0a52fe8ff671d83b9e6b771d02e366d31c6cfe426a1807984015ab15a08e3626

Analysis

max time kernel
299s
max time network
296s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meter-drivers.html
Size 24KB
Sample260720-bgrctadw2w
SHA256 0a52fe8ff671d83b9e6b771d02e366d31c6cfe426a1807984015ab15a08e3626
MD5 32793308b9604ab5cf43094ff7119556
SHA1 e2c855bd7a5e1aa632789f0523e47e2d890ff9c4
SHA512 53275d727258044fa2ebf0ae82bd6c079c18532e318a3a27990d0b6b9009d6dff46e2b473e8a69e560b51f177436a0a7b9f308976b2f2817c9f4b42c17aa7c8c
SSDEEP 96:3boB82Q46OV0AvfLZCNfhpnCe2en/0c+XofsCO1mjvGXJ+XiItlydBP5wg2e1YjB:Lc1jb0A3FoiocK5fSQzePp2yTnu
TLSH
T187B2BA2678C0D927A2BBA5C93C616F29FCE58203D3484695B1FD47AF1FF3C658923085
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289832509149953"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 1688	5220	chrome.exe	89
PID 5220 wrote to memory of 3744	5220	chrome.exe	90
PID 5220 wrote to memory of 3744	5220	chrome.exe	90
PID 5220 wrote to memory of 5268	5220	chrome.exe	91
PID 5220 wrote to memory of 4920	5220	chrome.exe	92
PID 5220 wrote to memory of 4920	5220	chrome.exe	92
PID 5220 wrote to memory of 1716	5220	chrome.exe	94
PID 5220 wrote to memory of 1716	5220	chrome.exe	94
PID 5220 wrote to memory of 1376	5220	chrome.exe	95
PID 5220 wrote to memory of 1376	5220	chrome.exe	95
PID 5220 wrote to memory of 5528	5220	chrome.exe	96
PID 5220 wrote to memory of 2224	5220	chrome.exe	97
PID 5220 wrote to memory of 2224	5220	chrome.exe	97
PID 5220 wrote to memory of 3664	5220	chrome.exe	98
PID 5220 wrote to memory of 3664	5220	chrome.exe	98
PID 5220 wrote to memory of 1084	5220	chrome.exe	103
PID 5220 wrote to memory of 3868	5220	chrome.exe	102
PID 5220 wrote to memory of 1084	5220	chrome.exe	103
PID 5220 wrote to memory of 3868	5220	chrome.exe	102
PID 5220 wrote to memory of 5024	5220	chrome.exe	105
PID 5220 wrote to memory of 5972	5220	chrome.exe	104
PID 5220 wrote to memory of 5024	5220	chrome.exe	105
PID 5220 wrote to memory of 5972	5220	chrome.exe	104
PID 5220 wrote to memory of 2560	5220	chrome.exe	106
PID 5220 wrote to memory of 2560	5220	chrome.exe	106
PID 5220 wrote to memory of 4380	5220	chrome.exe	107
PID 5220 wrote to memory of 4380	5220	chrome.exe	107
PID 5220 wrote to memory of 2872	5220	chrome.exe	109
PID 5220 wrote to memory of 5708	5220	chrome.exe	110
PID 5220 wrote to memory of 5520	5220	chrome.exe	111
PID 5220 wrote to memory of 4472	5220	chrome.exe	112
PID 5220 wrote to memory of 2572	5220	chrome.exe	113
PID 5220 wrote to memory of 2572	5220	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\meter-drivers.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8a117c728,0x7ff8a117c734,0x7ff8a117c740
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,9591475841515724363,18194451563315000569,262144 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,16685198191175616973,3328561972564802093,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,3374263019481159621,3321282645087970325,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,17749161386296557422,6280557001193849540,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,14915568961939664515,12661193540379929686,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,5473226677824226038,13581590902929402246,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5276,i,15578483314912245169,5503227718193569785,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5312,i,812857184611667026,4159384588571868943,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,8936106700826217916,17362265677226026290,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5804,i,1291384725055287233,7837378367740651117,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5868,i,14602256590054893665,5044588213668503626,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5456,i,2314271341499338065,11778811504761878435,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5344,i,14266816281928860378,15482854557012032614,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5272,i,8857550587891865482,3701482998228416252,2097152 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,8656895778136402900,15984079801797448525,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,1214480273922104697,1532040372476966413,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,1218164774453846499,10477179791458425894,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5808,i,11013422538234688941,15451216560978755766,262144 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,2004190004339826385,10462756889004935177,524288 --field-trial-handle=1896,i,14675207665011846317,8147647940631172479,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

583e5559-3399-42f2-8eab-e441d42489ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\583e5559-3399-42f2-8eab-e441d42489ca.tmp
Size 4KB
SHA256 27b981d8324fbe5e0e526d1504b36e2e682918c7122ab2af6f0c18e0d9d1b3d1
MD5 b602a8241cec6548766cb60eda0a0ac5
SHA1 a4faa5e8bed97acea5048812aa3c98725bff2edc
SHA512 e682dfaf12b544e62671341bdfcd8073596f7451280094afbb0cda948b6820a0d7bde770280da6b0bda60b1eb9425fc8fb9a7510928c3e5b09865bbb7b4b85d3
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5oFADQB6xGyv4YR5g7ObETev4a:TC0cTkJaRZi/CF2lIDUDQ2UZIR5g7ObV
TLSH
T1C2A13C3264658DB76976D98AB4423A43DFBD722B7951AE84E9DD0F0C18FB0DC1342427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

