21ed72b08e6c6f9b3132c024d89fed9a853c9a75e350f2381a5e372e67bc3eb7

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 344KB
Sample260728-sd947azvdw
SHA256 21ed72b08e6c6f9b3132c024d89fed9a853c9a75e350f2381a5e372e67bc3eb7
MD5 f16451ef15844e39b1fb5b00e38b572a
SHA1 b64933ba6419f21a069a7803b3bcf0fdc696b051
SHA512 ebe4faada4189b433b247e27a6ff28fb100a8fff3549a67af9a394542fa2a1e72387ddfa97f36d8afb8b7a1f4d80c5330d5e1dd0e59ede232602c2e97387fb67
SSDEEP 1536:Ua2qG1NCNO39FY4vyUkUwWC+tymrGVnmctamufOQkdenOtEurceri8AXlpg+owmH:6BNFYDUkUwWejcdXnqBLlNQFZK2FQ
TLSH
T15474F72281B2127E155F6DA9F160F728E197F30FC9A797C8616C83A017C3D9DB973A48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5756	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297245356211752"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4176	4292	chrome.exe	89
PID 4292 wrote to memory of 5756	4292	chrome.exe	90
PID 4292 wrote to memory of 2592	4292	chrome.exe	91
PID 4292 wrote to memory of 1040	4292	chrome.exe	92
PID 4292 wrote to memory of 2592	4292	chrome.exe	91
PID 4292 wrote to memory of 1040	4292	chrome.exe	92
PID 4292 wrote to memory of 1180	4292	chrome.exe	94
PID 4292 wrote to memory of 1180	4292	chrome.exe	94
PID 4292 wrote to memory of 1456	4292	chrome.exe	95
PID 4292 wrote to memory of 1456	4292	chrome.exe	95
PID 4292 wrote to memory of 4668	4292	chrome.exe	96
PID 4292 wrote to memory of 3416	4292	chrome.exe	98
PID 4292 wrote to memory of 1084	4292	chrome.exe	99
PID 4292 wrote to memory of 3416	4292	chrome.exe	98
PID 4292 wrote to memory of 1084	4292	chrome.exe	99
PID 4292 wrote to memory of 4820	4292	chrome.exe	102
PID 4292 wrote to memory of 4820	4292	chrome.exe	102
PID 4292 wrote to memory of 5360	4292	chrome.exe	103
PID 4292 wrote to memory of 5680	4292	chrome.exe	104
PID 4292 wrote to memory of 5360	4292	chrome.exe	103
PID 4292 wrote to memory of 5680	4292	chrome.exe	104
PID 4292 wrote to memory of 2812	4292	chrome.exe	105
PID 4292 wrote to memory of 2812	4292	chrome.exe	105
PID 4292 wrote to memory of 3796	4292	chrome.exe	106
PID 4292 wrote to memory of 3796	4292	chrome.exe	106
PID 4292 wrote to memory of 3188	4292	chrome.exe	107
PID 4292 wrote to memory of 3188	4292	chrome.exe	107
PID 4292 wrote to memory of 4180	4292	chrome.exe	109
PID 4292 wrote to memory of 1464	4292	chrome.exe	110
PID 4292 wrote to memory of 4184	4292	chrome.exe	111
PID 4292 wrote to memory of 2416	4292	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffedd65c728,0x7ffedd65c734,0x7ffedd65c740
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14494479655689967408,1678068519571655489,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,12347238478652324049,4551321513021609096,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12904403753094171459,2138815534749693797,262144 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12228239741051145158,13634298515148392940,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,16005565555849590380,5349514356065906494,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,5827132582704264803,1171006488800003695,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5348,i,14045668804198889536,13992894888028769820,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,14311760195262389237,15854227926314685311,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5340,i,9073494227419198787,17783670952324524308,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5944,i,11962824787378869083,4263506354072930743,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5748,i,11787147876649381848,13366625082509018755,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6020,i,6155014872898614166,7380303226171254493,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5680,i,14512813087892471790,4393714770899016269,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5404,i,11443842994659819009,4104536922942267203,2097152 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,13469703507271011466,6175431594306383259,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,7200370449359691708,10401983439746973325,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,17709226884727774628,1324837049089947749,524288 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4836,i,13166550813987604324,1657307779176054482,262144 --field-trial-handle=2332,i,2595078392422311695,16320325331977873950,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3c999b3e-21bb-49c3-8e5c-7b1cd41f8a7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c999b3e-21bb-49c3-8e5c-7b1cd41f8a7f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0a4cd33771ed16d21626a314cba74f59ffb1011359a767b951d0e1fc671c7549
