19f5b9791ceea710c6c4c1a61e4a66342fe98f09956d689555a2e16a3e317e0c

Analysis

max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lrHI3sO43B.html
Size 113KB
Sample260724-wpdf5shr2z
SHA256 19f5b9791ceea710c6c4c1a61e4a66342fe98f09956d689555a2e16a3e317e0c
MD5 c95e99663fa09c07b42fe0001009f644
SHA1 f01338a963e07bdb534c09442de2d10d1a94a85d
SHA512 229a7635ba4f4cc83043df7577de5ae0da466e8f503c5b335b9011dbd6fa4ebff8d845ef0d317ddf1d1ecb2872588c3ab1e2788202dbd587d48b8e60a2f6d149
SSDEEP 3072:Vgq31rFYkzbvwUMRK5FxQLN6+KtV4qf6LizWUYwgSnzSMwl1RHjmugWHy5:X+8
TLSH
T182B3F8A7E97D00BB13170788E0797A38E37DA074D38955B079BDA52CF3C8994127AACD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1140	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293900207791011"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5164	4632	chrome.exe	88
PID 4632 wrote to memory of 5452	4632	chrome.exe	90
PID 4632 wrote to memory of 5452	4632	chrome.exe	90
PID 4632 wrote to memory of 1140	4632	chrome.exe	91
PID 4632 wrote to memory of 1632	4632	chrome.exe	92
PID 4632 wrote to memory of 1632	4632	chrome.exe	92
PID 4632 wrote to memory of 4592	4632	chrome.exe	94
PID 4632 wrote to memory of 5064	4632	chrome.exe	95
PID 4632 wrote to memory of 4592	4632	chrome.exe	94
PID 4632 wrote to memory of 5064	4632	chrome.exe	95
PID 4632 wrote to memory of 5676	4632	chrome.exe	97
PID 4632 wrote to memory of 1464	4632	chrome.exe	98
PID 4632 wrote to memory of 2872	4632	chrome.exe	99
PID 4632 wrote to memory of 2104	4632	chrome.exe	100
PID 4632 wrote to memory of 1584	4632	chrome.exe	102
PID 4632 wrote to memory of 4692	4632	chrome.exe	103
PID 4632 wrote to memory of 1584	4632	chrome.exe	102
PID 4632 wrote to memory of 4692	4632	chrome.exe	103
PID 4632 wrote to memory of 5340	4632	chrome.exe	105
PID 4632 wrote to memory of 5340	4632	chrome.exe	105
PID 4632 wrote to memory of 5552	4632	chrome.exe	107
PID 4632 wrote to memory of 5552	4632	chrome.exe	107
PID 4632 wrote to memory of 2780	4632	chrome.exe	108
PID 4632 wrote to memory of 5980	4632	chrome.exe	109
PID 4632 wrote to memory of 2780	4632	chrome.exe	108
PID 4632 wrote to memory of 5980	4632	chrome.exe	109
PID 4632 wrote to memory of 960	4632	chrome.exe	110
PID 4632 wrote to memory of 252	4632	chrome.exe	111
PID 4632 wrote to memory of 960	4632	chrome.exe	110
PID 4632 wrote to memory of 252	4632	chrome.exe	111
PID 4632 wrote to memory of 1712	4632	chrome.exe	112
PID 4632 wrote to memory of 5764	4632	chrome.exe	113
PID 4632 wrote to memory of 5764	4632	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\lrHI3sO43B.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bfd8c728,0x7ff8bfd8c734,0x7ff8bfd8c740
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,8314672332621869882,15196290907002114569,262144 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,4626644570462625646,3235820302758720898,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,3627376163531590953,42370895509393846,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,12638494032650999102,2878598927482127037,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,4745252781507310639,11908130190788048846,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,11749312847310807563,5441514467710497502,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,156031501609640354,11383936795392317641,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,14706078128138874177,7934517453308461171,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,2963647954764477976,12518191592972001771,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,4036337270614402266,4824