1df120427de50e03f5f21b4f7184bde4ca91ca38d06915967b23e3820dad926c

Analysis

max time kernel
660s
max time network
657s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRIavHGrez.html
Size 258B
Sample260703-aewdbadt7l
SHA256 1df120427de50e03f5f21b4f7184bde4ca91ca38d06915967b23e3820dad926c
MD5 021046c240e18f9d08d27ba3e35bcbaa
SHA1 87d3597652f716c3a5baa5c956113bdd758c9eb9
SHA512 349d2c30cb7f15afeacfe55f623fef953e0ed205db99e5a73162efc1fa7afbd0cbfdb4d35d0a491202a21c36761f9859977c6b25011d8630df169caab832b9b8
TLSH
T19AD05EA34C08AD8292B46190B17970EE4C53645E9CC48EC7D4A030EC4714AAFCA4B155
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275109233570170"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	chrome.exe
704	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeCreatePagefilePrivilege	704	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe
704	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 2816	704	chrome.exe	88
PID 704 wrote to memory of 1560	704	chrome.exe	89
PID 704 wrote to memory of 4916	704	chrome.exe	90
PID 704 wrote to memory of 4916	704	chrome.exe	90
PID 704 wrote to memory of 5404	704	chrome.exe	91
PID 704 wrote to memory of 5404	704	chrome.exe	91
PID 704 wrote to memory of 1416	704	chrome.exe	94
PID 704 wrote to memory of 4704	704	chrome.exe	93
PID 704 wrote to memory of 1416	704	chrome.exe	94
PID 704 wrote to memory of 4704	704	chrome.exe	93
PID 704 wrote to memory of 2812	704	chrome.exe	95
PID 704 wrote to memory of 2812	704	chrome.exe	95
PID 704 wrote to memory of 5324	704	chrome.exe	96
PID 704 wrote to memory of 5240	704	chrome.exe	97
PID 704 wrote to memory of 2788	704	chrome.exe	98
PID 704 wrote to memory of 5240	704	chrome.exe	97
PID 704 wrote to memory of 2788	704	chrome.exe	98
PID 704 wrote to memory of 4356	704	chrome.exe	100
PID 704 wrote to memory of 4356	704	chrome.exe	100
PID 704 wrote to memory of 1196	704	chrome.exe	101
PID 704 wrote to memory of 1196	704	chrome.exe	101
PID 704 wrote to memory of 3064	704	chrome.exe	102
PID 704 wrote to memory of 3064	704	chrome.exe	102
PID 704 wrote to memory of 3260	704	chrome.exe	103
PID 704 wrote to memory of 3260	704	chrome.exe	103
PID 704 wrote to memory of 5388	704	chrome.exe	107
PID 704 wrote to memory of 4176	704	chrome.exe	108
PID 704 wrote to memory of 5448	704	chrome.exe	109
PID 704 wrote to memory of 5424	704	chrome.exe	110
PID 704 wrote to memory of 5424	704	chrome.exe	110
PID 704 wrote to memory of 5816	704	chrome.exe	111
PID 704 wrote to memory of 5816	704	chrome.exe	111
PID 704 wrote to memory of 2564	704	chrome.exe	112
PID 704 wrote to memory of 5952	704	chrome.exe	113
PID 704 wrote to memory of 5952	704	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\DRIavHGrez.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa8b79c728,0x7ffa8b79c734,0x7ffa8b79c740
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,11485360289994256071,8827633926600400224,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,3395831490967981607,3250977342883083110,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10668826470193250853,432634488372231268,262144 