDc9GdiU2OMGYPCjzq+uCowj
TLSH
T114C108B1A85E5C7B69F2E545B0032D47CDB8619B69547E58EDEC5F0C11E74EC1382233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 77299526d3b2f0cab4c5ac15d79c97cf3bfbfedd7c4f9380cb6f6ffc28a4bf2e
MD5 bf0bc6cacaf3b405a2e96a0afb97aeee
SHA1 f3b38efc1d223a25869e3a86726aa3432e71ed4d
SHA512 90e845af65ce25d98f5dd27cf0537b771414eae989586f32b8b78241d73c1caa2cf60ff7ca1f38a3db9a8fa2bf1427ba975829811cdc4627d5c7fa37946e9195
SSDEEP 96:OC0d+R07wEk/0a3kCfYGi83Sl8h4otop5wpUPDWB6sXGyvfoHctRxwzwsT3qX5z4:OC0K07wDc9GdiU2OMGYPoxr5zqTrUy
TLSH
T11AC11971A86E6C7776F3D655B1032A4BCEF461AB9A106F94D9ED4F0C15D70AC1382232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5687037506f2a7e2f63f49573124d54cec7abd5c6efa5f2584f666168a1e858c
MD5 b8315b0960080de519d41c71290f13fa
SHA1 d057a9a8facb25230f63d33b416cff2aba450fec
SHA512 0b83ee54c9b5d98b774e589b10bbfde13e9974b6db54965791b364ca0d0fdaed30a38a000434f400bb3a89aee9537a8e950c3ccbcb338ac6e3b2fc78cf5254e1
SSDEEP 96:ObJ0d+R07wEk/0a3kCfYGi83Sl8h4otop5wpUPDWB6sXGyvfoHctRxwzwsT3qX5M:Ot0K07wDc9GdiU2OMGYPoxr5zqTrUy
TLSH
T109C11971A86E6C7776F3D655B1032A4BCEF461AB9A105F94DAED4F0C15D70AC1381233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 14c9ce5e5b9bc86125a7c821fb426c167e358146fcdc3b21dd15e50899ae7e5f
MD5 21f3e745dc17a5e1eb39675127783df5
SHA1 536f38bccb976d9e305ffff85e89e4b9c4a622a5
SHA512 1e0947b34ba709a78299214bb415264f965c0e2c5b5f559a3747ff6453d0b504298aa11e2fdb382bf44ac714c697817f2b49bb24503c81a594dcb142f113e770
SSDEEP 96:OC0d+R07wEk/0a3kCfYG785RDotok5wp0DWB65GyvfoqCkpZbcv4a:OC0K07wDc9GCDUDOCGJiCqZbO
TLSH
T141A10A31A4AA987765B3C645B4422A47CFF8629BA5605FC4D9EC5F0C66F70EC1341733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download