feb9bb4d5585b13a65864a9fd0a3acf2c0900371781ccd84aa104d50aeff0d02

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 21:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bCOsKSUW.html
Size 465B
Sample260729-z7x52sshnc
SHA256 feb9bb4d5585b13a65864a9fd0a3acf2c0900371781ccd84aa104d50aeff0d02
MD5 7d2b9599471bd1803099a2509fef46a1
SHA1 f92e654fb4c1a2259157c541a76c1f9998816612
SHA512 7bb96fcb9e72b099c7b46f82877d60be6c36a0b82cc99294598118537534f92f070c31f27e91bdfa374bc56337dafff08eb40a422d3afbc0fd43f85704bb0058
TLSH
T118F027B71CA334131525E740658174FEB80254F877C979A4F26273836C8873384C62F3
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1948	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298337454795162"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
252	chrome.exe
252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3508	4544	chrome.exe	88
PID 4544 wrote to memory of 3352	4544	chrome.exe	90
PID 4544 wrote to memory of 3352	4544	chrome.exe	90
PID 4544 wrote to memory of 1948	4544	chrome.exe	91
PID 4544 wrote to memory of 2684	4544	chrome.exe	92
PID 4544 wrote to memory of 2684	4544	chrome.exe	92
PID 4544 wrote to memory of 2068	4544	chrome.exe	94
PID 4544 wrote to memory of 1352	4544	chrome.exe	95
PID 4544 wrote to memory of 2068	4544	chrome.exe	94
PID 4544 wrote to memory of 1352	4544	chrome.exe	95
PID 4544 wrote to memory of 2884	4544	chrome.exe	96
PID 4544 wrote to memory of 2884	4544	chrome.exe	96
PID 4544 wrote to memory of 3972	4544	chrome.exe	97
PID 4544 wrote to memory of 3972	4544	chrome.exe	97
PID 4544 wrote to memory of 1264	4544	chrome.exe	98
PID 4544 wrote to memory of 2844	4544	chrome.exe	100
PID 4544 wrote to memory of 2844	4544	chrome.exe	100
PID 4544 wrote to memory of 4956	4544	chrome.exe	101
PID 4544 wrote to memory of 4956	4544	chrome.exe	101
PID 4544 wrote to memory of 3156	4544	chrome.exe	104
PID 4544 wrote to memory of 3156	4544	chrome.exe	104
PID 4544 wrote to memory of 5500	4544	chrome.exe	105
PID 4544 wrote to memory of 5500	4544	chrome.exe	105
PID 4544 wrote to memory of 5644	4544	chrome.exe	106
PID 4544 wrote to memory of 4868	4544	chrome.exe	107
PID 4544 wrote to memory of 5644	4544	chrome.exe	106
PID 4544 wrote to memory of 4868	4544	chrome.exe	107
PID 4544 wrote to memory of 4980	4544	chrome.exe	108
PID 4544 wrote to memory of 4980	4544	chrome.exe	108
PID 4544 wrote to memory of 4692	4544	chrome.exe	109
PID 4544 wrote to memory of 4692	4544	chrome.exe	109
PID 4544 wrote to memory of 4588	4544	chrome.exe	111
PID 4544 wrote to memory of 4340	4544	chrome.exe	112
PID 4544 wrote to memory of 4276	4544	chrome.exe	113
PID 4544 wrote to memory of 252	4544	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bCOsKSUW.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd25abc728,0x7ffd25abc734,0x7ffd25abc740
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3375297983542397144,11161649719117810166,262144 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,2163089181635604444,7457134186331212603,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=1468 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,10684049260008471429,1071742272520465819,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13695013021999386722,6078325472710510959,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,1236942326241663369,17502445181570957706,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,4378738291405050844,14384335330091426855,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3868,i,5297520501806821245,2219558739132295879,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,5013555404193266203,9410071740043745370,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,6840055304672194124,5076109129641358186,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5448,i,917790700068542018,10187047311449178781,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5540,i,9612050965699575266,5249506947007954132,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3312,i,270299456420933042,1352376927332654102,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,10657244395544221222,8591833521870436002,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5660,i,12458627542254657913,4696091980265596727,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,14065948917235261070,3075649468224264010,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3236,i,14049568941579155235,1273582126345637949,2097152 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,13223350197551827596,8466762813811064805,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,13824211433902794072,1007919031607662674,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,12298404568483948819,7710719778623761003,524288 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5704,i,16214089670066905498,15358800438315676901,262144 --field-trial-handle=1908,i,15334626134352683843,703216572822670514,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 54d5442feec69d9e36d495f7bedbf02c6a4554a38d3cb9805c68e55c3af0c3e9
