80ffd37a74c3de114d1ab8842651a08887afbc58ddecdfabd466448c16e69615

Analysis

max time kernel
900s
max time network
902s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 33KB
Sample260730-wx64esvbld
SHA256 80ffd37a74c3de114d1ab8842651a08887afbc58ddecdfabd466448c16e69615
MD5 6bcddc95ee1b53e46cda1cc9a71616f4
SHA1 ac2b3d9911da04a72aa81f1e8d94fe5809b7d825
SHA512 818a05dd9e4b43de79d2c1627e00a30df41144d26f61722d3342e7eb607a11de3be1a869e4fab184960019cd71bd949471dee03107a8ac90c4a8efe9f691d79f
SSDEEP 192:zrHNpwhWdI3ZwZow5h+zGi27BL+kDXe7TeXsIgQ/OnQ1ErCg7wOL+qg9oi:zsCI3ZwZow5h+zCBX6DnQ1E+g7wJqK
TLSH
T1CFE21675AA5AB41B06F391F07750B70DA5EAD72BD49366C2C1EC47CA06C1ECAAC3207D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299091801157702"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3672	4876	chrome.exe	88
PID 4876 wrote to memory of 3368	4876	chrome.exe	90
PID 4876 wrote to memory of 3368	4876	chrome.exe	90
PID 4876 wrote to memory of 1280	4876	chrome.exe	91
PID 4876 wrote to memory of 3236	4876	chrome.exe	92
PID 4876 wrote to memory of 3236	4876	chrome.exe	92
PID 4876 wrote to memory of 2564	4876	chrome.exe	94
PID 4876 wrote to memory of 4808	4876	chrome.exe	95
PID 4876 wrote to memory of 2564	4876	chrome.exe	94
PID 4876 wrote to memory of 4808	4876	chrome.exe	95
PID 4876 wrote to memory of 2792	4876	chrome.exe	96
PID 4876 wrote to memory of 5916	4876	chrome.exe	98
PID 4876 wrote to memory of 3080	4876	chrome.exe	99
PID 4876 wrote to memory of 5916	4876	chrome.exe	98
PID 4876 wrote to memory of 3080	4876	chrome.exe	99
PID 4876 wrote to memory of 804	4876	chrome.exe	101
PID 4876 wrote to memory of 804	4876	chrome.exe	101
PID 4876 wrote to memory of 2172	4876	chrome.exe	102
PID 4876 wrote to memory of 2172	4876	chrome.exe	102
PID 4876 wrote to memory of 1808	4876	chrome.exe	104
PID 4876 wrote to memory of 1808	4876	chrome.exe	104
PID 4876 wrote to memory of 2800	4876	chrome.exe	105
PID 4876 wrote to memory of 2800	4876	chrome.exe	105
PID 4876 wrote to memory of 4824	4876	chrome.exe	106
PID 4876 wrote to memory of 4824	4876	chrome.exe	106
PID 4876 wrote to memory of 5020	4876	chrome.exe	107
PID 4876 wrote to memory of 5020	4876	chrome.exe	107
PID 4876 wrote to memory of 4804	4876	chrome.exe	109
PID 4876 wrote to memory of 5816	4876	chrome.exe	110
PID 4876 wrote to memory of 4880	4876	chrome.exe	111
PID 4876 wrote to memory of 3532	4876	chrome.exe	112
PID 4876 wrote to memory of 3204	4876	chrome.exe	113
PID 4876 wrote to memory of 3204	4876	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaacd8c728,0x7ffaacd8c734,0x7ffaacd8c740
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,11389695757414858901,143373225482600639,262144 