e1fc8d83d16968df0afe93eef7e13a91e4645538ec931bd3d811816d7510a440

Analysis

max time kernel
300s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prdxq82u.html
Size 11KB
Sample260722-wvjkcaae64
SHA256 e1fc8d83d16968df0afe93eef7e13a91e4645538ec931bd3d811816d7510a440
MD5 1782d393e738ac4440dd9fc14afd0246
SHA1 c42cfaa15dfdf6c154c161f011a0ddd6d9ee2dfa
SHA512 cf6e318e805834d8df2d90341d00e7e57ebc5a8e1ccbd366868fab1758d4a290182b6bcad502f796f7e92bb972dcc1d47b489efb1728ef02df7fbfeb0fbf9782
SSDEEP 192:DXdPxdPBdPIpuXsfyGAXmcCcj8SUuYck/ze+2v+FWZ9AdPR0TDkAPaP0topaurK5:DdPxdPBdPIpuXzjshdPwQAPaP0topauW
TLSH
T19A423FB2A9F03527018282B056A8FB0A7F51E143E25E9D00BBEC9BC64FD1FD69D27315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2916	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292177067562050"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe
Token: SeShutdownPrivilege	2196	chrome.exe
Token: SeCreatePagefilePrivilege	2196	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4228	2196	chrome.exe	88
PID 2196 wrote to memory of 3632	2196	chrome.exe	90
PID 2196 wrote to memory of 3632	2196	chrome.exe	90
PID 2196 wrote to memory of 2916	2196	chrome.exe	91
PID 2196 wrote to memory of 4688	2196	chrome.exe	92
PID 2196 wrote to memory of 4688	2196	chrome.exe	92
PID 2196 wrote to memory of 5380	2196	chrome.exe	94
PID 2196 wrote to memory of 1880	2196	chrome.exe	95
PID 2196 wrote to memory of 5380	2196	chrome.exe	94
PID 2196 wrote to memory of 1880	2196	chrome.exe	95
PID 2196 wrote to memory of 5544	2196	chrome.exe	96
PID 2196 wrote to memory of 3088	2196	chrome.exe	98
PID 2196 wrote to memory of 3088	2196	chrome.exe	98
PID 2196 wrote to memory of 3396	2196	chrome.exe	99
PID 2196 wrote to memory of 3396	2196	chrome.exe	99
PID 2196 wrote to memory of 2320	2196	chrome.exe	103
PID 2196 wrote to memory of 2320	2196	chrome.exe	103
PID 2196 wrote to memory of 2704	2196	chrome.exe	102
PID 2196 wrote to memory of 2704	2196	chrome.exe	102
PID 2196 wrote to memory of 5812	2196	chrome.exe	105
PID 2196 wrote to memory of 5740	2196	chrome.exe	104
PID 2196 wrote to memory of 5812	2196	chrome.exe	105
PID 2196 wrote to memory of 5740	2196	chrome.exe	104
PID 2196 wrote to memory of 3684	2196	chrome.exe	106
PID 2196 wrote to memory of 1708	2196	chrome.exe	107
PID 2196 wrote to memory of 3684	2196	chrome.exe	106
PID 2196 wrote to memory of 1708	2196	chrome.exe	107
PID 2196 wrote to memory of 1096	2196	chrome.exe	109
PID 2196 wrote to memory of 3328	2196	chrome.exe	110
PID 2196 wrote to memory of 6112	2196	chrome.exe	111
PID 2196 wrote to memory of 4784	2196	chrome.exe	112
PID 2196 wrote to memory of 5816	2196	chrome.exe	113
PID 2196 wrote to memory of 5816	2196	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\prdxq82u.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc4cd8c728,0x7ffc4cd8c734,0x7ffc4cd8c740
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,9510158316496067109,10521269601835552991,262144 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,6278942414033958055,8909793953200397545,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,7723959514777116425,3713443788074669185,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,17698436610378959132,12434372647135755723,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10413179912973246773,4812531312151296746,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,6800473990281657328,12040548294869695713,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5252,i,10217681009550888106,17649062724272990671,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5284,i,15137250740234063767,6379741861494401061,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,7508953416559864451,804412203077427557,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,744813161695144960,2737111563943615647,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5500,i,5059670576076248342,11786508168081983022,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5380,i,9755886163537284776,9981672828982973359,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5876,i,15409935408592608787,12961107535949374693,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5248,i,4822174613343299262,5977026906083157981,2097152 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,17322104897207843911,15624756878036855291,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,8521514847055464725,8345525158696500372,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,12060364872994473304,6097559877744909114,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5864,i,13948352771339378155,3660786751307782841,262144 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,10758800862325382377,17340301414626764366,524288 --field-trial-handle=1904,i,18129237733410160055,15807286545105388365,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 033b55bf2709865503e668f130bde4f9362d574f57cdc536a234c368afd85441
