6fee1d5ae34caf926b6dd23e48bcb32547b635fbacf5e8b721290cd7014afc2a

Analysis

max time kernel
899s
max time network
885s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
damons.html
Size 24KB
Sample260731-endbbacd73
SHA256 6fee1d5ae34caf926b6dd23e48bcb32547b635fbacf5e8b721290cd7014afc2a
MD5 508790c1b19f18aa43443fea3c9b9284
SHA1 143171f8c8ad0454cc66c54ab1edfad9b2ad0343
SHA512 18ab91527b99cbcfa059260676a977d565d67804436ce59d92380ca4cb68e2d6957d4c02e1044aaa81f7ebaa68b725fc8cc0686170ed978c23712eb48900af30
SSDEEP 192:CNe1oMl7XjwIHqeaFQDmo2ex0Ccso0JsyONEQsFUt3I8nUiWyCvtRZcEtTSOgJWD:CNe1l7znNHqE07so0JsyOMednx/0
TLSH
T155B2216BEC088A6C51313A8A796AF0CDC189B50FCC7ADD34B1BA561F1515FC846A7CB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6044	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299446645246638"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3560	2316	chrome.exe	88
PID 2316 wrote to memory of 6044	2316	chrome.exe	90
PID 2316 wrote to memory of 4220	2316	chrome.exe	92
PID 2316 wrote to memory of 4220	2316	chrome.exe	92
PID 2316 wrote to memory of 5480	2316	chrome.exe	91
PID 2316 wrote to memory of 5480	2316	chrome.exe	91
PID 2316 wrote to memory of 2472	2316	chrome.exe	94
PID 2316 wrote to memory of 2784	2316	chrome.exe	95
PID 2316 wrote to memory of 2784	2316	chrome.exe	95
PID 2316 wrote to memory of 2472	2316	chrome.exe	94
PID 2316 wrote to memory of 5496	2316	chrome.exe	96
PID 2316 wrote to memory of 5100	2316	chrome.exe	98
PID 2316 wrote to memory of 5100	2316	chrome.exe	98
PID 2316 wrote to memory of 6120	2316	chrome.exe	99
PID 2316 wrote to memory of 6120	2316	chrome.exe	99
PID 2316 wrote to memory of 3224	2316	chrome.exe	103
PID 2316 wrote to memory of 3292	2316	chrome.exe	102
PID 2316 wrote to memory of 3224	2316	chrome.exe	103
PID 2316 wrote to memory of 3292	2316	chrome.exe	102
PID 2316 wrote to memory of 5000	2316	chrome.exe	104
PID 2316 wrote to memory of 5632	2316	chrome.exe	105
PID 2316 wrote to memory of 5000	2316	chrome.exe	104
PID 2316 wrote to memory of 5632	2316	chrome.exe	105
PID 2316 wrote to memory of 1596	2316	chrome.exe	107
PID 2316 wrote to memory of 4984	2316	chrome.exe	106
PID 2316 wrote to memory of 1596	2316	chrome.exe	107
PID 2316 wrote to memory of 4984	2316	chrome.exe	106
PID 2316 wrote to memory of 1388	2316	chrome.exe	109
PID 2316 wrote to memory of 4392	2316	chrome.exe	110
PID 2316 wrote to memory of 5828	2316	chrome.exe	111
PID 2316 wrote to memory of 4492	2316	chrome.exe	112
PID 2316 wrote to memory of 956	2316	chrome.exe	113
PID 2316 wrote to memory of 956	2316	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\damons.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7ffb84bfc728,0x7ffb84bfc734,0x7ffb84bfc740
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,8113149415069618125,5389415418314953070,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,11253418197585001258,9254519233763290307,262144 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,14152024983296076876,3285772088888004753,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:13
