3968887c8c08b8e2d034ae3e466875598726ef07a50e879cf307a274bf7f704d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Da5nac6Jx4j.html
Size 585KB
Sample260718-yncvbsbt6r
SHA256 3968887c8c08b8e2d034ae3e466875598726ef07a50e879cf307a274bf7f704d
MD5 505946a8aaa2dc180d379c9c7b1d8d6c
SHA1 536da3edc52461d75721adf0ee84223ad9c8096a
SHA512 26e9b8d515822bf4ab8ef5ca193fc24384e18c19b1f0cec3225a18d97a7f8edc8d5c420af866191091d93f32c07dbb238a7e7d9bf9550d5bdfc2ffa191dae79b
SSDEEP 6144:YHLiWxLoWHLiWxLo1HLiWxLoVNmdHEAKGcOAJPQQuIindWG7HKHxFRnesRQfL:ANWOwAJPQQuIindWG7HKHxFN2L
TLSH
T14ED42A427408E97B991307E2E4963ED7FA2C140B66C899EAF1DD2F3957C18F8321BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288781496022212"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5224	chrome.exe
5224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 4948	5164	chrome.exe	88
PID 5164 wrote to memory of 2592	5164	chrome.exe	90
PID 5164 wrote to memory of 1084	5164	chrome.exe	91
PID 5164 wrote to memory of 2592	5164	chrome.exe	90
PID 5164 wrote to memory of 4116	5164	chrome.exe	93
PID 5164 wrote to memory of 4116	5164	chrome.exe	93
PID 5164 wrote to memory of 404	5164	chrome.exe	94
PID 5164 wrote to memory of 5660	5164	chrome.exe	95
PID 5164 wrote to memory of 404	5164	chrome.exe	94
PID 5164 wrote to memory of 5660	5164	chrome.exe	95
PID 5164 wrote to memory of 968	5164	chrome.exe	96
PID 5164 wrote to memory of 628	5164	chrome.exe	99
PID 5164 wrote to memory of 4060	5164	chrome.exe	98
PID 5164 wrote to memory of 628	5164	chrome.exe	99
PID 5164 wrote to memory of 4060	5164	chrome.exe	98
PID 5164 wrote to memory of 5400	5164	chrome.exe	102
PID 5164 wrote to memory of 2628	5164	chrome.exe	103
PID 5164 wrote to memory of 5400	5164	chrome.exe	102
PID 5164 wrote to memory of 2628	5164	chrome.exe	103
PID 5164 wrote to memory of 5576	5164	chrome.exe	104
PID 5164 wrote to memory of 5576	5164	chrome.exe	104
PID 5164 wrote to memory of 2176	5164	chrome.exe	105
PID 5164 wrote to memory of 2176	5164	chrome.exe	105
PID 5164 wrote to memory of 1040	5164	chrome.exe	106
PID 5164 wrote to memory of 1040	5164	chrome.exe	106
PID 5164 wrote to memory of 5436	5164	chrome.exe	107
PID 5164 wrote to memory of 5436	5164	chrome.exe	107
PID 5164 wrote to memory of 956	5164	chrome.exe	109
PID 5164 wrote to memory of 712	5164	chrome.exe	110
PID 5164 wrote to memory of 1660	5164	chrome.exe	111
PID 5164 wrote to memory of 5224	5164	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Da5nac6Jx4j.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8cb43c728,0x7ff8cb43c734,0x7ff8cb43c740
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,9670212702587063429,10265369254615921879,262144 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,9623534570331829053,9093570039933215092,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,13265041026537514871,1031276153088165415,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,14982170862007653346,14893038455518895444,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,4135217739787280922,15650134661836938915,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,15236617635284501642,4749776777243838807,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5272,i,11372604194965839420,14346653404116926140,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,7983384759323895699,16831841115379078399,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5556,i,4807834305950474033,18117105579096555246,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5460,i,12765968490473084504,10458302333400653173,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5984,i,6176604888859334416,35877854703549861,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5284,i,8078489182261228797,9873172600157597886,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5760,i,6591332961043998876,7964680774307490727,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6092,i,16112634518928560885,1822526782862263885,2097152 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,5535830097694080244,8812281266152658405,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,2421042985325192213,14018929411078039056,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,15393403651431192300,1350958308860103875,524288 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3248,i,9951758210313417711,4205037239819367985,262144 --field-trial-handle=2088,i,9132274991830154917,17840504588504291009,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cd9aafb5ad1e87002a4fe8c44665216edcf52276084698325fb5a23202712a0f