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,12489925631404701373,15206166238960923766,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,9424252573791538834,5813361432062817246,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,1225947539615385661,2855696754073774709,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,4331603262141604532,8560310018431620035,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5540,i,16458886469439943288,10431955136983741945,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,5720999845422747976,7833351948221475480,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5732,i,17210037436072455080,18111700903980096775,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5748,i,17541664067825784482,17252291105212685287,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6172,i,10423555099394716831,16540714374603415712,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6316,i,6640192928269613862,13686120018721212379,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,8294303671581343399,17368026697394053046,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,14546368736272901369,4840202291562041793,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,8785266802627732930,13942939756416860231,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5736,i,9215719925837402735,13964651145312440405,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5028,i,9012841764944528469,17144058448934532480,2097152 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4440,i,15335605226610988333,17434414041429984247,262144 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:10
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,465375027677827107,11544580795585726740,524288 --field-trial-handle=1904,i,4017576521352858136,12712631148274316999,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:5952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74118af4733077494125cb9db057afc634e8642cb237ccd7d0f3cf9b65b1fb71
MD5 54f9e37c8459f687249cef9b9d02c81b
SHA1 d3eedc6bcd576b2b018dff5bfbf69e351c8adf36
SHA512 7fd1bfea1eceeda57e46da5a2bd9b69d0a9864645a8102cdacb2bf41ad645b064a4d8f4ff1419d8835a7058a5d55a95f40172b3e2331bfc6683f38261e00a8de
TLSH
T1E571935597C260A4FF104737EA932EC470F68829FB0A4B6F129811EC6C4B7EC6E4DE11
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 60e6ad36d63ae19c171184c9fd6ef8800fb123ecf19f1b818ef2edabb135cc5c
MD5 44dd92a49ae792c03c3688c9d97a4533
SHA1 df5f3f01b937967ef6b6f9aa177c8c6787fcdcd5
SHA512 b8491621130f6ca041c22d50cbfbe82f6194cf038a6d487ee2a7361333d5c0d506a10015f32c4b923928cb2154c6ede9e8b22ae000afc34ef730609c93385fa6
TLSH
T1C8719DF783E99A7D8D2151F4A7166E5FCE2D0924532C3C26C8E4AF1B93E28B1D20065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 52c9ac10510b4d253bb0c301b90d4b08b3a646ab281471a8d6b9ec7a6831e240
MD5 7a67370dce260e5d6457ced70e03eb0a
SHA1 d43303e292d0462c9779c0fba46b04a598136951
SHA512 2f7d15bc3a9735c3bb0a312fd132a772710765f12fee3b625e38de5ffeafcc1466780f61b589b89e0b6e1445619b8cd413b0e1b59f31848967fcdd68468e40ea
TLSH
T15F819BF7C3E99A7D892151F4AB163E1FCE2D0924532C3D26C8E4AF1B53E28B1D20164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 da637208760d4a414934ecbc395e1469826c042bfc4fce35731f0123202b02bd
MD5 7ff2490ed07f6f5a0048e9fe684b7a84
SHA1 7b60ad2672c21ade8e056672fc516ff5d835acaa
SHA512 db640e52600d9c30f9a7bb9299528271e873ed9d1e0dc7c4193f322c008d7578d38879c2cc1f51e966f600ad2e413dea42e7aab8854329cde719f0670a7a659d
TLSH
T19A118893D7B9B0174028A9AF0F15BC06ACB9B4310256A8F8CFA6826CA0820F71F1B017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 eac0997229b1bd5f9cf48eb460cbfb7b66f3fa0a8c1d443ccb1aa921448d799a
MD5 f6495a86a1c062e7892b15890d86d9b5
SHA1 07a061b1d990672bbd0956655faa2415e9103365
SHA512 53bd6279832404f5e175ba9323a49b513991ef31313451f090b36b4bde1bfdcd94f91641dec8a90969d5fbcb7626440d692078f82b1ec5083825d80cf7b94fc1
