5db9e6c0592b86fb96c3e4b9bf4344f9ec553b70b9402ce0c0f2df78732c6b76

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fresno_Year-End_Bonus_Form_2025_04251.html
Size 8KB
Sample260709-tzwpcsdv9l
SHA256 5db9e6c0592b86fb96c3e4b9bf4344f9ec553b70b9402ce0c0f2df78732c6b76
MD5 24340ae603da415718400dd9df7388d6
SHA1 8f758795377c436d6956b4458ca0b60215dc0bf7
SHA512 1a6bc5be4b14ea7667c91035df0613631e6e46b347eab6172052f4bd1becd4b362247b0b5cdaf7c7e2489451688e3f0282544c9a0484e20ffa85e4c87963a92e
SSDEEP 192:VqiOVjaC7EsnGqmCc4CdmCHFGClFqdU3C20p4ecSBXsKsLlr8JY:aCA4ezC
TLSH
T1FC12C12092A01F65506A9CD0B34ADB5A7B66035357018E7C76FF2A769F8D89103EB3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5328	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
6292	chrome.exe
6292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe
Token: SeShutdownPrivilege	5988	chrome.exe
Token: SeCreatePagefilePrivilege	5988	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe
5988	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 6352	5988	chrome.exe	85
PID 5988 wrote to memory of 5328	5988	chrome.exe	86
PID 5988 wrote to memory of 3300	5988	chrome.exe	87
PID 5988 wrote to memory of 6632	5988	chrome.exe	88
PID 5988 wrote to memory of 3300	5988	chrome.exe	87
PID 5988 wrote to memory of 6632	5988	chrome.exe	88
PID 5988 wrote to memory of 2892	5988	chrome.exe	90
PID 5988 wrote to memory of 2892	5988	chrome.exe	90
PID 5988 wrote to memory of 6712	5988	chrome.exe	91
PID 5988 wrote to memory of 6712	5988	chrome.exe	91
PID 5988 wrote to memory of 4632	5988	chrome.exe	92
PID 5988 wrote to memory of 6248	5988	chrome.exe	94
PID 5988 wrote to memory of 6248	5988	chrome.exe	94
PID 5988 wrote to memory of 5976	5988	chrome.exe	95
PID 5988 wrote to memory of 5976	5988	chrome.exe	95
PID 5988 wrote to memory of 5636	5988	chrome.exe	96
PID 5988 wrote to memory of 5636	5988	chrome.exe	96
PID 5988 wrote to memory of 1956	5988	chrome.exe	97
PID 5988 wrote to memory of 1956	5988	chrome.exe	97
PID 5988 wrote to memory of 5176	5988	chrome.exe	98
PID 5988 wrote to memory of 5176	5988	chrome.exe	98
PID 5988 wrote to memory of 3396	5988	chrome.exe	100
PID 5988 wrote to memory of 3396	5988	chrome.exe	100
PID 5988 wrote to memory of 3772	5988	chrome.exe	102
PID 5988 wrote to memory of 3772	5988	chrome.exe	102
PID 5988 wrote to memory of 6168	5988	chrome.exe	103
PID 5988 wrote to memory of 6168	5988	chrome.exe	103
PID 5988 wrote to memory of 3208	5988	chrome.exe	105
PID 5988 wrote to memory of 4156	5988	chrome.exe	106
PID 5988 wrote to memory of 5108	5988	chrome.exe	107
PID 5988 wrote to memory of 6292	5988	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fresno_Year-End_Bonus_Form_2025_04251.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb9e88c728,0x7ffb9e88c734,0x7ffb9e88c740
  2⤵
  PID:6352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,17600251953136502476,7513383008611467428,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,9907992681526547328,9060851555994143402,262144 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,12893307440627379702,2436640898720561658,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:6632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,5434852844549324524,8099685190345183958,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,14667086310755233323,14796245076618139886,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,913285851167120536,1153265491250932154,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5340,i,13254323110656104589,4413362256931381197,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5384,i,7955221822100591652,3098486746831474016,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,13824137825480434188,17722948717121832851,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,4571180107330019947,11449683047303647747,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,1636335144513785243,18105550685339629739,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6136,i,8273782364245591088,10881112098554909908,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5908,i,17870824242144971383,8521345717522058145,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5948,i,355804825671528456,10489714218825227788,2097152 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,10016086613649282294,16400927116886335920,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:14