MD5 4689d6f0d5959d3844ce59caa9890594
SHA1 d0b17d086ad0f0682dfdd9b11c9d5936fa503a67
SHA512 0ee0eb66692608577e6453626f97bd0b51c66d5e57259b964fd24741d49c7e23dc775b1ed0a1b54d7d203135e6d71e951a825c9ea65c73f5b2d9211b45d5fa13
TLSH
T1B6417BF7C3D8857D891556F8A7256A1BCE2E0918432D3C2688E4AE1B67F2871E20059E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9716999293ea9d4da2ae32d1e40dbf8d1c4174789adef5394c4e55a784852c55
MD5 80f1c1981909f0870fcfa44f85343e0a
SHA1 942265e5b5d50b873126cf56347ff0378358f034
SHA512 cc537d0ccaa6e81685143dbdc28373378d859e50f1c25c686b6082818148653bae5db6a6580eaf5210ab7ef4d2851126853f4e946cedb1494840a2b25ded2e47
SSDEEP 192:rRooMXMCcAv7IvxPRpdho98Hsb+WNnEsP2+okwHK+VyIsnAUgE:rRnrlc8RXYuwrPknK2E
TLSH
T19442B82EB954697B9CCBD229F9217B53E7F5102161E02E84E7FC8A6C15E7ACC2327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 13e0149d9a5fd0a2de7e6c5c7408a6d1c1f6c79e18519af4c4d9d56b93534299
MD5 122549439b1a2ca11c905e0968be8e69
SHA1 c8269dabc4b037f418ae872d4409f7404f46c50f
SHA512 1354e97ae2efc80846c378a37fbbb2b361858ccdd8066e31f410210f9676cb0214f652dddd00914c11e03d6e58ebe196a3be0cc274bb4a6930340a8610c0cdfa
SSDEEP 192:rRooMXMCcAv7IvAPRp2ho98Hsb+WNnEsPE+okwbK+VyIsnAUge:rRnrlc86XBuwrPq7K2e
TLSH
T17132A72EBA54697B9CCBC22AF9217753E7F5102161D42E84E7FC8A6C15E79CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8102f16-fe04-4b78-ba91-f8288a3c50f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d8102f16-fe04-4b78-ba91-f8288a3c50f5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 de6e7d2dcfd6a4f8ebd891d7527bdb86000c25245bd3a1a3110c2f3b414cee56
MD5 670a0fa97cfb399bc9d5a4deb88a1463
SHA1 0c0f8665f0eebca1220d280e4f11df366d46c2dd
SHA512 f51899bcf1dd0f7ec7a044be5c7e8c8b12f28af656b303b1fb13234102742d7c7cf1e2b07f4177fdd312b69685a4191ee338106046e26136108520d2d40e48b0
SSDEEP 96:5IbJ0d+oJm4V0FH+pqf+HBKyoqatVSl8h4otop5HoDwB6LGyvkfadGzG5RNC39Ip:et0HJm5FHuPgDiU2+07zadGzG5uC0q
TLSH
T1E6C1F8B694AD4C7B4DF6E681B0032987CCA4616B6A94BF54EEE94E0C01E35DC1393627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dadd68f0a4346796fc25f0d4b4dd82e8ca9d179c1778f4f9bec88e04bc8db19b
MD5 c79762a5c15a98c62566c95fc8c2b13c
SHA1 ced82b8e433e7a79e2b8d5419ae834650b2293bc
SHA512 08c65d9475caf4640136da702698a822828361bd9bc04a58626d291c1ef7e033f5f8cb417559f49468710993614f12dae09295404ff4708e1548deb5a9dbbf00
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5HHDwB6eGyvkonzGob1v4a:MC0HJm5FHuPgXDUDD0W8nzGobZ
TLSH
T1BEA12AB2A4A948B759B7D245F8833A83DEA4A227A991AF84D9DD1F0C01F31D81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 780b9c9b52ebea87faa202b5da3e2b770864b2abd3622cdc9ffede426cf0a79e
MD5 05bc441ccf3082cc0196993263652f24
SHA1 12b23fe4768d54ab61d17281017f17abe9031f8f
SHA512 49f2ce2625c8f8ea80ba9d4a9816675c681dbd06794f4e18a5a0230b04479ba71b5309e878e2dbba0b89e6d96a83500f31c2f5c4569f39d1634a72ca422c2936
SSDEEP 96:5IC0d+oJm4V0FH+pqf+HBKyoqatVSl8h4otop5HoDwB6LGyvkfFl65zrtfnGzGpp:eC0HJm5FHuPgDiU2+07zFl6hdnGzGpUm
TLSH
T178C11AB5A8BC5C7349F7D781F4432583CDF462676A90AE94CAE90F1C02E75D8234362B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2d71884c41829325bb64ca00ba22152a0048f58d87b7d1baeec0f9bb433b8704
MD5 e8f2aa0de6317d39d4bba20afd86bc4b
SHA1 a5c79db9e416599cd7b565f2752fe17b120a25f5
SHA512 9bc7a1d4af1c87b0e15c41661a05bf2c2daa9db2b6d097a1972cc4ee4eaa6aa234aa2ece268d58117d556cc325e0f97eb758059482e325d7ed8d512a3814b049
SSDEEP 96:5IbJ0d+oJm4V0FH+pqf+HBKyoqatVSl8h4otop5HoDwB6LGyvkfFl65zrtfnGzGH:et0HJm5FHuPgDiU2+07zFl6hdnGzGpUm
TLSH
T1EAC10AB5A8AC587349F7D781F4432583CDF4626B6A94AE94CAE90F1C02E75DC234362B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 15e9c08af47c7fbce6d3c94ad53453aedda1c29e05ad4f32510c6c55389314fe
MD5 7426d77ce68437c329ac7a7223af65fa
SHA1 76b398b23fb3299f49062e8c53a5b3d9d67b50c6
SHA512 db65a2c3289d6ad45be8e2c431cdeee5ecfeaf1019bb53f51cd584cd41c50d2d23fb9ee5a9575491aafbb5841ab45734d54afc57c1fac05bf1be354e2c8d5bcf
SSDEEP 96:5IbJod+oJm4V0FH+pqf+HBKyoqatVSl8h4otop5HoDwB6LGyvkfadGzG5RNC39Ip:etoHJm5FHuPgDiU2+07zadGzG5uC0q
TLSH
T18DC119B294AD4C7B4DF7E685B0432983CCA4216B6A94BF58EEE94E0C01E35DC1383637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download