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,12135807718643900489,252994878391671590,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,15384270816650055164,347062758734581121,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,79506443713692682,13953221120209685202,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5360,i,1047497733383320190,8017568866936675117,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5340,i,9334049253986823886,1197258159577904053,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5284,i,2248211127940564806,15772862658880017830,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5428,i,6784519030604037142,14901975297477952225,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5892,i,14036578143220018363,17146951582367565707,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5372,i,1341608661333873745,16353389869283349831,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5424,i,12539730531966549941,13360265263927047597,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5360,i,10093513288426725482,17103863886630047511,2097152 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,17922975124213476575,12262501223028305080,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,4093627770757712285,8706570450083926657,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,2132320427135625071,10301414625216963016,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5704,i,14063234651362028267,4530240757280367683,262144 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,14802324536249172656,2101553510071743182,524288 --field-trial-handle=1916,i,3726365922708006707,15514630665282750622,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
  2⤵
  PID:956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2460

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1e4195c015d004aadb310a10859b5bb94ee96ab9b0e71487c793a2bb9b119c19
MD5 c454b92d5720e1ae0f08b9b0aa0b2f4b
SHA1 2073299a7ab02232d7384fdb20952b5e90db2d9e
SHA512 e5f5d3df6f79b6fd97756e714aab840ea15570a9eaee4a7fc5c4753be33b8b5407ff49cca8b99d1ad9220b3d5f611efd2e1fdaadb531192bd174917b72448311
TLSH
T1C9416AF7C7D8997D894556F8E7157E2BCD2D0A18422C3D26C8D4AE1B57E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f24aaddb1391864862f76e42a5f933d524fa0a9d0b47b3890f748a9f16d58b44
MD5 a7ee0eb6996e645595f1637799d389e1
SHA1 814927bff671085f43764b84823a97d0b07930fa
SHA512 2d1366431e9c1946615179e5c69c176b0d7161784d33f75e44a9593c1c4dc4903a89bfc3a39a2ceae14436ac717a24f5b3d31516db00839f2f3f9e74ff56afd4
TLSH
T170419BF7C3D8893D894556F8E7157E2BCD2D0E18422C3D26C8D4AE1B57E2872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 694aeb618b02fea8f97347adaecc9feb92f106ccafdb2b5aaee502c767324f2b
MD5 bf9233d32a6adac11a58bb32dc260904
SHA1 e7b37d091707a41bdfeadd9b3259afb0612f48fe
SHA512 c06eed9cd67067a6a86be886accbda6327a31c1b011627f62c135d67df669d923e58f74c0e658c095231e76bf4959d71faefd122f6829ac7557600161e9edb49
TLSH
T14F417BF7C3D4993D894056F8E7156E1BCD2D0A18422C3D26C8D4AE1B97E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 6f5ff6034f0a548b0cd56f0ea474397c32802439207631dd23035f3992bf59e8
MD5 a7888e5f0da019986aba317b375d181a
SHA1 b36700ecc05e0ad7dea48d9756e295dcf7028731
SHA512 ea2a812aec05b98b556d0d24fd4958f00a862e14f6eacf36de49064b61d4e4b01ce202781a1ce24263d9a1f1309692a77498f6a92d455fcef373d417a4ad784a
TLSH
T165F059A7A6AAB463507A46AE4E04BC06A875E83A154069F4CF9B836CE0865E71B02493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 07e0ea1667a97b28638ce35f8b5e1706e7bcb61d968b2a27848e22f02025397b
MD5 29eee0f7287a5f8df8a923b662202caf
SHA1 707909a5a24211895f5992d7c4e3b3496401cad4
SHA512 cef8e445b737604766a958c8124c233e0989914f6a38673d23cd1328e021b4eb39739cb6b2f6cf2df7a720cff8f3d7fffff335b69aa6908a2c247429421ad8dd