487ae069-a0bf-4038-a4a0-6d10fac7ce2e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\487ae069-a0bf-4038-a4a0-6d10fac7ce2e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 86a62776bdddb836b1e9fb8d36d720a5bdd2b7c1da4096335747ebf5023b8bef
MD5 41bfc34ae3b06272c4a1052f801c344a
SHA1 fee671a2f56f54b92a7dea656fdae9cf3900ff48
SHA512 33f9fffa5d54f10fefa3f0a2e4b6ccc0531e1814ed40e31c2b417a3d1cbb0d30129e6d8a242b0ec57c8c5b6ac9657de523957586bf0dcfb3c987d8fb38b172ec
TLSH
T121419CF7C7E8963D894156F4A7166F1BCE6A0918432C3C67C8D4AE1BA7E2871D10065F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 274c8f61ce50b509e07a4fa6d328dc06385c8c22c366bfdca84e65bd63103714
MD5 fbcd944236f001c6efe70c48e2a93d81
SHA1 deb766eea9e21ba9c06022850dcaff52c20b3ecd
SHA512 abcd34224fea2c97f7897020404ae428d33bac392a3bab3f06052fa65594c4a1329b09087b3827e4ea231eeee5d599074d74adbff5bc7de2cf4f3d5233997273
SSDEEP 192:+RL3YEiv7ivAPRp2XX9rHsb+WNnTePIFeS2U7cVyIsnAUge:+RL3Xum6X45w6Pw2S4e
TLSH
T17932C72EAA217D7B6DDBD22AF9657793E6F5102121D03E80E7FC8A6C14D75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 927a9b6025eff5e8eb5ae955d0107cf2c9cb471b58080e2d517a9c7113db25de
MD5 782ce3b33594cd8b45f76719b72e0302
SHA1 7d3f6f37d524d663e313c0c1094adee055033e65
SHA512 fd506beef1e20a9a3e332ba4bf778404fe403361697e2f29bddd219fe65d969aa53fb0a502d9b1f6ffd78ba8e3455679ba3303eb47d3a694e30c95e418ce8b9e
SSDEEP 192:+RL3YEiv7ivLPRpjXX9rHsb+WNnTeP+FeS2UGcVyIsnAUgE:+RL3XumLXT5w6PC2Z4E
TLSH
T1B442C72EA9116D7B6DDBD22DF9257B93E2F5103121D02E80E7FC8A2C15E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 88b18bb20fd2c7251f380b9ee70680d3d1a8f20060e75a851cc56e7533e322c4
MD5 bd92f10be164fe706c9288b76a6e4506
SHA1 4a73fedce9af3d24b195620de46c937b5d5b5cb1
SHA512 91b1f34d9c57480d49e190ad3d2e3641e76c90cf15ecc1cfc14583d8c1f8bfe9cea849a22e7d5357d6a2150c93e5680424a88d37b2320f337cbe319fd0bf9a6e
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8IgGG8Sl8h4otop5oFWDQB64Gyv4Y+itcx7px:Tt0cTkJaRZi/CF2lriU2QQUcI+itcx7v
TLSH
T15BC1F872A46D9C6759B2A886B0032D87CDB9316B7994BE54EEEE1E0C04E74DC1383927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e4fe5ee4bbc251018b29798844a7426604193ce034da361b360db3fda1b8d088
MD5 cb590403e82d4ba1995ae3b4d6ce024d
SHA1 29ea8ff4a96943cb5be83542199225b1477d44fe
SHA512 c6451ee9bf70240bfd7168e91cb23158f924a2d6f5a5a6f9d8868a570026de3a361160524c7f4056d6ff296d36b187b1b8b413146be57ed44aadf2ced9852a29
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8IgGG8Sl8h4otop5oFWDQB64Gyv4Y+mE1I07R:Tt0cTkJaRZi/CF2lriU2QQUcI+mEmWGq
TLSH
T1E3C13B31B5AD987369B2E596B0433A43CEBC316F6991AE54EBDA0F0C05EB5DC1383427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 71a48351f6311c6d4cb4818908db7f3848ce3c168802936aa8150d845745c75a
MD5 e9c8a2dcd61238171ecf0f9194f14439
SHA1 1a5249fcf36a9151fb4c9ed7e07fd60305ba16e8
SHA512 c8e71d0d6957ac34ca9d75d15f675bd86026af75367fa3fdb8ffb74b066edcddd2f84969a74d2afdd398ad938898b828bfcce8452e3c7574ee6f84a36ad6af40
SSDEEP 96:TbJod+PTkblaRZiIEby3rUfsfuZ8IgGG8Sl8h4otop5oFWDQB64Gyv4Y+itcx7px:TtocTkJaRZi/CF2lriU2QQUcI+itcx7v
TLSH
T1CEC10A72A45D9C7759B2A88970032D47CDB9316B7954BE54EEEE1E0C04E74DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcb9098f-e218-49e0-94b2-4573371da2fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dcb9098f-e218-49e0-94b2-4573371da2fc.tmp
Size 5KB
SHA256 0153e036b8e99b730f53e2b5086ab0e9099cf48511c4c47405d38b4cab5b4965
MD5 41560d660c5cfc4d543087c892340131
SHA1 9c012c652859aec6d57080775aed8ff9fac6b35b
SHA512 923f54c4cbebdcffd09b64ac698c20e544a753886b1e2a48158e48d82c6f7250398efd7347e8d4900c73388b40ff3db89fbee9c50ce70a505855bb2186445702
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IgGG8Sl8h4otop5oFWDQB64Gyv4Y+mE1I07Gq:TC0cTkJaRZi/CF2lriU2QQUcI+mEmWGq
TLSH
T101C12B31A5AD987369B2D556B0433A43CEBC316B6991AE54EBDA0F0C05EB5DC1343427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download