cfe4acd71ed08e4d213943cb3fc9290c6a44b80c74bef28b8b074510a5490f43

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
899s
max time network
868s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 122KB
Sample260717-13phsabs4t
SHA256 cfe4acd71ed08e4d213943cb3fc9290c6a44b80c74bef28b8b074510a5490f43
MD5 17b552018a6644d61b2967a8c33f4219
SHA1 978bf2e0c174c83c2c8818654bf657677ad175f0
SHA512 8cbbc03ea0002e18a62f227e3a8e19c2d11a0fcea34ca1f51bb526759553aeec27b10744690139c940fc31ca1db6ca3d084509ec33eadec26cd6691f2798fd08
SSDEEP 1536:NmBvKYLwT42hck2pukPkZ7KZmWyxuZsNMIWyxuZsj7eyeEEPXDV2EXB3C2t1uQIK:NsEEouQmDUmBNLW4STUZ
TLSH
T163C33A72E1A12236783392D777DB578F72A4D007D8138254F6ADD3548FC7CE222A7A98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287998807117054"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeCreatePagefilePrivilege	1256	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1928	1256	chrome.exe	88
PID 1256 wrote to memory of 1752	1256	chrome.exe	90
PID 1256 wrote to memory of 3268	1256	chrome.exe	91
PID 1256 wrote to memory of 3268	1256	chrome.exe	91
PID 1256 wrote to memory of 2648	1256	chrome.exe	92
PID 1256 wrote to memory of 2648	1256	chrome.exe	92
PID 1256 wrote to memory of 2832	1256	chrome.exe	93
PID 1256 wrote to memory of 1768	1256	chrome.exe	94
PID 1256 wrote to memory of 2832	1256	chrome.exe	93
PID 1256 wrote to memory of 1768	1256	chrome.exe	94
PID 1256 wrote to memory of 5740	1256	chrome.exe	95
PID 1256 wrote to memory of 2100	1256	chrome.exe	97
PID 1256 wrote to memory of 4964	1256	chrome.exe	98
PID 1256 wrote to memory of 2100	1256	chrome.exe	97
PID 1256 wrote to memory of 4964	1256	chrome.exe	98
PID 1256 wrote to memory of 2624	1256	chrome.exe	102
PID 1256 wrote to memory of 6104	1256	chrome.exe	101
PID 1256 wrote to memory of 2624	1256	chrome.exe	102
PID 1256 wrote to memory of 6104	1256	chrome.exe	101
PID 1256 wrote to memory of 3508	1256	chrome.exe	103
PID 1256 wrote to memory of 4708	1256	chrome.exe	104
PID 1256 wrote to memory of 3508	1256	chrome.exe	103
PID 1256 wrote to memory of 4708	1256	chrome.exe	104
PID 1256 wrote to memory of 1516	1256	chrome.exe	105
PID 1256 wrote to memory of 1516	1256	chrome.exe	105
PID 1256 wrote to memory of 1228	1256	chrome.exe	106
PID 1256 wrote to memory of 1228	1256	chrome.exe	106
PID 1256 wrote to memory of 5184	1256	chrome.exe	108
PID 1256 wrote to memory of 896	1256	chrome.exe	109
PID 1256 wrote to memory of 4908	1256	chrome.exe	110
PID 1256 wrote to memory of 1976	1256	chrome.exe	111
PID 1256 wrote to memory of 2232	1256	chrome.exe	112
PID 1256 wrote to memory of 2232	1256	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd0dc0c728,0x7ffd0dc0c734,0x7ffd0dc0c740
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1720,i,13131382711489192259,18104042207919951031,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,9203246489221084282,11824848274783387865,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,2158739237805968734,9457048092080669407,262144 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,4296332374272539152,9903620190705549064,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,4176464627774722353,3330991176238877686,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,8085804543218772987,2253013121110637933,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5280,i,8975907594680900860,4271213372646910686,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,1936049477809655048,11307695370314751230,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5564,i,3471077795061912940,12919789340179594717,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,2856011750745113638,17074237425465745277,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5324,i,1150347079981634423,5033551853674733231,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5232,i,2004118764299521889,15532322662813359940,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,7918209664312664329,9315140004488113020,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5908,i,9582192798213198375,15521201896468535484,2097152 