SSDEEP 192:5BRo2aCcKv7QvAPRp2WI9XxHsb+WNnVWPnh2XeQlVyIsnAUge:5BRo2kG86XAfwAPh23e
TLSH
T1D932872EBE10693B6DCBC22EF9657793D7F6102271D42E44E6F88A6C15EB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91ccf32d9e3b95f0b3547b7219dc7e9fbc38c3e3b8ae711c9c103e8a5736b5ba
MD5 ca4e2f27ef4d8ac32177f53f4de4af90
SHA1 339f10722090154b3dc9f3cccf0b7ee62b58476c
SHA512 32c40ebb51562119e4847e173284b24bcf70997273458cc0683592aa28388437006a684b634dbda2cd8e2c2b9d39faa63a04e50c888e58c6fb83a1bdb96f26fa
SSDEEP 192:5BRo2aCcKv7QvcPRpmWI9XxHsb+WNnVWP+h2XeQ4UVyIsnAUgE:5BRo2kG8WXwfwAPi2MQE
TLSH
T11942962EBE10693B6DCBC62DF9657B93E7F5102261D02E44E6FC8A2C15EB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 df2b2a64f8469b0cce743b1d3d381de17ce1326fd17ab543ea6be50a926d7151
MD5 d06c64759d2f8f4edcb63153e72e39a4
SHA1 a66834fbe7924cd6b8399a32f86af3998e38c9b4
SHA512 177e72cf789adcb9616d6c9409218a8b4df5417070c00a3ae2ce58be0b0ea2852480b573da17f4765d79c9d23935f43ff4780a737900c3c4540bcf520d4c5fe0
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934oMDhCSl8h4otop5YicDXLB6BGyvn0Sbhlm+9T+RNCW:Rt0ITo+TQ0IgiU2yX1lPSbhlm+9T+uC1
TLSH
T14EC10975E02D4C7708B7A846B1132D47CDA8206BA965BF64FEE94F0D01E74DC5382A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 84c038e5f93d1c2b0cac002ebf2385db0b290dbd3ed3f12c66fba0e4bca16c36
MD5 0c9df8dca3a8760558a17394d271c029
SHA1 0c58f3f0d999cd1de027573c00cbdb8734a26edd
SHA512 c671c6315256f04e9588bb70fbe233fc368145672b713f91ca030dc32241fa01d0f8a4a11638826fd2b6da771df903007376e0eb92aaa9af2943b727c41cc2ec
SSDEEP 96:RC0d+r2io+TJ/E0f6m934oMDhCSl8h4otop5YicDXLB6BGyvn0SvQxwzQ//HShjy:RC0ITo+TQ0IgiU2yX1lPSIx7yhjm+9Tm
TLSH
T1BEC12B36A46C4C7715A7A546F0132A57CDB4206BDA51AF74EADA0F0D01E70EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 320a601b782f375ab998c3ca56429a2fbd45cbad1eaf6fb9e2f1f3c7f4d75e15
MD5 37ec38523431881cafbdae87fcefe6f6
SHA1 00ad6cf83e47f1c7659c28e5e4155e52d647a9e8
SHA512 1a94870bd7a7d79f01411859c5d33bdc126f81ca7d0a5911e098aa10c67d3bef06d7e7ee2512dde1e485fcbb940fa931bd0033885d3ab459bc61ec6cc336711a
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934oMDhCSl8h4otop5YicDXLB6BGyvn0SvQxwzQ//HShm:Rt0ITo+TQ0IgiU2yX1lPSIx7yhjm+9Tm
TLSH
T117C13B36B46C4C7705A7E546F0133A57CDB4206BDA51AF70EAEA0F0D01EB0EC2382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 075ccb0ec5d55d5939a67875a30bd4fc267a74448ef38800484816ecb49041cb
MD5 4f65a59b86609b9e54d48ef343ed774c
SHA1 319e371b38509f636dd86823bc9cc137dfce2a09
SHA512 7d3d3f3e8cbcde1e48ff40c7b69b1aa545c1711cc2cb794969bd1553018844c27acaaff180f0d9889124784fcc29d8e34f0e468618e40f5e9715228cf4fb24f4
SSDEEP 96:RbJod+r2io+TJ/E0f6m934oMDhCSl8h4otop5YicDXLB6BGyvn0Sbhlm+9T+RNCW:RtoITo+TQ0IgiU2yX1lPSbhlm+9T+uC1
TLSH
T161C1F775E02D4C7B48B7A846B1132947CDA8206BA955BF68FEE90F0D01E74DC1382A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8d3240014dcc4eb478cd85a85d8364230581b956ae6988705ad30a4006722a22
MD5 4b1cb71d79642630ac619422cc012b01
SHA1 fe64f9a9e42f30508abb514921b76c2cda6a4b08
SHA512 977e36d5c79a4d0d7208c7c295e0c4195f9ef1abc6baffa7c9507d34f252547eaadcc2c8558b8079de5c6874f221b61e920b1ed1704fa7358c10d47097f1f686
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5YmDXLB6nGyvn0b4T8TybJv4a:xC0ITo+TQ0InDUD3X1PPb4T8Tybl
TLSH
T108A10835A0284DB74477D446B1626A43CEB97067E972AF94EADD0F0D14F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download