SSDEEP 192:KRev7gCv7AvAPRp2iYPw98Hsb+WNnEbPo1eeVyIsnAUgR:KRevkOE6Xn+wUPUR
TLSH
T10D32872AB910653B5DCBD269FA75B767E3F1102176D01E84EAFC8A3C12E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cbf410f40140289a81494d592707532c2cce38c8a86035624cd96e0df5214363
MD5 56f7ee5318159d935bf280c0b8f07c74
SHA1 767af00e6977f189bbdee39238d40176d97ea3cf
SHA512 09c5a8695f8b0513b41f34e7393de1f1e08412441dcca883adef886dba1ef383686b8210090fa9c2bc4da69260b465052dc959bbf10cd35ca3b06d1119a6383d
SSDEEP 192:KRev7gCv7AvQ0PRpeiYPw98Hsb+WNnEbPM1eeVyIsnAUgL:KRevkOERX/+wUPQL
TLSH
T14832772AA910653B5DCBD269FA65BB67E3F1103176901E84DAFCCA3C12E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d216bae6-4386-4245-b464-af8f2e195a5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d216bae6-4386-4245-b464-af8f2e195a5b.tmp
Size 11KB
SHA256 fb8c8df3f2d06761286c81fcb3bffecf84f025fef4edaddd87a2edb13afb43f7
MD5 a36867db2985e3705e5b51191dd964a2
SHA1 b1d831bd84989107a01e928f72380fb5cb8fef92
SHA512 b6c39e4f06d190baaaab380dce4849cc52d7bedc4197b7626bb86fabe9b8fe336464583af75762e80a478ac793ba4855ea9f5050cd2debbdc5ddb1e8fd87169e
SSDEEP 192:ep+4K6h97KxkXqK4I40pUZNCgVLHrKHfFKslERL1XzKD/qd+ErUkKN9sMayzjPZj:U+jS97KxkXqKf/pUZNCgVLH2HfgslI1i
TLSH
T1B7320927A48D8A3F4FD8D50DCC176F8B6DB5019222684C2457FF9D0403A9B8E225E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eaf027988226b192b3d2ca427dcf1197dd211faa1a5251fcb0c349720c1b33a9
MD5 a76ee4a133c6a64d5960de4d5c4ac797
SHA1 6f0a9a2ca0097402a4fa32b6ab608fe23d00244c
SHA512 86763c9a2ebed2565493b4216a961d08a569eb83a238b296ea3b0c22fb0f3b32bf65b04622ee9ee6d7adcdbb6d4178250f664e725e8d4774fe6ce0c2574a93ed
SSDEEP 96:aC6Md+pp4Cd1B3fkg2Xe2gSl8h4otop50XDrB6oGyvhrWgFI1QzbWldtWdp0j9IV:aCPg4Cd1Og2XKiU2OVMKWgFJkdtWdpU0
TLSH
T1BDC11C35B47CAD7315E6E554B5073643CEB0A1AFA6106FA4D9E94B2C12DB6AC1343113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 aecbeb23dc2ed544f9f3eea456c9f65c33dfc6d3fd4f3273773f1a634bb84350
MD5 cd6f13c2ab1fe41407b165a8063a2a93
SHA1 31e4794cdbb2ad0ee3c8a9001f406a540034fb4f
SHA512 1319243a50dc11458756edb0afb47be9ecd4b95a68c43e795075c4e633c45b6910d6354bf90af7623e5bab36959e5a1df594466b98ebbbc1598c43eb2c36b05c
SSDEEP 96:abJ6Md+pp4Cd1B3fkg2Xe2gSl8h4otop50XDrB6oGyvhrWgFI1QzbWldtWdp0j90:atPg4Cd1Og2XKiU2OVMKWgFJkdtWdpU0
TLSH
T1C2C11C35B47CAD7315E6F594B5073643CEB0A1AFA6106FA4DAE94B2C12DB6AC1343113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3afbeada240157cfdf1531a7a806b3c6c8a85371776cd568640c355e35ffdc81
MD5 c92494842828a7bc345d8e48b4e684d8
SHA1 fe78739009ac2824ef08cf674cfbf1475e943c8a
SHA512 3c92e57eb6d1b1dcb482a3745ac7db09b7493925264d8e194b2e8205b24fb64741a8993206d836f7f4cb50fbfcebf9b520ea10ca9415afd02cdd3b1a403d1b7c
SSDEEP 96:abJ6Md+pp4Cd1B3fkg2Xe2gSl8h4otop50XDrB6oGyvhrW/hWdp0j9IfsLiMgf4a:atPg4Cd1Og2XKiU2OVMKW/hWdpU4
TLSH
T17EB1FB31B46D99B725F6E945B5063943CEB0A09FAA106FA4DAE94F2C12E72EC1343513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5db2d7d888a03be1c8658f39ed4ede83465e73e4b94ef7f474a0094d877ec85a
MD5 c6880b6f4714ebf4884355171c3207dd
SHA1 a32aa5a962057accc370f31f605cde30cfc443a8
SHA512 e63df2847f95b56b0566909c7e2fca3f314ebcc49318a98a5e98b69f9fdc224bda9762952768c8aac5c0a383f5bdf629d1a48f54a521aa661ed04e138d92b0eb
SSDEEP 96:4C6Md+pp4Cd1B3fkg2Xf2iRDotok50RDrB6KzGyvhrL3dybLHAv4a:4CPg4Cd1Og2X7DUDUVzaKL3dybLK
TLSH
T186A12A31B47D89B715B9E448BA063A03DFB4A09BE6516FA4D8ED1F2C21F72F81352607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download