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,7927113591731814310,10260001098449117154,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,4684219314796312185,9512970648529301617,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12584787995785790413,5836201527611393878,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,12000956647808035214,14039921955951385902,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,9003806776817771223,13620527530516510322,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5308,i,5011848185183074348,17547921214613657946,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5360,i,13295501909388483829,6973543126572212076,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5348,i,5688526722864164268,11359854844109811556,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5440,i,3301975396088730328,551080959947327376,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6012,i,4883580692178357348,376822036948038685,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5756,i,16812384529986719913,17007253178973349335,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6364,i,7327452373401995722,8361478853843671767,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6480,i,15905228196811400575,2879029585523286826,2097152 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,76714196201762685,8336528028078700492,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,7635583454823351585,10740772803433183493,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,7753320054929795942,11593515048663991381,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6100,i,9395864740660821234,1488928778049459076,262144 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,10070955149078293830,8752947100055318434,524288 --field-trial-handle=1916,i,6450588133593960256,8146918705039550587,262144 --variations-seed-version --mojo-platform-channel-handle=1136 /prefetch:14
  2⤵
  PID:3204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3436

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

71bb2bd4-2ff6-4024-a529-d30ef562f063.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\71bb2bd4-2ff6-4024-a529-d30ef562f063.tmp
Size 11KB
SHA256 ad266ead1dbc15d1dcc3700abb868545586c5433960f3a215ecebc6ad443ef30
MD5 e1305bd646009d4de7cad828fa3993de
SHA1 d8719f45da2f4efd5de128cf3abd1b4923ba5591
SHA512 9d830f405082a45df7469e83a60efc70adfcbd6fe0708f4fa636b248a9968938e851a00ee7fb1c4b520797946c7a49c95bd99fdd4b66b07a0d66588e63e2eeeb
SSDEEP 192:dRSvb4s4v7DvAPRp2rF964Hsb+WNnpRPLfY0kwnYVyIsnAUge:dRSz7kH6XabwbPrH8e
TLSH
T1A932963EBD64697B6DCBC21AF9257B53E7F5102261902E84E7FC8A2C10E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 729d4b4c0b76d192ea971ad4be134c46d4b21dea4fdfbcfb18708c94eed946e2
MD5 50e7be36d8c19119504c7a4e9d1981e1
SHA1 30fde5d0860b2d3be060ee7f7bdb8e0ed2a9776b
SHA512 ae3c36eab041789223403388a5fb37da6609180210ee1702fa002eb197341a6557875266642697506ba26fc88b2cc544f5ee85aca9dbbd9869ada8227a6a84aa
TLSH
T1CE519DF7C3D4867D890556F4EB156F1BCE290918432C3C26C8E4AE1B67E2871E20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1018B
SHA256 4a9c45dd1217b327aba0a60d201f54c508c43d16d72eeb0f91085828e311f39c
MD5 27a4a8337d836f88d79b751d714258ad
SHA1 fe44e9a719c96ac4835be8fadef88ba7f19f99b1
SHA512 4152c2ee451c053c3edb330421d3fc11e6822b571fbed952ef0a7b872a8ec2944bc3697bcfdede3b466091ebc534e0ddf145c41121092a1f522b9a6cf0527f61
TLSH
T1C2119EA7E37E755B107D486F2E06BC0AA9B6A8344651E4F4DE69827DB0C18F70B26C07
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3926a6479b834b5f1acb00697ed0a410334deabdd8fff594dacb78410def4ffc