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,14241203979124884001,2960788657899879878,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,5562921872054501240,15880685505365416309,524288 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5604,i,5295556013565985215,15322179839510995443,262144 --field-trial-handle=2304,i,10512616519535591511,9500326749821589251,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d26c99a10a06d26a7d2ffc09bd5943ebe43181cc1ca678e87aeb1e478af61353
MD5 f0eac642f3908f51a232fcdf8f5f4764
SHA1 2d674b46252d042822def87d813efa9a631c0699
SHA512 570831f6b21f774ffd1a4d2f2166018794d3ec8afac38dc56e70cf57fc35b40b737d9811f95662c673a35732d94138477ac51fdd494309e129420b6ca6c5b9d4
TLSH
T14C417DF7C3D8857D891156F4AB256E1BCE2A0918532C3C66C8D8AF1FA7E2871D20065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f2748522f810ceb0a4e504462ba816c0dc00ae8e11e8a945d7d2f63e07c4910b
MD5 0dfa84bbbcd8135ec9a2bf48de07f328
SHA1 fc87e7aa473fd69db12ad6883a0ddf7bf4e8e996
SHA512 68c501fb0a9bcec80457868cff8e5a419777e397ab10a60f50d872fa45e92c193565687a44cbe2a01012d1fabc8944bd6c616d625baee3ee8cf1cc6fe05c582b
TLSH
T1B0418EF7C3D8857D891155F4AB256F1BCE690A18532C3C66C8D8AF1BA7E1C71E20055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 8737d4f5b4d802d7a2463f8d975d8cc964726c15b3a2bf2926270a557f5e4a71
MD5 4fe9a2279455203ad7a7e65fd5b6374c
SHA1 f58d3d27cbd973dbd8451a32bdfc103687d26b96
SHA512 35840aa267da9fc3798fc5e6500267d42cb100c7ddcdadcf19411ce0e42e51049913c600e6d2e4ad8fa979a341f7c0ec580e01047d97b4fe1b58a92ee71d8387
SSDEEP 192:+RzBRCV+v7FTvAPRp2Cx9CHsb+WNng32hJVyIsnAUge:+RzBUV65T6Xdkw42Fe
TLSH
T13E22826EB914697BADCBC229F9217B93E7F5102572E42E40E7FC8A2C11D75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6ae54f172375effc4e376f80bd32ec2aabd186a6fd83726de8916bc2914822ce
MD5 4f19e7576300d9026e5597f6bd8c3282
SHA1 52402aad4f2476d8f9aecb38785e026df1b3fb8c
SHA512 39286ed6780de7d1667dfb9ece3c06ba970baeb41dd8b2fdb322d1ab58efd735de6088c7a154f4d186f2d3ac2c731ab084c7490e9f58db30ddd80d7682970402
SSDEEP 192:+RzBRCV+v7FTvUPRp7Cx9CHsb+WNng32eDVyIsnAUgE:+RzBUV65TeX6kw42KE
TLSH
T1D632826FB915697BADCAC219F9217B93E7F5202172E42E44E7FC8A2C11E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e535f68c017e56fbaf6c4a2492a8f3e07ddec7dfa474143db995e801f36ae75a
MD5 b240046e497a764ebb5937b85cad8de4
SHA1 4a73250f73401cf422c4625eebca767bee432932
SHA512 9e0c762683e6f55f3020629381f17e131cbcc03889f5a898a7b3433ed44570619b96ea70b991c391df81b34ed62701c0b08ad4c955aae3a6a5fc2ee4de22c93b
SSDEEP 96:MWC6ed+CNkx/Fc5vBh2F8vIfjnNA8XsroSl8h4otop5g9BDNB6xGyv1fQBFv1QzF:MWC11N2c6AGViU2gDT1wQBF+6wI2iU5L
TLSH
T113C10976686DAC7359F3D85DB1132B43CEB4612BAA50AFA4EBD94B0C11EB0EC1382512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 cd3b21d62042d9c91d9828e216328ae5c75bf69114e5cf746c21239544bc4955
MD5 be7a5028148b49a6d626ef49a85a0dec
SHA1 0388540c4d25289c53efb7d826b37b59840b56bb
SHA512 a051b60e09dafc5bffe54e7290fb90819e08fecfa3766d6a4fdd1b84dad62986e17a0b46bd05ed0d1dc3bcfd88d75f0eb10ffbe163330307bc1c083f1b9ae113
SSDEEP 96:MWbJ6ed+CNkx/Fc5vBh2F8vIfjnNA8XsroSl8h4otop5g9BDNB6xGyv1fxbcI249:MWt11N2c6AGViU2gDT1w9cI24uCou
TLSH
T172C1EA72682D9C7789F3E44871032E43CDA8612BB964BE68FAE95F0C01F75EC5382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5d317c3347d25c725a4daae6d0bfc1ee75ee604f54f2b5ccd26db687ceafa8fd
MD5 2f905bb443ae3abafb74eb374bb6adfb
SHA1 9c761bf45942b77f25647bfc4fa8e73964f67a32
SHA512 3e1a6d275b8d0811313dd96c60c4c4c25f91eb37d6f73a95c2ab82ee8ae7021ea57c53b40d921bc0bb5b0744b289b2fe39202f834e58bab99210c6365fc667ee
SSDEEP 96:MkC6ed+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5g9VDNB6xGyv1T52qbKv4a:MkC11N2c6AGDDUDgLT1U52qbU
TLSH
T1A9A1F732682E9C7388B2C948B6522F43DEB8712BB521AF98E6ED4B0C11F74EC1381516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1dc8758fbf83a05ff2b149d6061c5e0ccb3a6000fc7fe3b84d6458c78d46c117
MD5 fc025ce8b5f906112f8ebebc787f9a0e
SHA1 404c2289512f3aa647e9da4a3c05aa0ff3272ab5
SHA512 80dc02859cee9195eb12f3ba9ef4c907d1ad298e986971079741e3a7fa0aa484aa44605508c83c980482ff975c9878fd2f463ce3da65f9e5909a88be33442adf
SSDEEP 96:MWbJ6ed+CNkx/Fc5vBh2F8vIfjnNA8XsroSl8h4otop5g9BDNB6xGyv1fQBFv1Qp:MWt11N2c6AGViU2gDT1wQBF+6wI2iU5L
TLSH
T18CC10A76786DAC7359F3D45DB1132B43DEB4612BAA50AFA4EBD54F0C11E70EC1382512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download