56f1af0f02588b2404db48c178cf73c1bb626b67db967af091ec7b4a42f5cf93

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 28KB
Sample260731-a6j5csab92
SHA256 56f1af0f02588b2404db48c178cf73c1bb626b67db967af091ec7b4a42f5cf93
MD5 d18f6da12dc060b46de96f92bad1355d
SHA1 f2c92aa140f6ac927b883885a338299a4e76576d
SHA512 b96991556dcef5e31668c7f2be888ef88bc7a007fd601882dd34dd5ea8b45c5d96a7b0e1c6c2f7cb28621187ea4d299390f974c683fa289a5d100a627f450da3
SSDEEP 768:3SiY3p1HeOmh64O6szMx3257QlU0DhtAiwqKx/0:R64O6szAW2wbx/0
TLSH
T1C5D2E8B2A904DD7AD5139FC8323B7F3C30DA817BD9648064C39DCD694681CB7AA72DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299325899334368"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 1588	5888	chrome.exe	88
PID 5888 wrote to memory of 4436	5888	chrome.exe	90
PID 5888 wrote to memory of 4436	5888	chrome.exe	90
PID 5888 wrote to memory of 4340	5888	chrome.exe	91
PID 5888 wrote to memory of 4444	5888	chrome.exe	92
PID 5888 wrote to memory of 4444	5888	chrome.exe	92
PID 5888 wrote to memory of 800	5888	chrome.exe	94
PID 5888 wrote to memory of 4580	5888	chrome.exe	95
PID 5888 wrote to memory of 800	5888	chrome.exe	94
PID 5888 wrote to memory of 4580	5888	chrome.exe	95
PID 5888 wrote to memory of 1140	5888	chrome.exe	96
PID 5888 wrote to memory of 5724	5888	chrome.exe	98
PID 5888 wrote to memory of 5724	5888	chrome.exe	98
PID 5888 wrote to memory of 2056	5888	chrome.exe	99
PID 5888 wrote to memory of 2056	5888	chrome.exe	99
PID 5888 wrote to memory of 5772	5888	chrome.exe	102
PID 5888 wrote to memory of 5772	5888	chrome.exe	102
PID 5888 wrote to memory of 4260	5888	chrome.exe	103
PID 5888 wrote to memory of 4260	5888	chrome.exe	103
PID 5888 wrote to memory of 3376	5888	chrome.exe	104
PID 5888 wrote to memory of 3376	5888	chrome.exe	104
PID 5888 wrote to memory of 3444	5888	chrome.exe	105
PID 5888 wrote to memory of 3444	5888	chrome.exe	105
PID 5888 wrote to memory of 3212	5888	chrome.exe	106
PID 5888 wrote to memory of 3212	5888	chrome.exe	106
PID 5888 wrote to memory of 2984	5888	chrome.exe	107
PID 5888 wrote to memory of 2984	5888	chrome.exe	107
PID 5888 wrote to memory of 4788	5888	chrome.exe	109
PID 5888 wrote to memory of 1260	5888	chrome.exe	110
PID 5888 wrote to memory of 1376	5888	chrome.exe	111
PID 5888 wrote to memory of 2272	5888	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9d40bc728,0x7ff9d40bc734,0x7ff9d40bc740
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,2554329241053239935,759218733825109423,262144 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,10149709692501493919,18141222387492630548,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,11467742076597829641,2646097909363955849,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,17157449717093580382,10436698988751327583,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,1899083671561213153,10230065265166499562,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,15760659810650548766,16682718610274933354,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5288,i,1474514826910149268,5397542226231337226,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5328,i,7175348986648082502,13302783177683412454,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5616,i,12453737828550071730,16831256211075596105,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6068,i,17146413589965691844,17979662416880255628,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5880,i,8441545818986284369,11972584238818917946,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5556,i,608169853833302298,10743327119634875444,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5568,i,8676780697832168932,11496669513585556850,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,9838509230762509601,15233677560301792436,2097152 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,11755255683157453856,451081942757368105,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,7286354059101191988,3730667110435855243,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,7887548465566633628,1245080396571211403,524288 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5716,i,2075302017671742246,3524168562506268898,262144 --field-trial-handle=1924,i,8274569101874358754,6890477436790294715,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fd163631b43c18a72d822c8a811dbc47caeb913ae29f4599137b8454788a15b1