MD5 d624683168e28865227e0fedb4c84f4e
SHA1 3f159cb1a11615e27b12b8408b952387dc2d0608
SHA512 e42f2561eed221f3cfc77befed170b7fa2945ae4654c8c91a05ae38e28c8f0ef51d716d75df19cc566818d3f865548e661e540f7cf52e92d1ae8fe5a46e3049b
TLSH
T1EC518DF7C7D4867D895156F4AB156E1BCE2D0919432C3C26C8E8AF1F57F1871E21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cc700f36db12c543df0ca190b33516da9bdfeb748516cdb75962d1f86adcbd53
MD5 27c4c411942c2687b26f4a626eaafd31
SHA1 546f7dc4209b8b3ce023477981c2854301008c45
SHA512 57293a5bb916f4a666a1574aac5baeb6cb8e7facce9d9be93e87c96b02e914120d8122e9810d2f48e5b40ffdfba1f764a456d0c3b65f5490a78794947552bb4c
SSDEEP 192:ZRT1o+tv7uvAPRp2EZ9UHsb+WNne3P2cskwT8lVyIsnAUge:ZRT1RNK6X3GwyP2ee
TLSH
T17532B56EBE14697B6DCBC62AF9667753D6F5102171E02E84E6FC8A2C20EB5CC6317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 44c8f1510807f199ba3a25d75ae8d0a6f0cb4c432db814f2380a2c2441600949
MD5 ce01935c434bf1276c7e5b5734682007
SHA1 c58c7b21039907d75430a2566b46c447d6445d4c
SHA512 c4d42a663f742d3c2d0faf1897616b34e93cf080a2e06d0272fc46f4324f2b8a29a1c6da350f2025033be1603f4cf48015af61e6cadcfe02782b365cbb7735ca
SSDEEP 192:ZRT1o+tv7uvJPRppEZ9UHsb+WNne3PecskwTXlVyIsnAUgE:ZRT1RNKJXiGwyPOPE
TLSH
T1AC42B55EBE14297B6DCBC62AF9667B53D6F5102171E02E84E6FC8A2C20EB5CC2317117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae8bbeb4-a0b8-4f0c-9650-a03602a4ab78.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae8bbeb4-a0b8-4f0c-9650-a03602a4ab78.tmp
Size 11KB
SHA256 93785f5a55dd4064becb4f1cff2db93ee5c453069390cd1f175b14efbc7c3712
MD5 3f745d2e721c8e8653083d0942fd1e3b
SHA1 65c5deb319ad77fa2904b9e80a68747d89661424
SHA512 1054802f590f58b87fcf7dd07e0c496be092915ce6b1963537363cc344b69aa858c5224a631afcd5370a01ccfdb24fd88e105054f3077d30b55a845f9d252488
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9mO5a1AfTH:oKj8P7KxkXqKf/pUZNCgVLH2Hfgslxbg
TLSH
T10132EA67948D9E3B4FD8D518CC176B8B6CB4019673780824A6FF9D0403A67CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b3a192a9dec42ed9cc2428921cb8357dec308e45ae2236c08e4a97c1167791bf
MD5 a905d40e04f00339c5cbd0e60155a7f9
SHA1 e61765e2b59533e3b0844a057642a7641931b745
SHA512 15187a707bddb10c9b1985118ae4a8009b10a9ad2ed3758a6f33717f47470cc0296ede7022b23f3ad6780a2d5bd971b20e4446bbdb1458659d170a8ee6616adb
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphunMISl8h4otop5eItD3B6UGyvODctTaWHRNC39IS9:Ct0AJr7fbyVlKiU2ZxQFctTaWHuCO4A
TLSH
T100C11975E82E5C7B4DF6E045B1032D43CEA466AB7951BA28EADE4F0C01EB9DC0383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8cafcd3ab1685b08cb2871482c8cffc92d161d80edab436281fbbcec911c65b7
MD5 c861575b7ffaed0a2ae80618ca730541
SHA1 7769140c3bc85e4487e484c452804e2c1c9bc6a0
SHA512 9bebe50b2e268747eb7f6dabefc29523ace6f337c167243ea0185f281cf1013dc9d72fbecab9c97f9809dd76f5be158a602dd4ac235b5e0fbacef2e147d73bc8
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphunMISl8h4otop5eItD3B6UGyvODcyXxwzjQ4IRA16:Ct0AJr7fbyVlKiU2ZxQFcmxoQ4J1aW+F
TLSH
T1A7C13B72F86E6CB759F7E591B4032E43DEB466EBAA416E64DADA4F0C00DB4DC1342113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 70699a1839dad65b48b31aa1d55d230771ab26cace987d5e021d04c2fb7138b3
MD5 cee321b11f2958c09d2649f02c7d5051
SHA1 3f1c499985e37a937603323d9255af1819270b64
SHA512 4d382fe8c849ac47fdd75e59e6db9921cc1b81e388e5e55f537ba18ffb209333c2b18ecfa452a80af14648a473e8047762b2ebda6032c03ab3a457f26706cc3f
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5e3D3B6AGyvODqLW/bjv4a:gC0AJr7fbyVlFDUD4xkFqLW/bH
TLSH
T122A12A72F4665C7B5DB7D444B5122E03CFB4B2A7B961AB64E9DD0F0C00EB0E80741217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f10cd4453d989d0581c16a15d73ee33384002ba6abc057ed267a8a6d0e6d31e1
MD5 9d997d98edadcc18fa017935a3d856e9
SHA1 39362f822946b0ffae3d8d0e880caba627a42826
SHA512 99ccc6b74e6aa5015652c6029c4bb05390c281e6e035d4e61e97655ce8fdb3c6867e0934ddd3ce54719997c691b9f5aece73a8144baca2ef0d045ea6311a6a97
SSDEEP 96:CC0d+qKJku7fby2f2eaPphunMISl8h4otop5eItD3B6UGyvODcyXxwzjQ4IRA1aZ:CC0AJr7fbyVlKiU2ZxQFcmxoQ4J1aW+F
TLSH
T1DCC12B72F86E6CB75AF7D555B4032E43CEB466EBAA416E64DADA4F0C00DB0DC1342113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-148-0x0000016E26010000-0x0000016E2607C000-memory.dmp

Download