482883483100184,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,14567843375958371955,13429015302685992489,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,13612151490519878817,17895280905694171371,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4736,i,8287259416703683308,8841804367354361275,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5900,i,15627491568781228891,5988104754792235933,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5764,i,1885520588494981735,8809503051887907599,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5932,i,5072866977519273677,11043044287499658730,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5684,i,9763712233522342474,2591643771154891401,2097152 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5084,i,8776087789692852332,6079849576758813149,262144 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,4799363083550624050,14675774024547788884,524288 --field-trial-handle=1900,i,682096699536317810,15379854857963545125,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:5764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5335ede982f818fcb62f1fe482a88517bdc0b3dcc8ac484d1c787fbcb094acf1
MD5 2d86754cda3d990d19a128b936e1b235
SHA1 ff99e8df252a57c5aa620b61a0550be0c0cd8ffd
SHA512 ec54b1d97f36664026d224ed9abd575ee967ef9a0decb42fce5d670d3a26fe94e2e2585a202af23502645b31173b1742956a7db6268f3ab362129bb3786b1764
TLSH
T166318BF3C3D49D7D890456F8E7153E2ACD290D18421C3D26C8D4AE1F57E2876D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f2321fe11b7ee3365e3a238aae34227ad07835d2cc75b8510793dc96fbb0913
MD5 41ba7e32a5164427aaeb149e487b6c1f
SHA1 7be15ffb5678a66628a0ad597374b48ecc938343
SHA512 68cae345deef01dde31d721874d1501152f7e9d6b999ae530ebe184d2bae9de43eb98c4bf792bba82d83327dcec53df746e1dc0adfc512b8a46b8af337636f43
TLSH
T165517CF7C6D89A7D890152F4A7253E1ACE2D091A422C3C578CE4AF1F67F18B5D20168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b87fc390eac0726f40c869128aef66815c82cf4794cfae84be79bfa1984fc9fd
MD5 9bf5de1d8f7879cdf77af0992d3b43db
SHA1 2a4943c52c268a5b9a00335f800fa6e5bc2e0e4d
SHA512 881d43e150b69c874ca82d9118d7aacb9f33c3b4fd7f69b0b9b13074ce72dd9f7833343c2daf431b87066c5509724ff2613fd9b323d31e8e371970b471ce059a
TLSH
T150718AF7C3D88A7D891156F4A7257E1ACE290919422C3C268CE4AF5B67F28B1D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 118b94400a47748fe487bc4106402f803b279b792d04c6e9233a9506e23435cd
MD5 d0b7e34d6bf8fa2c65beec59e66d9041
SHA1 2fd29e230b5914209146a9f132830f2cd6e7f8f2
SHA512 e4e42a9c02ba50e6434ec552f9bf4648fcbd92ed220e7a48fd7cbd1933ef44ad46caa6d1a7e653def3f1fff5ba62a5c7e82b505fe2b19cd445a191a82c04271d
SSDEEP 192:5BRS+aEZv7QviPRpQWZ9XxHsb+WNn23Pqqec95+VyIsnAUgR:5BRS+R58MXLfwuPp2R
TLSH
T12032882EB910697B6DCBD229F9657B53D7F6102261E02E84E7FC8A2C11D76CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e549a2ae-c5ad-43e0-833b-8c0f7ce2f703.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e549a2ae-c5ad-43e0-833b-8c0f7ce2f703.tmp
Size 11KB
SHA256 38a08686fb147d0a1b11734747b653ae9ab05200a33f8129ba9b91ab81f6f0c8
MD5 a8994c08e218288e3e63773a784d2a17
SHA1 fd0c0daa6bd655f5c270a0934b9a572dba4f1a71
SHA512 2800f46b7f19d97f03bf75f5d529f5057f40055caa0f0362f772aece6000c31f0036f17c6491ad8d5a20e106d080eb18dc32ed881821325a2b54f44dc6b7eb9d
SSDEEP 192:5BRS+aEZv7QvAPRp2WZ9XxHsb+WNn23PTqec9R+VyIsnAUgR:5BRS+R586XBfwuPW2R
TLSH
T1F732862EB910693B6DCBC229FA667753D7F6102261D42E84EBFC8A2C11D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fe6d75ac46a1dc71fdda36e7ec1dcd8379070a5ebfce8812416e1094906e382a
MD5 2a35db43629765bb0a1ce4747a1a3d70
SHA1 2a59e716993f8bc9f784a3c50731542aa8a57a5e
