969cf71a1490fb6a6e7f5b17616216f2fe64eb2d1efb3b4f05369a96c50b390c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cpclso5wyx4s.html
Size 5KB
Sample260714-rt99fsew7q
SHA256 969cf71a1490fb6a6e7f5b17616216f2fe64eb2d1efb3b4f05369a96c50b390c
MD5 1d0109e72b15a55642eb1c5f24aa925e
SHA1 9a8bd4be803b8d3d7dbd57caf666af5048d788b8
SHA512 a18bb0f2e52ac386db551dbb602742edc870176486465b00846dfbfa05c97d29868fc667f5c4d68dd3ed69eb629b18449b16c56e3306a1916c8ff49cefa673a9
SSDEEP 96:PNyEtoXZzIEb0EaW878cOwyXsf/YeYluY31n2D+2vNwkbdYkLiYzueh8GYymw:PN1tkCBgwyX8/YeYluY312DZPLvyUYVw
TLSH
T171C14CF3BE305012D7E63B6724FB73288231B754B604908DDA90D62D95DEFCE806869C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5224	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285130400891342"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
4552	chrome.exe
4552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe
Token: SeShutdownPrivilege	956	chrome.exe
Token: SeCreatePagefilePrivilege	956	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe
956	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2784	956	chrome.exe	87
PID 956 wrote to memory of 5452	956	chrome.exe	88
PID 956 wrote to memory of 5224	956	chrome.exe	89
PID 956 wrote to memory of 5452	956	chrome.exe	88
PID 956 wrote to memory of 3328	956	chrome.exe	91
PID 956 wrote to memory of 3328	956	chrome.exe	91
PID 956 wrote to memory of 4464	956	chrome.exe	93
PID 956 wrote to memory of 1344	956	chrome.exe	92
PID 956 wrote to memory of 4464	956	chrome.exe	93
PID 956 wrote to memory of 1344	956	chrome.exe	92
PID 956 wrote to memory of 6036	956	chrome.exe	94
PID 956 wrote to memory of 5904	956	chrome.exe	96
PID 956 wrote to memory of 4472	956	chrome.exe	97
PID 956 wrote to memory of 5904	956	chrome.exe	96
PID 956 wrote to memory of 4472	956	chrome.exe	97
PID 956 wrote to memory of 4412	956	chrome.exe	98
PID 956 wrote to memory of 4412	956	chrome.exe	98
PID 956 wrote to memory of 4784	956	chrome.exe	100
PID 956 wrote to memory of 4784	956	chrome.exe	100
PID 956 wrote to memory of 3084	956	chrome.exe	102
PID 956 wrote to memory of 3084	956	chrome.exe	102
PID 956 wrote to memory of 3580	956	chrome.exe	103
PID 956 wrote to memory of 3580	956	chrome.exe	103
PID 956 wrote to memory of 2836	956	chrome.exe	104
PID 956 wrote to memory of 2836	956	chrome.exe	104
PID 956 wrote to memory of 2600	956	chrome.exe	105
PID 956 wrote to memory of 2600	956	chrome.exe	105
PID 956 wrote to memory of 5432	956	chrome.exe	107
PID 956 wrote to memory of 5428	956	chrome.exe	108
PID 956 wrote to memory of 1280	956	chrome.exe	109
PID 956 wrote to memory of 4552	956	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\cpclso5wyx4s.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa06f4c728,0x7ffa06f4c734,0x7ffa06f4c740
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,7247147527769596013,9745756036405717229,262144 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,13044049597097093030,3010659938049395343,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,4408569457471953289,4934382495423114594,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,16176194227401757197,18317172627415069714,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,10368782488745110881,15819360174296236184,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,8476767785639812915,9590994164989434264,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5316,i,4631231109673414943,17445641340511102297,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5328,i,14372726043422863325,2352283727421638807,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,1069777313648123604,1629185203108904354,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5892,i,6952285426022876739,9760296394503964911,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6036,i,15789299054568054121,2648492983893087135,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5908,i,347968570371130267,643710543441601997,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6136,i,7509412816114943293,2665711547758961978,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6400,i,1700562231943937660,15712390510596123897,2097152 