MD5 2ba39507e3079ba29c2960cdc68e1311
SHA1 8bb80f2d2ff2e733c8d3f57d72fe4ef5c45fddf8
SHA512 85df4174681993eae803d37cd708d301ac7d4f2947142cbf6a4e21cfd51ce3c88fb7b6d8c7dd63bd55726314eedef775912dc5a3bdaf26fb17f80bc0789d8b28
TLSH
T1B9519EF7C3D89A7D890152F4A7157E2ACD2D0A19532C3C66C8D8AF5F67E2871D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c236239f4dc9f2e62610424d51d6d5ddae00b35bdf5a49c33a3b0d6cbe97e305
MD5 00d523d5a8396214cb6fea58f190a2b9
SHA1 cbf4fccc2e690918d409324223644ba2d33c0622
SHA512 99fbe157ba254783a9ff15149eae48319b033eba4a65426551cb53010c0bd8c0ad0887c89ac658fa4a96852d6d36bb4ae8ffe15737ed939704b1a5933247a157
TLSH
T1115190F7C3D88A7D890552F4A7157E1ACD2D0919532C3C56C8D4AF1F67E2871D20168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7d3125e6dead610f4176adbd99bd348873ab6cef289f620305afc33fa2c309ba
MD5 a5418eaccabab13e6a44d607df474caf
SHA1 13af4fc11e814a1a4958da846426e320ad763395
SHA512 0419877af05bc56845c7a328cd68fb9813aabd11225a81abe776ae32cae27efd7f6af8ca32a404362e75d69f3fc50f73c81c4a1f3a5aa9c20b7b56a616241b61
SSDEEP 192:5BRq0adkv7QvAPRp2WG9XxHsb+WNnSHPcESesra+VyIsnAUge:5BRq0IA86XOfwiPb2e
TLSH
T17F32B82EBE10657B6DCBC22AFA657793D7F6102221D02E44E7FC8A2C11DB5CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3fe21b88f8493635b41ba1419f162ec405303abbdaa83de6f99abb90422576dd
MD5 dc038b00872c41650bed4ea6f717e87d
SHA1 28cbdabe072912b6d6fc616889c96fb54788b626
SHA512 d6280752fe777d9d7070c08e0d42c847f445dc916f0f32f4b9ac0b9d76547dcfbe9bd10110a43ba55065e4b8e8ba672a447578175bb6c55b6ab0beced898d3cd
SSDEEP 192:5BRq0adkv7QvlPRpxWG9XxHsb+WNnSHP1ESesr/+VyIsnAUgE:5BRq0IA8FXnfwiPd2E
TLSH
T1B542A92EBD11697B6DCBC229FA657B93D7F6102225D02E44E7FC8A2C11DB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b994476c5ea42872416621edb3ab08f387f38f12dc5338c727ae56ff962c98dc
MD5 3a158811775890142741e85b705c0193
SHA1 1c1955567e22a9dc6a0bc23e4f0cc87e8d234edf
SHA512 9e72f35ebd5646a9e0af2f70d7a59a4ce548ab0a396b3dbb837fac185e1ef1bdebc3b82a2d34a1b7e03b8c24435377171484a5401ae244f2a60ca82d9c897c30
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934xMYSl8h4otop5AicDBB6WGyvn0Sqhlm+9S6RNC39Il:Rt0ITo+TQ0IViU263aPSqhlm+9S6uCjZ
TLSH
T1B0C1F875D02C5CB708B6A486B1133E87CDA8206BAA55BEA4FAE94E0D01E74DC5383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6bc58cc165e43e29133d85f2732121eed1077f0b2e22a3502bdb7662ec0ad8ff
MD5 873a322addee2b7b3012c2680b4f007d
SHA1 d9852df0e6cfa99049ffca37566b073ba6b4b126
SHA512 80ca9f66dd2bfa86c9f260ac84e8cafb37e6d152af20b4117fb62c5eac0c7d4f31e7cc8dfd721c5ba2ef3a0ebb0c6472aed87b9d9cfd321ed74081d532b8e0f8
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5AmDBB6nGyvn0b4T8SybJv4a:xC0ITo+TQ0InDUDP3PPb4T8Sybl
TLSH
T1B5A10835A0284DB74476D486B1622A43CFB97067E972AFD4EAD90F0D14F70EC1342A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 26e94aa18c31fdadb2cdbc107e1a36f0da923cddc763a17a0dce3188ef9b0938
MD5 f72933963af0647094748ee178c00add
SHA1 98bb303d7bdaf8c43132034e878de6f159a35de1
SHA512 e48337b3b97a2e38205ffa57e6be587278dd6c0ce0ddf3b3a5d0c390ab7f92da6b33b0e688c9b271725281318c90bb7bb9dc07b847063524cc2fe63ad00e32fc
SSDEEP 96:RC0d+r2io+TJ/E0f6m934xMYSl8h4otop5AicDBB6WGyvn0SvQxwzQ6+hjm+9S7r:RC0ITo+TQ0IViU263aPSIx1hjm+9S7rX
TLSH
T1ADC12B76A46C5CB715A7E542F0223A87CEF4206BDA51AFA4EFD50F0D01E74EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 83b4d4cfcaa411becad9e1b0f80096785d087f3dec678043cc23767e2c55e4ea
MD5 ade985ea4dfc219faa6eb519eae3ddea
SHA1 92f709c3295ad5df400fd8c39ebc366e30e63126
SHA512 0980b1363e2d0517cc604c3b5c557681cd88edb951b05ab32dc12e908f3f37e89e52362f4add520f42b1f20f0b9cfe27d3a53a9b231d1a34d32c375aa52a2b14
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934xMYSl8h4otop5AicDBB6WGyvn0SvQxwzQ6+hjm+9SX:Rt0ITo+TQ0IViU263aPSIx1hjm+9S7rX
TLSH
T16AC12A75A42C5CB715A7E542F0123A87CEF4206BDA51AFA4EBE50F0D01E74DC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download