MD5 b5410a0d9ed9d1dd8ab1b12477f008f9
SHA1 140092af9decb7f7e0f6828d79b7b98463ff38dd
SHA512 80764efdae3d5de6f5270005ff037d206872086dbeb244646ab00d343235b0f881b8ae4b3064ddc0bdc114b0d221ea463f2c0b144ba99ec9271b1da0723d16eb
TLSH
T1F9519DF7C3D48A7D890556F4E7157E1BCE690918432C3D66C8E8AE1F67E2872D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3be0284f274e80a04f1e376d57bb5c4ebb621cda92b4289ad71d54a5dfe6484e
MD5 326dc68475e0076dfb0d2afa18bc0558
SHA1 50dd8a5b368d19a799787a2cb087cf856bd08d3b
SHA512 7c781cc21bd74190f3996151a67b8d45e2edc6e3e4593ef1d01b9be88a596f1bae57a6e5a041cda0e127738c1828421b5a70604a87b7f0bd19ea0d3e44ab6947
SSDEEP 192:5BR86akhbv7QvAPRp2WL9XxHsb+WNn6JPraeC2L/VyIsnAUge:5BR86lj86XTfwuPm2Fe
TLSH
T1F432862EBE10A93B6DDBC22AFA657793D7F6102171D52E40E6FC8A2C11DB5CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4d8e4ea8e22703863f0d0d8e5ed7bdc5f479f792068288c78854c7b56c5131f6
MD5 32b3fe857297da2868dcb472ebba13de
SHA1 1867da0208ab8baab123d06bf7ebb69eb0d34449
SHA512 1c97ca5e41f0c67851cfe07348d8ae0ec3f77f92988318e1fef60520a37b9fd9fa10d9c964c12cb433d2af89551f1e47861b487ceabc89ccc33c687709999911
SSDEEP 192:5BR86akhbv7QvjPRpnWL9XxHsb+WNn6JPUaeC2LucVyIsnAUgE:5BR86lj8DX0fwuPP2i4E
TLSH
T19E42972EBD10693B6DDAD22AFA657793E7F5102171902E40E7FC8A2C11EB5CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 40KB
SHA256 e73ee790ce90da47a499dc97ac9653e5d80abaa9e81ea427958ca6fb3285bb73
MD5 ed0e13e2a0fc050c4ee121da4fbe6b62
SHA1 6385960cd46533435f276ff93aaf87171ba6dfd2
SHA512 fc345fd4fb44d328c97aa2eb3859ed76d0c54f9fb9018a12056805ff826624a8aa1a0bb9542e1a7aab7b1d8fc6f53f030e3e48c1757e0bbba43e94478cad7c33
SSDEEP 768:n987wUTqBb8LwAUI5zt5OOJHg4RWEfZ1hoQbhfEd2fbk9P/lOPH5L0:98bTMb8kAf5zt5OOJAe9hMbOHp0
TLSH
T15F13F178002AFC770DF3D84DB0123D67DB98315A24D8F6E1A79E4E1C26591C846AB6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8c71b0399df3de9c6fefe7e4c5865998d62f5f6c35a16dc4f6971d186bc86616
MD5 3038dbbc270ac8b22122e1f88b94e69d
SHA1 add02f5a9e965485b89e17d9fc4736fb8edd11f1
SHA512 083b867e0d3befe5d5530a5d662a41ead3d3b55cd8d61e4027ed1fa781f2d295f7d5e149a2c7c01508568b15bd3d8e9d12c28b1e3b2927adbe7327b0df310d5d
SSDEEP 96:RC0d+r2io+TJ/E0f6m934BJMxESl8h4otop5TaicD7xB6FGyvn0SvQxwzQl0hjm8:RC0ITo+TQ0IviU2TU7HBPSIxihjm+9gY
TLSH
T182C13B76B42C8C7706A7A942F1132A57CDB4206BDA51AF60EEDA0F0D01EB4EC3342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6958d1ed07ee235ef1ad43d9ef26ab78e87c0ec5d10a8a7cd92c1ec4b0e55f7d
MD5 d3a3b4831ce2950d8ddbd90c211d9886
SHA1 b63160610032df9509279ead340026f1d06a5efe
SHA512 dc54573e36d6b45777d1cc656358c13daa3a4dc033797537bb531791e5cd6377ede20047ba02ec206b93df46796f237fbf3ddce94c5b0a18b043162b09b246b1
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5TamD7xB6nGyvn0b4T8gybJv4a:xC0ITo+TQ0InDUDTx7HPPb4T8gybl
TLSH
T145A10936A0288D774476D446F1622A43CFB97067E972AFD0EAD90F0D14F74EC2341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2a76bc73168652e577eb0cbbdec5d9739e252f5ca43a66e63f9cf2b9baae00b4
MD5 9a9ff0f55fb2ab7833c69cf08936eb85
SHA1 2936e4cc26097621adf5f5d1d555109c8d8e4467
SHA512 657ab7c6f6ca18eba3b30f0fdbdf3549ec566088910ca46bfb48c921e82546ecbb6d2c640bc3f9832ae1705703859c457ad1c81777aeeefd15ea3a6354651a1f
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934BJMxESl8h4otop5TaicD7xB6FGyvn0SvQxwzQl0hjv:Rt0ITo+TQ0IviU2TU7HBPSIxihjm+9gY
TLSH
T1D3C12976B42D8C7706A7A942F1133A57CDB4206BDA51AF60EEDA0F0D01EB4EC3342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download