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,7043649159682212642,4751943845025027053,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,7402344930501295634,6907021115060119128,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,13211910241997428784,15412712920993011438,524288 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5820,i,15654862674462964733,1541837724824895403,262144 --field-trial-handle=1936,i,17424227499478133427,9397558842297352575,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d80837b311d9ee8883760dacb57f4f920831b9bfbe03099f2c1b986122ba713
MD5 c64f10d53d9f0b75d3024e7bd019fce1
SHA1 19c19b956732d08857e6a2a52513250a5ef41feb
SHA512 010eaf9b14c80302769f583eda6330c8d2b4021f4328687b399449c9f477ca22281ceaffea85fb9bbb4869c262d8476de035b1756cd0fce243948b401e3c1730
TLSH
T1CF418CF7C3D8853D8A4156F8AB156F1BCE290A18431D3C66C8D4AE1F97E2872D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 37a9db6e6fabcdf9d86f2f8cc352134b1bf125fb278345d6b71512b7558655d0
MD5 eac23282bc534ac024e65df012918500
SHA1 3ffa6fc8543108dc840965e783466204deb5b7e4
SHA512 bc90c47d120dc3fd6a4fdeecc9c9264ab7ac6cb60275d612033b6faabd45e9a8d2fa295e5062ad8ce973b3d188a36f3918c19bada2c66a1588a8bb3a27387006
SSDEEP 192:5RoVAb7v7JnvAPRp23m99Hsb+WNnboPMbMeeVyIsnAUge:5RoVYDd6X9vwkPLe
TLSH
T16C32A62EA910653B9CDBD219FE62BBA3E7F5102575D42E40EBFC9A2C11E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1275a6c8159df20c4d5668e6f9ff58907ac158c3e4df6a402f64cbddf1b2432e
MD5 e4f72508b954f0e9246fe20969989f84
SHA1 deea2b322fa98ab674568d9957097ea8fb348785
SHA512 0ab5ce2c849d818d693da06467055773920c25fdf1a1d90137b3e8ff2884bbf164bf36206fb466ce6f570fdca4b42ce18e579990ec952c51e553250d55631129
SSDEEP 192:5RoVAb7v7JnvhPRpo3m99Hsb+WNnboPM6MegVyIsnAUgE:5RoVYDdRXbvwkPyE
TLSH
T16D32B76EA910653BACD7D219FD62BBA3E7F5102575D42E44EBFC8A2C11E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 3f7e4137d06646ee119dcb08c93b1e0de5b280e4e9b49f04b66a59297fe0b710
MD5 23a20fabd76efcbff19f9ee603e0212e
SHA1 09457186b0235a79ed0fa7d354ae133697566d3f
SHA512 07981b2ff8f0850c6197c5b24b6823cdd3aa5419b606d2689aae376ec1b702266efb990d9e96c91a622eeefebfd8299f951a9c72b181474d7638e74ccecb02ee
SSDEEP 96:5bJ66Cd+CgjAe56y7nKZwpOfsXa7Sl8h4otop53mIDsB67CGyvk5EjblvTRNC394:5tzCNgjf5ZKSN4iU23pgGzWjblvTuCmY
TLSH
T1F3C1F9B1A46D4DAB5CF6D5C9B1032E83CDA410ABAA65BB54F9E94F0C00F74DD1382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f76876004d26e65f23fb63876689887b2c3543f919c4d88b723c8b00e7ae73be
MD5 2ad2fcef7d02cc8e275f53f61ff9a4a7
SHA1 3f963196e35e568e88e123f97e21321ff0c5666a
SHA512 6546c51b50ce2a08660aa51a2f63986dcf3555439695eb594ecd18cf7ce623f660a86f9cad871ecbc64efc0419be8c7cc191b50c2c81718335854e7ba8570855
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsXa7Sl8h4otop53mIDsB67CGyvk5EMZH1Qzb/Zsoj:5CzCNgjf5ZKSN4iU23pgGzWc2PuoXlv1
TLSH
T1CFC11AB5A47D5DB398F6C1D9B1036B83CDA510AF9961EB94EAE54B1D00F70ED2342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8cbcec6ef5fe22a7e0bf038c2c01fb0ec52d96038ea8098255cd4e7c6ef7afcc
MD5 43224b51ffd9341bfd58f248868ba487
SHA1 ca7d32f4e4ce891c1b9e83008778c2852d7dcd11
SHA512 5719c59d4bb2ec5e00e62e3733e7a8bf693bbb30e37a0d66e8614396af89527994e4db48db12f09029c7ef078ee0ddeff38f35e1742401c46a055d10608de6d3
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsobajcRDotok53m4DsB6vGyvk5pEvTboRYv4a:5CzCNgjf5ZKSNqDUD3Zg7zEvTbog
TLSH
T1B5A12BB1A4690EB794B6C5CDB1527F43DEA421A7A571EF84E9DC5F0C10FB4E81342213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 10e23b25f3f7f8d27fd17f94e9c2f69e26aa4c56096b012c5572008aa25ad397
MD5 ed767730b921d1600299ba9ea4d0b2ea
SHA1 e62d2bac03531c938bc7e8ba236c534181b92079
SHA512 43a99f13f2b913ad820538de03d5b066e88572382ff814662acf21b8d6b50eeaef72975d0aa5336492ceee40ea5fc7e1610d771653f158df316fa96635d0d13e
SSDEEP 96:5bJ66Cd+CgjAe56y7nKZwpOfsXa7Sl8h4otop53mIDsB67CGyvk5EMZH1Qzb/Zs0:5tzCNgjf5ZKSN4iU23pgGzWc2PuoXlv1
TLSH
T1DCC129B1A47D5DB398F6C1C9B1037B83CDA510AF9961EB90EAE54B0C00F70ED2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download