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,2907510897873371386,6197694303206729384,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,16687902144844112362,17978533370058961062,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5990061944947921565,13683151494758634842,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5508,i,6855290571285868829,13926798187618619453,262144 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,4775195585598068830,12356034868375574767,524288 --field-trial-handle=2264,i,16153707831330449271,3106652167573271671,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
  2⤵
  PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

357bbc78-0623-4881-8150-8a9bb493048c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\357bbc78-0623-4881-8150-8a9bb493048c.tmp
Size 690B
SHA256 688f020cb813936b8d12b5d05e8c4df349432d764c172ed1bc0cbf75f327d6c3
MD5 603729059d9702a358d47f1de40e8e3a
SHA1 9c393edb289ce27cf582ba1c8f05833447ff0c4b
SHA512 85c78a72922342c4ac0e989778b4003feafe45ec627a50249dabde35f82130ce6ac1add753229ad603a625d5ee4a7bca3b5c4e5da5adb0d668d70af66581587e
TLSH
T143019EAB9ABAB53750BE4A6F4D04F806ADB5E434064068F8DEA7436CE0814F32B02453
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 650811da905059627761543a366f51619735e42f25a531ebca2d5a8e8f422caf
MD5 961c6ed32c78d710dd375139b3eea9f7
SHA1 6b6d42b81a18eae584917469efece5753b99bd9b
SHA512 eb5cc5c61ed01612ab3d40338ff797bf1a7f8e1e672b7d72dce753a81e11a856e371c885bc96f4632a1c036274b8f944ee464384a8566bdf719f6b3bdc60dc31
TLSH
T1E1418DF7C3D89A3D890156F8A7157E1BCE290A18532C3D66C8D4AF5F67E2872D21068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc2e21a3aaeb01e12fac8c70961ed0e7539a2671fcfb896190718bba292b1458
MD5 aee1ac913236f86f328f8461bca43438
SHA1 9534ce19f7dc982c2ead75be87a1db424eead6dc
SHA512 84eecfead9ae630516e6df5c36c74c5b2c08c44cbdac997264679ffe69ea480dda57b347f8b3f070e26cd7833d4fb689242be739df235cc36debc61e1b7affa4
TLSH
T1ED518FF7C3D89A7D890156F8A7157E1BCE290A18432C3D66C8D4AF1FA7E1871D21164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eba1e76fd24437120be53237cee2defef115df0fa0daba2637ec5bc311dd2170
MD5 0b13f3d7a7b49995f42d39881982dda7
SHA1 971687af97baea6aaf3747524d5ab16fe2e75494
SHA512 c30a3f796e630d78cc811a18e68aba2e3aadd3f0f678e050e6b6f64414646681b0d911ae630c7b9971cdcc1f7a66c67d951b20cb8f60b860d306faba5b39b03d
TLSH
T137518EF7C3D4897D890152F4E7157E1BCE290918432C3C66C8D4AE1F97E2872D21164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 47b3ccf1a3f256ca016e2321afccde4ca56a502b8f0cf0a340aa9588110ed6f1
MD5 c6fbd72ba4f5bb40528b39d4e677868a
SHA1 729d97d883f3f32cec842cec3a8c1b80dd6c1a97
SHA512 f2f3f2a67568ca6a2c9148cae14ad6fe0869304f574319718008102d8c02ea82a1bcdd5b63e16662543205ee4dd5b6b50b82e5678cd21072d350328a89adac41
TLSH
T103518CF7C3D89A7D890156F8A7157E1ACE290A18532C3D16C8D4AF1FA7E2871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3dce976ea265b4900d2408e22b0fad21ad5b1be05158bdde2c1056b6f4e473f7
MD5 a1fe7d4e2f49e1308d9a2a8851e9539a
SHA1 aab9a8135d643b74e997b9b90f23efb7cd66bcf1
SHA512 44fc0c4cf78e9f8cce645650bf06e740ecfe7013ca2484e9516923ebbdc6da04dafb0f7e2eccbe531413673e20bd02700d13f7858f74399d76ad0b58433c0d0a
TLSH