SHA512 74e9cdde67df1dc09238555a2d67d8201d195cb08f0fae1fe464479b310f7ba580a856a905341f39e0753f7fa545be6fd4331fb7cdb8a44198a481d1ecd37b42
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0Snhmm+99xRNC39Ix:Rt0ITo+TQ0IoiU2ZUiPSnhmm+99xu89d
TLSH
T158C108B5D42C4CBB09B7A485B0032E47CDB5206BAA65BEA4EEE94F0D01E75DC5393623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d285b38263a7e8a2da945e1fe7aa0c7c4d2b5640e27f7bd1a7ab2e6b427f1869
MD5 7336659c59e15a353dd355cce5babf59
SHA1 b0bc8922901b9178c0b85ff87d4b3d452de1d22c
SHA512 4e335e443cfffc70bb9e5922878c40a4632bb0b82511d61a6d5231ec35f48c9a6eb0031fcdae2d93e5bd34b9cfdae871febd2e1889c11a4114482a2918b71c95
SSDEEP 96:xbJ0d+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0SvQxwzQthj+99urK:xt0ITo+TQ0IoiU2ZUiPSIxZhj+99urUx
TLSH
T193C12A76A42C5C7745A7E442F0133A57CDB4206BDA51AFA0EEE50F0D01E74EC2392623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 119244d8abc7277eb21e7868d1136b8954b68c50f12be064efa2e43a674d1fdd
MD5 cc6f81cf821bd0b304fb044abefd1fa6
SHA1 172579212bd2f836ae78d7a02232bb905fa52747
SHA512 e4e6244f7ccf5a843d9b36b0b98193bc697eeac0215c890746de15778c3fd043f05509fcb050a1fdaf7ecac77691c1121daae76d3a54d24676d016545002feb6
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5nmDQB6nGyvn0b4T89ybJv4a:xC0ITo+TQ0InDUDAUPPb4T89ybl
TLSH
T166A1F835E0284DB74467D446F1626A43CEB97067D972AFD0EAD90E0D14F70E81341623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 38343b1d615063fd42d38bd2fbaeebe05d12187728f1e862ba9cc49d6b4843f3
MD5 08e6e060116a1fb308ec8c1d402ed067
SHA1 e2af20c47447c8bd6037e4184dd06431ba2b3525
SHA512 e46d5d38f180103fe764193b0066ee7b966c0a29dbb3a6e49ac9ef36f991ace2f62685ce1429ea0be92031caccc92ca4f44af0bdb268635fe721409cd251f127
SSDEEP 96:xC0d+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0SvQxwzQthj+99ur0X:xC0ITo+TQ0IoiU2ZUiPSIxZhj+99urUx
TLSH
T1C8C11A76E42C5C7B45A7E542F1133A57CEB520ABDA51AFA0EED50F0D01E74EC2392523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3ddc6b68a05c8725f545da3f1ad7ac80223ab81c93923f8d6591f91d76a21381
MD5 033683d3387719cff9ef5fc1cfb764e5
SHA1 b9044c225e3588e881e057b0addf61fed1462510
SHA512 be83521f47c218401680dd3b626a3e68a2a76d53e7072562d307c8b5d19da39edbc72d1cb3fc1cac731e77ec144cab21ddd9ef3eb8303cf8ad299169f3955704
SSDEEP 96:xbJ0d+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0SQhj+99ur0j9ICEp:xt0ITo+TQ0IoiU2ZUiPSQhj+99urU7k
TLSH
T1A5B10976A06C5CB745A7D446F0173A47CDB5206BEA62AFE0EBE90F0D01E75EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b42a6ea1221e4d557c780a1472da689c9725859d59988ba46f643ce83c9ee026
MD5 dfd2e2d45e642618ef6c42c8378d445a
SHA1 38bacfbc14bdbf40973e9c728ed0652346b408bd
SHA512 3c3474184bb51dbe59c1b4f9a89b3ff45bdbf008387e4ebc4c6c1c0d91c690ca44139ef129d1990a3c09127dbb06dc881516606867c2468a19d10bc992255ef3
SSDEEP 96:RbJod+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0SnhVm+99xRNC39I3:RtoITo+TQ0IoiU2ZUiPSnhVm+99xu89r
TLSH
T14AC108B5D41C4CBB48B7A445B0132E478DB5206BEA65BEA4EEE90F0D01E75DC5393623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ab982f854d80a41df68487c45f1986997ee2acd469546ac6c1b9cbf4094ea851
MD5 be634848fe2bf4b1d6e4388281a21d29
SHA1 5183422f77e6f6348e741df2b4885e5b61966aae
SHA512 0f87ca2c9685dca1ff90826de796ac3b5d07315097b053653479a69c40e843a4ffeca67a0d37413ef0e442ac34bdbc8547efc29c8ce9016392a9c9872decf013
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934WMySl8h4otop5nicDQB6uGyvn0SnhVm+99xRNC39I3:Rt0ITo+TQ0IoiU2ZUiPSnhVm+99xu89r
TLSH
T134C108B5D42C4CBB08B7A485B0032E47CDB5206BAA65BFA4EEE94F0D01E75DC5393623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download