b34ae1704e551a5b751fbd2243ebfbb0eb8539871c98c46693756f1e4398dfb0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jQqCw99fWz.html
Size 303B
Sample260706-ptbpsaa17q
SHA256 b34ae1704e551a5b751fbd2243ebfbb0eb8539871c98c46693756f1e4398dfb0
MD5 af2157dedb18864b50e75d97a62160f9
SHA1 7ee9a9f321c883b83e1a45e96815011d32125b39
SHA512 d096b799d52dd9fc54c01649f291e2e7883f59018bee30572ad71d07eb371010f16c39ff79d743f39a3737d6f2158262302eac1a61eaac4401b2972bb0fd8bf4
TLSH
T1BEE08CE34A999C13527BA690413AB638121700A988C8DCC1C1C566A4AA35B81EA2E034
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278150319153799"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
468	chrome.exe
468	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 2184	5292	chrome.exe	88
PID 5292 wrote to memory of 592	5292	chrome.exe	89
PID 5292 wrote to memory of 592	5292	chrome.exe	89
PID 5292 wrote to memory of 3932	5292	chrome.exe	90
PID 5292 wrote to memory of 4472	5292	chrome.exe	91
PID 5292 wrote to memory of 4472	5292	chrome.exe	91
PID 5292 wrote to memory of 1488	5292	chrome.exe	93
PID 5292 wrote to memory of 1488	5292	chrome.exe	93
PID 5292 wrote to memory of 5520	5292	chrome.exe	94
PID 5292 wrote to memory of 5520	5292	chrome.exe	94
PID 5292 wrote to memory of 4428	5292	chrome.exe	95
PID 5292 wrote to memory of 4428	5292	chrome.exe	95
PID 5292 wrote to memory of 2344	5292	chrome.exe	96
PID 5292 wrote to memory of 2344	5292	chrome.exe	96
PID 5292 wrote to memory of 1244	5292	chrome.exe	97
PID 5292 wrote to memory of 1980	5292	chrome.exe	99
PID 5292 wrote to memory of 1980	5292	chrome.exe	99
PID 5292 wrote to memory of 3420	5292	chrome.exe	100
PID 5292 wrote to memory of 3420	5292	chrome.exe	100
PID 5292 wrote to memory of 5404	5292	chrome.exe	103
PID 5292 wrote to memory of 5404	5292	chrome.exe	103
PID 5292 wrote to memory of 2180	5292	chrome.exe	104
PID 5292 wrote to memory of 1500	5292	chrome.exe	105
PID 5292 wrote to memory of 2180	5292	chrome.exe	104
PID 5292 wrote to memory of 1500	5292	chrome.exe	105
PID 5292 wrote to memory of 5928	5292	chrome.exe	107
PID 5292 wrote to memory of 5928	5292	chrome.exe	107
PID 5292 wrote to memory of 2060	5292	chrome.exe	106
PID 5292 wrote to memory of 2060	5292	chrome.exe	106
PID 5292 wrote to memory of 3552	5292	chrome.exe	108
PID 5292 wrote to memory of 3552	5292	chrome.exe	108
PID 5292 wrote to memory of 2024	5292	chrome.exe	109
PID 5292 wrote to memory of 2024	5292	chrome.exe	109
PID 5292 wrote to memory of 3284	5292	chrome.exe	111
PID 5292 wrote to memory of 1380	5292	chrome.exe	112
PID 5292 wrote to memory of 5620	5292	chrome.exe	113
PID 5292 wrote to memory of 468	5292	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jQqCw99fWz.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8c008c728,0x7ff8c008c734,0x7ff8c008c740
