a76929761ea6eaa801109b7ca6765dfa444335eeb9d164d460150ce4929c4ed9

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
300s
max time network
298s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1488704609513111644.html
Size 35KB
Sample260709-bjnppscs41
SHA256 a76929761ea6eaa801109b7ca6765dfa444335eeb9d164d460150ce4929c4ed9
MD5 14d47049ae238ee2c599dbd28d44480f
SHA1 630ede0f541783de95010d7767316b7367c69bed
SHA512 8d14c19f9068c808c627b2ec394908dfd4cbd90d0304060f75e069d660f9f3075dfb402cd66643a5586e15002aa106bc72f168ee4317fa0e8fb14d3089e3cc72
SSDEEP 384:69H1DrKENq65Y6CBPo6/EgjKLiIoVxeX+GtRMN4j56q4SAiVjyweNvtnx/0:69Hq67lUKSreXpgN4j8q4h+jXeNvFx/0
TLSH
T12DF28D58DC09C6A870313E97F575F1EEC589B20ECD35EA3894F9922DA634FC449A6C32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5792	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280330924730628"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
3172	chrome.exe
3172	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2884	4948	chrome.exe	88
PID 4948 wrote to memory of 5728	4948	chrome.exe	89
PID 4948 wrote to memory of 5728	4948	chrome.exe	89
PID 4948 wrote to memory of 5792	4948	chrome.exe	90
PID 4948 wrote to memory of 3272	4948	chrome.exe	92
PID 4948 wrote to memory of 3272	4948	chrome.exe	92
PID 4948 wrote to memory of 944	4948	chrome.exe	93
PID 4948 wrote to memory of 1328	4948	chrome.exe	94
PID 4948 wrote to memory of 944	4948	chrome.exe	93
PID 4948 wrote to memory of 1328	4948	chrome.exe	94
PID 4948 wrote to memory of 4532	4948	chrome.exe	95
PID 4948 wrote to memory of 1152	4948	chrome.exe	97
PID 4948 wrote to memory of 1152	4948	chrome.exe	97
PID 4948 wrote to memory of 1416	4948	chrome.exe	98
PID 4948 wrote to memory of 1416	4948	chrome.exe	98
PID 4948 wrote to memory of 2520	4948	chrome.exe	99
PID 4948 wrote to memory of 2520	4948	chrome.exe	99
PID 4948 wrote to memory of 2372	4948	chrome.exe	100
PID 4948 wrote to memory of 2372	4948	chrome.exe	100
PID 4948 wrote to memory of 4320	4948	chrome.exe	102
PID 4948 wrote to memory of 4320	4948	chrome.exe	102
PID 4948 wrote to memory of 556	4948	chrome.exe	103
PID 4948 wrote to memory of 556	4948	chrome.exe	103
PID 4948 wrote to memory of 1296	4948	chrome.exe	105
PID 4948 wrote to memory of 1296	4948	chrome.exe	105
PID 4948 wrote to memory of 1648	4948	chrome.exe	106
PID 4948 wrote to memory of 1648	4948	chrome.exe	106
PID 4948 wrote to memory of 5080	4948	chrome.exe	108
PID 4948 wrote to memory of 3488	4948	chrome.exe	109
PID 4948 wrote to memory of 3296	4948	chrome.exe	110
PID 4948 wrote to memory of 3172	4948	chrome.exe	111
PID 4948 wrote to memory of 1956	4948	chrome.exe	112
PID 4948 wrote to memory of 1956	4948	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1488704609513111644.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd8039c728,0x7ffd8039c734,0x7ffd8039c740