MD5 128b1722cd7db3515a03f86bbbcb6e3d
SHA1 f44c2509b138fc546abb38a8d614beb342b46f9c
SHA512 b4313b130e845fbdad028bae79facdfd84b626e80c3864f59191f54a0f1bba34ae7f7579049b304ff83193eb38f78c674518a56aea6a6d20f720c02655107bb0
TLSH
T1E5F0E520A552522EE3D0233D1CD4D5C8B9B2445824574ED0B14ADDB7B45878B5A83BB9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 46326c03952077fe307d674b9f02e4fdaebf169777958ede21868e33cc3e1482
MD5 469081cab8028aba91c13d66e54ce4f7
SHA1 5f44699819b658fef60655e761eaa5ba1713f06c
SHA512 8e21346d40cd247476e12d6ea65f355f2186bcb08fc03a6697d05919e0a974b8fb8c93b8df8ab23a4a5ace161f6f2f6f83f01b17d9b13b9b6b38648ac6645154
SSDEEP 192:D1pY1KaKSrJu3ducywADSwDJrG6NWULVK:D1pY1Ka1rJu3ducywADSwlrG6NWULVK
TLSH
T173D17EB7C2E59D6D896152F1E7383A2BCE2E0928631C3C1AC8D5DF4BD7D24B1D21498E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dfa2f769a2691dacc3972c5c32818a06058e1783f5101aa7e798692b114e9d07
MD5 ef11871806c5ca05774fb74702568863
SHA1 17232e5d5c7a5bdd4e8783ac3eec90553d04730a
SHA512 f5197393d680bad879385df6b5df65711b8ee292f0ad66f6e05203cdf0aa9b90625e2c5da3b8910ed0fdf14842f1db88b1cfc6b29ba0b9a81563df15c7bfbb09
SSDEEP 192:5BRUEaa8v7QvAPRp2WRxN9XxHsb+WNnAyP4c2HewZiVyIsnAUge:5BRUEjo86Xp/fwRPV2we
TLSH
T12732962EBE10693B6DCAD229FA667757E7F6102131D42E40E7FC9A2C11EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb4b3be62fc836aae1778942520c8daeec523d81e9e9df804a17d4b1a32474fd
MD5 d336472b3235d16c1923eadc046d43ff
SHA1 e06b9c43b0ad47419b2127ae836e073563a1bfd0
SHA512 fb3925f8bb27c1b30b354a03bb4078e65c422c2971e727fb317f2f99206cf2f04819bb8330e0020bcc3a7aee92b653af0776d5f6b94556792455b4845b78e8a9
SSDEEP 192:5BRUEaa8v7QvDPRpAWRxN9XxHsb+WNnAyI3EI1c2HewZ6VyIsnAUgE:5BRUEjo8DXn/fwRDIq2gE
TLSH
T14842862EBA10693BADC6D229F9667B57E7F6102171D42E40F7FC9A2C11EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2285d66b5a5e4677a52a73c858e2b2a911efb3960569feb89cf2d832450dba7
MD5 b6785d594b4eb55601078388545bda85
SHA1 2d8ab47f4c0b09cb765ec2ba371d2da7651fdd24
SHA512 4e806e833b85fc316ca684eaea94ccb0049640dab3e0bbbd11ffe96851bbf8c59aed824ee12db131ac19e312755023bf15e2f191f429dec4c6a2c16dc6be23bd
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5pmD9B6nGyvn0b4T8dybJv4a:xC0ITo+TQ0InDUDijPPb4T8dybl
TLSH
T158A1F835A0288DB74476D446B1626A43CEB97067E9B2AF90EAD90F0D15F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 47d7ba23d8f7863804101cbd34e681e98c200de1b57cdd42d97b7a9b5d5c8b1f
MD5 a1f00ff49959bd5f5179ab08e1ad9c91
SHA1 0e8ef0cab8fd8a9899943d8dabef2bb41f2d4b34
SHA512 d696847b19ff5f0ca7a2d4d6741890bb651d8c28fa5914cfd5a75c17089e3f28353dbdbe91714c1f21ae93f6b4164a6e7b287b4634d6ad59dbcf771fe4b75142
SSDEEP 96:RC0d+r2io+TJ/E0f6m934nMOSl8h4otop5picD9B66dGyvn0SvQxwzQVShjm+9dK:RC0ITo+TQ0IRiU2TjlwPSIx4hjm+9duv
TLSH
T1C9C13A76A46C4C7745A7E542F0132A47CEB8206BEA55AF70EED60F1C01FB4EC2382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f47be7e4b5d0de5f67adb6b9f985a64d01acabaaf3e58fd9b73b51a243781829
MD5 61d1868036b53ba6a5d058e5d8b9f032
SHA1 8a0c4902960143c4eeda9f84066e033e3a3a223b
SHA512 8a03af890b4c35818752e00bb1fe90c43531473ad125c7b1dfc4120ef2882792c8ad80d02b82906189ca8e59d3537ebb8de2253a36ba693cc7ddf39c56e8e772
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934nMOSl8h4otop5picD9B66dGyvn0SxShlm+9dpNRNCl:Rt0ITo+TQ0IRiU2TjlwPSohlm+9dzuXf
TLSH
T154C1F775A02C4CBB48B6E485B1132E47CDB8206BAA69BF64FEE90E0C00E74DC5383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4fe0bb1fd7b159a66440486843aba6a1e95fa561f1bef93a161ae4d16a93a8e0
MD5 a332fb425e86b9ad0d03433273efa0d3
SHA1 983ed8ab120c82abfca6077d556a6367056c73e3
SHA512 6ba83261b6ca87efe3de959fcce76d633e9cf6a13a12209b524c311dd31eb5cec8e77d076068b38a360f8e6d1bdbdeb9391c2b1b08b106afef03586ad9a03922
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934nMOSl8h4otop5picD9B66dGyvn0SvQxwzQVShjm+9s:Rt0ITo+TQ0IRiU2TjlwPSIx4hjm+9duv
TLSH
T1F9C13A76A46D4C7745A7E542F0132A57CDB8206BDA55AF70EEE60F0C01EB4EC2382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download