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,1075346025639860437,10678412706849811989,262144 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,767169644124097081,765866753725481908,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,13008875491568158117,17083766069637664868,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,8724151975544066245,1444078754060470031,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,9038122178665834667,12948856520768584563,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,15899243511608619552,5343200747897888511,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3868,i,3962478136877975670,302768625625269481,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,997637381896638475,16598254678709054596,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,14159537106922511835,15864726796907820887,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5564,i,748824715800190423,1852948052991391058,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,14492131071318110057,13454321271381608733,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5832,i,3186666054470398162,16441916077127425162,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,14979151883137358352,15617206883142636373,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:12
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5844,i,4535350820853680208,17856649791117288296,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5492,i,6745132883970925558,16004346391934961481,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5792,i,17306958670455647910,8760364829259765712,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5788,i,10409040043169343244,10333779444843842659,2097152 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3516,i,17698983042036341410,11664055918490837400,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,7688098373891729486,9096623285113338207,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,1255036877730887848,16708918983058750977,524288 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5104,i,11278449141249983574,5084137174288876328,262144 --field-trial-handle=1924,i,12484859669574033278,13195925217467254602,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 b10b2d30de60de8b0e19ea3c5e38b645832d68417b2e858c7998e87c97b91127
MD5 49f4cc452a8dc9ec1b6c11e571e6a857
SHA1 acde40734115d1341b1fd06f73ee428099ae7c2c
SHA512 237e753cd9acb73a2e69fe0481881fef71636537941003b8ac6cecae77154cd825440f14f6109dce9f60302a06e67052432ced28db306bbb77dd879fe7b329af
TLSH
T1A601971A17E244C2DB58C2F5B4E838083775F2F651C35FB9C4F4027805323A5305C095
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 11d758bd1de680585723af0cfe56711fae641c76e742e471f838d7ce3c6df2a5
MD5 f08e04199af7b8ac95f05910c0594823
SHA1 158f96248ef78b8546928a09e3beb5e361352d7c
SHA512 2d6b945d175b91b0c9a8dcf860b74482c046df5e801156b62e2a790cb39408c044f42febca84ce20c4f5c65fd81711b5eb6365b0cd6162c7c71b3d14065dcf6e
SSDEEP 48:YALlUVGnUVGh8sfRsxXLs5foKsWfsEosJKs74sHUisnGUTsBU8bUzsAU4WzsoUbh:DpnRq85t5JH8GtJbONUKEEvPWUReK
TLSH
T1DEB14CF7C7E8967D8C1156F4AB152E1FCE5E0A14932C3C2AC9E4AF1B57E2871E20064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ca7b7c292faf0c9f3932e7e4f9f3ce6d4a6f52583b75883534136a2d213e64ce
MD5 8f856e7a94b2b39dd3fab6008b1ed25d
SHA1 08a30d211308274efab90ea4b9715de5d9a3d596
SHA512 9ce7c09f8b2a4e672df394c25242d244011f5dbc19751faaf6847af363dbc1fd53a4e10446deefbf04eaeb3509307ae8a45b046975b1a990fd9edd8fb70f972a
SSDEEP 192:DRwHPJHv7bvAPRp2I8Pw9KHsb+WNnnocPHJmevkwvn+VyIsnAUgR:DRwHhPP6XVcwnjPHJvf2R
TLSH
T11D32A82EA954753B5CCAC229FE257797E7F5102125901F88EEFCCA2C16E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 91fe6c161b513e30be86a5b8bdf822f323474247a269b55894a7043e9dbbfe8c