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,15057509152394049545,2187253364878335584,262144 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,7523658605633564631,11151900725316616713,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,13259816494806659585,13592347238591834019,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,9140355460909801316,15663871238853715913,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,15993275139841118439,2644619183453172937,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,91410474417607924,5750442578989165207,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5456,i,9150910215968219593,7010949802106510355,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5544,i,17805150366772094540,5170495914809670561,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5580,i,12354583805502146832,13505678801030152365,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5464,i,4673669284103979346,8766887140466152402,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5972,i,5209547647316492090,12705595764011918863,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6348,i,11333383415420653278,6210522182059174883,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6404,i,8123912762281725073,5976581710439722341,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6688,i,8031983748176897765,13425909829277519659,2097152 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,8721877890130510408,8709693943322268625,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,7529444112501111821,9719493072586884102,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,5726615765059552752,10756130814199138067,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5560,i,14800168281903774126,4053490706270522758,262144 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,10988462504102393688,9278637437983464188,524288 --field-trial-handle=1896,i,12540236394300631811,2952012050845032578,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
  2⤵
  PID:1956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 05ba744f74322b13679dd03bfc39980139e6fdc3079ad7586255066b22c6478a
MD5 84feda7998dce719ae04c72a83be7a7b
SHA1 ca8dce20465a9f1f06e89efbe08895ce5e299544
SHA512 0a4dbeadb4e407bc0dce36cc02799b1682862d0114376e293595e7659ad67a9ded05a066365645e9ecfec8243d62a75a1439f960ede8da9e4841e2721e4e5459
TLSH
T16741BEF7C7E8957D891152F4AB256F1BCD6D0A24432C3C26C8D4AE1F63E28B2E20024F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 44ffdd7c34ac24b172f86581c6e7e779dc94cf40bd5999b9dc25fb6c43986273
MD5 68cdb27f1873df42aaf7e004c7f4c0e4
SHA1 67b94caaaca906876efb23b50ad348f2dfd2d20a
SHA512 cc4482ce4671e0ea9112ce4185031714ecf11bbcb6cf8c5a0b9c0850a291cdddc930fbdbc8b4aec86ef092c57fef30f2b9780a0fdc244b27a9e5a32913eeb699
SSDEEP 192:wRBwyr0DSfpoB6SfwaxKhp9JVv739vAPRp2u794Hsb+WNnyhPmerg/eKRVyIsnAC:wRWyr0DShoB6SfwaxKhp9Jlh6Xn6wUPh
TLSH
T17532B62EAE11B93B5DCBC31AFA657793D6F5103122943E84EAFC8A2C12DB5CC2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fd9de8e11b2a8afb8b30efac5b4d6466b7ef54e71a3392dc586d9089ee106a13
MD5 0a695a8dc70ca6c195860735fe445006
SHA1 8ad48701bb68859257c19a7dfa5a30c32895a5a8
SHA512 c38cc8cc9ec7c868d018054238b306faf4e474528244633fb78e13dbed2d50fc1d36258c76c2e2216574f015130ffa5a6ebbccc9fe1ce9cb0181fa08c7dcd5c9
SSDEEP 192:wRBwyr0DSfpoB6SfwaxKhp9JVv739vy0PRp0u794Hsb+WNnyhPFq1erg/eKlVyI4:wRWyr0DShoB6SfwaxKhp9JlhamXV6wUh
TLSH