MD5 0ccb886d63901db82778628f8e22d2da
SHA1 52f6f13c032e5630db4dfb00f2173119f0a191a0
SHA512 f82ad66a19ff03adc6a39596074ae06de9b7d063ea198a48382b189da2dd5bfe75193b4d9a9b11ae236125679052da395d57d32d25924e08af4ddd29ad1c8dd0
SSDEEP 192:dRSvb4s4v7DvpPRpdrF964Hsb+WNnpRPAfY0kwgYVyIsnAUgE:dRSz7kHJXfbwbPuA8E
TLSH
T1E042A73EB964697BADCBC61AF9257F53E7F5102261902E84E7FC8A2C10E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 06e489fae6fa5b67d4a9456f0e7b7970b2ebfc6e659d1c37b568bbc33ad05dd7
MD5 f9119d2dd8c5a2ae2b3bae9ff21f071d
SHA1 a51976e6baf517ec0dd130fad6b817eeb98375fa
SHA512 143a669609a09dd5cd37270b61cd1f309440b2ec8885c3032cf332b93beaedfae14c77356e010582c9601ff552f67c1e2aa5469dcf457141fc03226a94c60b04
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7Tc1Sl8h4otop5cpDKB6bdGyv9JeQDJe+RNC39ISyVNCR:Ct0LA/TE57EiU2GaEw+eQDE+uCMJhN
TLSH
T13BC118B5B46D5EBB4DF6A481F0433D438EB85117AA257E44AAED1F0C00D75EC1783927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 152172dff6c5db7bd611ed0bbb0262f64240d20058d4e2bbe9038cd64cccd061
MD5 bffd4ed93a92991ddd6de709f9e1e240
SHA1 7ce351091e44869199ab6fa8c76cb51c7fb2475b
SHA512 2d5f510b235907f20fc7537319bbe88d967a35f9c877d2dada2cbe1acf6a915ac625fd001ff96d622c3b66e5f3422e4cb2f7eb9abb2e2627e694d66d4dc9c515
SSDEEP 96:CC0d+cAOIt5aDVmufj7Tc1Sl8h4otop5cpDKB6bdGyv9JtFiO0AuSwbSDJeq0j9E:CC0LA/TE57EiU2GaEw+tFGSwbSDEqUZG
TLSH
T13BC13971B86D6E775DF69551F0827E83CEB8A157EA216E808AED0F0C00D71EC2783917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4ba9f8e8d63539ca67567ef89b912f2f972b30088a9ce792b74393fec45d3abb
MD5 058756c841f0bdafd635130bb8d83588
SHA1 70c4e407d4486aa6deb6ab1d42b2f2d0b6d448c7
SHA512 3282dea71aaaa7652b0a7e3bdacd3ebb00bf9c31044e08d48457d92d800a1d00bad885927222815dc41c51f46da9be6f70330081936095c923d73e19fb27415e
SSDEEP 96:CbJod+cAOIt5aDVmufj7Tc1Sl8h4otop5cpDKB6bdGyv9JeQDJe+RNC39ISyVNCR:CtoLA/TE57EiU2GaEw+eQDE+uCMJhN
TLSH
T19AC107B5B46D5EBB4DF6A491F0433D438E78512BAA153E449AED1F0C00D35EC1783927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ee68021ca65dc09fee136ed34b29c8e6c3f72aa8ccc464500f365cb2567a4329
MD5 14dfe38811d8fa1e27c9077569f99699
SHA1 a34c7081132f1f64b21719e3874893ee507953c7
SHA512 977a15c2697f5c56c238da5a973604feff608ea06989e9aee1408d55506a8a42d4d40bcd712c9d4046c0ff047b2f76dbdc1d06453e9a75d875bf7d2873dd449b
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5cCDKB6/dGyv95SJehbb2Jv4a:gC0LA/TE57cDUD3aUweSEhbKl
TLSH
T1CEA10971B4A95EB75DB9C585F4827E83CF78A113A9216E80D9DD1F0C10E71E81782A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5aedea400f10c3149b447bf25b708a0eade85551f16ed46e3b5e8d5d69a56141
MD5 17a94b9a17665d3b8e7ea9df75be66cc
SHA1 86c5676f7718d552ebffe91236a185428dc3dfb3
SHA512 57793c846a037e594af7a5cf4efabe24efc5c9c0184f54de45842afed5cd7ada30d7325e745edc6f35cf57dc17b3699e39334331698c3c923ced2556d5013128
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7Tc1Sl8h4otop5cpDKB6bdGyv9JtFiO0AuSwbSDJeq0jO:Ct0LA/TE57EiU2GaEw+tFGSwbSDEqUZG
TLSH
T168C13971B86D6E775DF69551F0827E83CEB8A157EA216E808AED0F0C00D71EC2783927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download