T16A517EF7C3D88A7D890156F8A7157E1BCE290A18432C3D66C8D4AF1FA7E2872D21164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ae16971127669cc5da498f4b4cb27a2f7d1cf7af948168883230fef3641a94ca
MD5 5dd46fcb6b97c33bad0a398fabd813f7
SHA1 8928c87270f13d6eb3b120e570001f32ae817ac8
SHA512 505d4dc8d7d2a79730b84dfc983eba27c71c8313738593bcd8cbabc0f65f3e2447f1da1a7cf821e3d3835d6cbe721d23fa55cb6eca548cfe9c7fd124cc33f5a4
SSDEEP 192:5BRzyaRbv7QvAPRp2Wr9XxHsb+WNn57P3xgkw7VyIsnAUge:5BRzyMj86XTfwhPSde
TLSH
T17B32A62EBD14693B6DCAD229FA667793D7F6102122D43E44E7FC8A2C15DB5CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9dbdbaf3434c9a9949f5542804b8e515c72feb1d4eb158d58c41b3211cb3378a
MD5 3e4c31ce0177edc258f879091c747c2a
SHA1 4819fa67a2e6462a6a648c8a0c15dfb54f5e74a4
SHA512 a27846144444a89d8735149a8b089b2285cb9141fc347892571d5b75db3219adf580910e01d573b6b166c6723b31ed0e45c0762f2214b586dbc7063f22095f6a
SSDEEP 192:5BRzyaRbv7Qv/PRpnWr9XxHsb+WNn57PExgkwVVyIsnAUgE:5BRzyMj8PXgfwhPXjE
TLSH
T15142982EBD14693B7DCAD229FA567793D7F5102122D42E44E7FC8A2C15DB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 636b7dec0597ae33b26d9cb548f5072118f1312326927e88e48760a1f4202ba0
MD5 84d06477faced613265aca8a31521fa4
SHA1 de32777fb085cba1a9f14b4f9102b282b6df432e
SHA512 ebd40562c0a70f4579e008dcf971bad11914ea16931dfa0d2f4dc8289f8968867c75ae316ecabc315e5ab3fb99e95354f975a6d7e4dd4245f17f91541ce6e145
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5ymDiB6nGyvn0b4T8GybJv4a:xC0ITo+TQ0InDUD5iPPb4T8Gybl
TLSH
T1A2A10835A0284D775476D446F1627A43CEB9706BEA72AF90EAD90F0D14F70EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1de63c7567d9aaa929ca10d9530d72fa10d072d53777530e09d07dde983895bb
MD5 a0772ab60719d21a6ce0fb5d706f885f
SHA1 9830ee65f786a7986e817448f011a12b1b3e4558
SHA512 86dabf99e57a00c7d7e36b4c3464fe5437d2cf9cd0bcd4898572687f0f4f462adee992c25f0bfdde67b9e5128ab579f9be204f4f3e4c907b1caf0bb32d654695
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934RMFSl8h4otop5yicDiB67Gyvn0SvQxwzQ+hjm+9Gxs:Rt0ITo+TQ0IOiU2MiXPSIxKhjm+9GxUf
TLSH
T1EFC12972A46D5C7756A7A442F1233A57CEB4206BDB51AFB0EBE60F0D01E74EC2382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bb2deb931e5c2b8297dc49959d1550e9899ac07f86205f94c1270fbafa8555f6
MD5 d2733eb085324d35c9c44e5f2e9a28dc
SHA1 7002f0982dab45d12b0bcd92368266309f7f631b
SHA512 1ad856b0f88497c16873e71163066da81394bbf200ca60ef1aa1bf40a24de3d5eb3f04ae2d6a2a425b7eb60be4279a8f0778272816ef97fda0c1ce33494b40ba
SSDEEP 96:RbJod+r2io+TJ/E0f6m934RMFSl8h4otop5yicDiB67Gyvn0Sthlm+9GkRNC39IO:RtoITo+TQ0IOiU2MiXPSthlm+9GkuCj6
TLSH
T1E7C10771D02C5CBB59B6A485B1133A97CDA4206BAA55BE64EEE90E0D01E74DC1382537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 3999bdb288484c02fcb43fbbd0dc63e0cefd85d50b386edbc5d4daf265317123
MD5 ff4f1b24f18ac3f0aed8fb92e565c2e9
SHA1 50b8366c4a23bef69773e5259ceb2d0a21c46de4
SHA512 a358b4e4605691a64e9e0c68f492829a84092e4a21e5aa9239cc2a9c96dd12824dfbb7a6d4b72e0ebba6683ba820c847e8ec0d0cc56f2bac859a5e061565cb9c
SSDEEP 768:n981KtTY9gJrvoxlalu/mBPDfNPZSMqHgd7l+z9wSMwyT2bnufIvstlRj+9jfbuN:98STYKFmGDftZ5qHXSShyiaJtlRj2jfs
TLSH
T13713F182971C0EAB0879F040F6071483C6DDB59F7C557B1097EE364D115B4EE871B6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f8e0e4b8a2af4adefd69694a40f935732b05642c6e0e892c7938ec9a7b752a42
MD5 dd3bcd4df1385c15bc1f7a5b6d75e4c1
SHA1 85d08fe628cb60943dddaff726594455f897f469
SHA512 7ed8f82b72de70f7755a11054f46e3bb3a38390f6f1a467ba80f1c6798f6b4d2d75dfc6d764d0b7725d24b91c7cb39d9241f92ce559789e2f53e96c550b57099
SSDEEP 96:RC0d+r2io+TJ/E0f6m934RMFSl8h4otop5yicDiB67Gyvn0SvQxwzQ+hjm+9Gx0Z:RC0ITo+TQ0IOiU2MiXPSIxKhjm+9GxUf
TLSH
T1C8C12A72A46D5C7716A7A446F1233A57CEB4206BDB51AFB0EBE60F0D01E74EC2382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download