T17E32A62FAA11693B5DCBC31AFA657B93D7F5103222943E44E6FC8A2C12EB5CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 589e4273c7552e29a370f4a2216f579be9fefa95636fb079a32114cb11690a56
MD5 1102834399720ac0ae3d4704f754f13a
SHA1 0580dbeb17759a5ac1a5448e7e4bdd955c2001c7
SHA512 4f3d027f8284d823b9d5d8e3648439dba2c2fce649e6cfba841d7acd0e55eb81c7d35cec1e708429a19b8c34f8cf38b83a333677f40f62ee633963023eab6b85
SSDEEP 192:ehE8c4K6+I7KxkXqK4I40pUZNCgVLHrKHfFKslED5E81XzKD/2E8d+ErUkKN9fE4:XljlI7KxkXqKf/pUZNCgVLH2HfgslXMg
TLSH
T10F32DA27A58D9A3B4FDCD60DDC126F8B6DB4019263780C2496FF9C0403B97CA215A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9fac223cc6229ee91eed2476ff307cd5e9a2596c68964dab03a225a5ca4fd274
MD5 7810b877475d18f67c0be8ad4f8bd1d5
SHA1 1c8440beb78d6fc32a2111ff57bfefec180357f8
SHA512 26c0d75ca0a2581ef33fa46a0e28ed9a2b616db81a9da907a575b27517d8e7f1cc428adaa2b1216961bdf8197f4dc6f3a3eb7dd47ac472fd20d1cb6785c0afec
SSDEEP 96:blC6Kd+nDPUk2hSPkJfkdWl/M1RDotok56MDdB6mGyvRVFyexbyrv4a:JC18l2hScidWl6DUDvDuMyexbyv
TLSH
T164A1F936A4698E375977C5C8B9523E43DEB47067A512EFC4E9ED0F0C46EB4AC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8a378476c4727017c133075f324e19123d18633a34023c10aa87e4b7998f1d88
MD5 0e03cbb1de49fb21e1f3ff948db99e14
SHA1 4a1768efd31dd26479f16894d3f9f83e0cf1d41d
SHA512 dc71ca7d03ccefa728b116c6f9482b0cb3ecc0567ccea2f00715cafbf2acf09af47fd477ce2f788ae5faa6c258bbcbda9d8efefc0386416a923066d3b62ece03
SSDEEP 96:bVC6Kd+nDPUk2hSPkJfkdWl4hM3Sl8h4otop56mDdB6hGyvRVAZNSxwz3Scd2RTv:JC18l2hScidWl/iU25DNBmxAuTje6UXE
TLSH
T18EC11A76B46D9D7325F3C695B5222A87CEF430A75B01EFA4EAEA0F0C02D749D1382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 4f1ecd3b34bdbbe4b6176eba1a4ffee34a21d29ad883c5f639e69fee9a671275
MD5 bc766b289be123703704d1b0e68ec755
SHA1 115c563ab9eae6989ea1b30c107aa592833d3bb8
SHA512 a49bbd22c94a71f2695a99cc565c4d2ab389f45215accff3a5d65815a207fc34a1ba88eb83dcf52dd0e32a93908d07a3b1c6fb55b7667f6a16321f5a6ab4783d
SSDEEP 768:/qlDcEzbb2ehtnH8E8avzGRm1gxAZ2ECRFaDoCBrsCneOvWpodz6:ylvT2icE8DmOxAZ2faDfRsCfvc
TLSH
T16713F1A3803C9DB764779D50F20770C68FE91D4715644E8E9CE9AE4401A738CA7CABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 04433f2b765593d83861b61fa9f78d40e651cd672912596a40d11946e4b29b85
MD5 2e62ff207fcd79053720d93e70a4c746
SHA1 c118fe0613bc8ef46b1fd36018f10e5463177484
SHA512 856988b7b696e4a9ac70379085d6b03b399f318eca228059b2b76d2e522a137bdacac2cdf0dc71774d372ba42eed42a9bfc1d3d4c7683df31b124fd2f4a3239d
SSDEEP 96:bVbJ6qd+nDPUk2hSPkJfkdWl4hM3Sl8h4otop56mDdB6hGyvRVAB1jeiRNC39ISC:Jth8l2hScidWl/iU25DNBB1jeiuCMbO
TLSH
T1C8D10875942D8D371DF3E589B1432D43CDA8206B6A05BE98E9ED0F0C02E74DC4383227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7ce5eb27c261a82733d79e307953d680d94be9205b78c3478d3c0e70b5676908
MD5 16fc3d148af0badaae46d0fe560db47a
SHA1 0e765c7c7d5a5fa4e16d4b5defc5d98be3d44c2a
SHA512 102d22474703d40dc422c9b76ee3b4cc38eeac6d513f3f9119c0bf3aac072de1f1bb762e15feebb9ffa2ade34955c595b3eb89c15007e4d0ca62b3bae9162b7f
SSDEEP 96:bVbJ6Kd+nDPUk2hSPkJfkdWl4hM3Sl8h4otop56mDdB6hGyvRVAZNSxwz3Scd2RT:Jt18l2hScidWl/iU25DNBmxAuTje6UXE
TLSH
T157C11A76B46D9D7315F3D695B5222A87CEF4306B5B01EFA4EAE90F0C02D749D1382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download