MD5 d9e7e04b4a55d4b17b70eadf5cc0884a
SHA1 17ec21022a0be2e2556dad26a8fc706c639b7795
SHA512 a624133d559aee9519e4991d3dc1e4cb5b3155b4f3116c5b64d6c4d4e8cb3ff966b6a6e0e251fc001b1900175adbe9cdf59cc11201a875533bad0094db1e18cf
SSDEEP 192:eh+4K6JF7KxkXqK4I40pUZNCgVLHrKHfFKslEC53XzKD/qF+ErUkKN9yehw7YgHZ:s+jyF7KxkXqKf/pUZNCgVLH2HfgslJ3V
TLSH
T1AF32D827A48D9A7F4FD8D508DC136F8BADB4025672284D2856FB6C0803E97CE215A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9c15c2d-b53b-4a5a-aa84-bf40a5e5dc45.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e9c15c2d-b53b-4a5a-aa84-bf40a5e5dc45.tmp
Size 12KB
SHA256 812965547035828426226c333be0d4651da69602cd470a2c746c7b3ae3184ec1
MD5 1d2668e790a44e3ab8cbb51e9eac5ba1
SHA1 ce2a375d87d7011087ee33dc3269496ec83c7b8e
SHA512 a79a446225524a1bffa4d13a22513f7f771860035ca0109010a5cf2536fc335aa0777ebfde26afb4eddec119c372fde67ae0fdfe7d985dbf2f721e07dfb52174
SSDEEP 192:DRwHPJHv7bvBPRptI8Pw9KHsb+WNnnocPH7omevkwvf+VyIsnAUgE:DRwHhPPRX8cwnjPH7kvH2E
TLSH
T1A142B92EAD14753B5CCBC619FA2577A7EBF5102161901F88EAFCCA2C16E76CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d11c30c7f5c06d16d6aaa3dc479bc01cb2d3f3fe9401ef709e698d9f524b89d0
MD5 adbe08ca5914bd01417fd192b9499043
SHA1 f803ab8d38a67600f54d6731c1e3015b120e8ec7
SHA512 dfbfe303f17657f5e0cc5e11c18f36429e885a98612c013908fcf8e355ccccb160f7c3e7e74c951fe2a5257e8f607c3af3d20d8204642e879222d0d26c1d7f3b
SSDEEP 96:vbJ0d+xHjVupEnr/FmK9f9N1VzDESl8h4otop5gpaD2B6qGyvGm9NOpYvRNC39IQ:vt0K2WTcMNTIiU2+cmis9NOpYvuCo
TLSH
T173C1E676A42E997B48F6E585B1032993CD78215BBA24BE98FDE95F0C01E74EC1342533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e97d54203d0ed287139dbc05cc6f50a832a7600e111f7ad0e58b4c712c5049de
MD5 2bed8b7f8b143f6b975927fc50fad6f9
SHA1 3ab1004d070147b4bcc94b530fde7d79ca39dd0e
SHA512 57fc00b356d7e3342b3a0f038c9f416b517284fa2d57935432fb46e3242b58ec40634224840c8790d8de1f68a650347394a5e0f8ba21cd613ade71a3edec30e4
SSDEEP 96:vbJ0d+xHjVupEnr/FmK9f9N1VzDESl8h4otop5gpaD2B6qGyvGm3M/uBnp4i4pYx:vt0K2WTcMNTIiU2+cmis3M/uBnpL4pYx
TLSH
T16FC11976A46D987758E7D285F5073A97CE74315BAA60AF84EDDA0F0C02FB0A81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f1f1d15cda11da17bea8f5da79fa8a3811769ecd5647195a2e73669773c6df8d
MD5 1ccf010db4a78aaec97ad44d40c4bf48
SHA1 61ccbc52dc90b8b1a91a33676b33e9573ddd751c
SHA512 82d772014de78a132d0281a2b0c250cd8aba83446365e15324764722563740842fcc5f89477b39098abce69a4996e9a060e317e9398d028cb782240b13fa381a
SSDEEP 96:vC0d+xHjVupEnr/FmK9f9N1VzDESl8h4otop5gpaD2B6qGyvGm3M/uBnp4C4pYbt:vC0K2WTcMNTIiU2+cmis3M/uBnpN4pYx
TLSH
T140C11976A46D987758E3D285F50B3AD7CE74315BA960AF84EDDA0F0C02FB0E81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fc67d545320dd312e8ad2efcb1e5b541a46d931dcbbf71c4ce14d4e7c6e7bf48
MD5 a5e693173a355e28a8d8bf84a1238a37
SHA1 cba9a74571b1da5b753de8aaeca19a25e52b17ea
SHA512 7628c49031b6d61d37433c29181c0425399b3b5fbc3a53e67b89b141e8ba99e18519e5d4136dbf563cf70ab19568a23856bb1c83c1d3c63f66baaa725d9b31f6
SSDEEP 96:rC0d+xHjVupEnr/FmK9f9NIzYRDotok5gpzD2B69GyvGl4YCabgv4a:rC0K2WTcMN1DUD+Hmhf4YCabK
TLSH
T106A13836602A997B08B6C989F5463A53CE78615BB921AFC4FCDD1F0C16BB1F81302637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download