4795a3ff86a3699d60e160d0fee2bc80b2f6616222296bcb2e1389be09342c4d

Analysis

user interaction
yes
max time kernel
449s
max time network
446s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 6KB
Sample260802-31lp8atgrg
SHA256 4795a3ff86a3699d60e160d0fee2bc80b2f6616222296bcb2e1389be09342c4d
MD5 59a36c63031765819dbb8872889296c0
SHA1 e816ef137ee1d89f4d3ac5d7f09a443ac627abc6
SHA512 d825458cfaf2942a2e03f29daa67de0347d2ff6b6ed5d7010549feb43de7ce599b8053617a32b00bae4188f38c5fd75f4971d33e5ac77f43ce4ee949b67b766a
SSDEEP 192:fvSYGOJGv65Z2qfk8nM1b9Hwjsca8V/bsu:fvSPvo2qIkjVDsu
TLSH
T199E1B8222892C02F6523CC4AB3E5E76C9B42F0378421CDE4F19C1622CF81FE94BD27A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301887515305552"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
6640	chrome.exe
6640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1388	2604	chrome.exe	90
PID 2604 wrote to memory of 416	2604	chrome.exe	92
PID 2604 wrote to memory of 5056	2604	chrome.exe	93
PID 2604 wrote to memory of 416	2604	chrome.exe	92
PID 2604 wrote to memory of 3160	2604	chrome.exe	95
PID 2604 wrote to memory of 3160	2604	chrome.exe	95
PID 2604 wrote to memory of 6792	2604	chrome.exe	96
PID 2604 wrote to memory of 3420	2604	chrome.exe	97
PID 2604 wrote to memory of 6792	2604	chrome.exe	96
PID 2604 wrote to memory of 3420	2604	chrome.exe	97
PID 2604 wrote to memory of 2128	2604	chrome.exe	98
PID 2604 wrote to memory of 4524	2604	chrome.exe	100
PID 2604 wrote to memory of 1692	2604	chrome.exe	101
PID 2604 wrote to memory of 4524	2604	chrome.exe	100
PID 2604 wrote to memory of 1692	2604	chrome.exe	101
PID 2604 wrote to memory of 1788	2604	chrome.exe	104
PID 2604 wrote to memory of 2560	2604	chrome.exe	105
PID 2604 wrote to memory of 1788	2604	chrome.exe	104
PID 2604 wrote to memory of 2560	2604	chrome.exe	105
PID 2604 wrote to memory of 4904	2604	chrome.exe	106
PID 2604 wrote to memory of 6804	2604	chrome.exe	107
PID 2604 wrote to memory of 4904	2604	chrome.exe	106
PID 2604 wrote to memory of 6804	2604	chrome.exe	107
PID 2604 wrote to memory of 4932	2604	chrome.exe	108
PID 2604 wrote to memory of 6612	2604	chrome.exe	109
PID 2604 wrote to memory of 4932	2604	chrome.exe	108
PID 2604 wrote to memory of 6612	2604	chrome.exe	109
PID 2604 wrote to memory of 6124	2604	chrome.exe	111
PID 2604 wrote to memory of 3044	2604	chrome.exe	112
PID 2604 wrote to memory of 6712	2604	chrome.exe	113
PID 2604 wrote to memory of 6640	2604	chrome.exe	114
PID 2604 wrote to memory of 1004	2604	chrome.exe	115
PID 2604 wrote to memory of 1004	2604	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb0d6cc728,0x7ffb0d6cc734,0x7ffb0d6cc740
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,13738079780974404830,7296614825954603601,262144 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,15101146089791313522,3287835481338097379,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1776,i,8052286805519774411,13183694341361028405,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,13301064821735952087,14767447955871675324,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:6792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,7626620943449440933,15867318755628342053,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,15519847860910036477,12473918000509909339,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5528,i,4710936721534457684,14218800389218440586,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5540,i,7415769084454254393,11160318268192561376,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6020,i,1959108042360841414,3031195681889984006,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5836,i,5549325114051281012,4036874867610061331,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5444,i,13549836108066117926,8655271306272478158,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,6559851227232278021,13045297074794332272,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5344,i,193464117789779591,10119336926172977877,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5368,i,17187765812535677052,2795619404281205902,2097152 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,8101200649672227918,9235727036892427182,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5000,i,4956002682358219238,8868597825930710069,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,8369375081297779211,2135624238130331096,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:6712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6016,i,355912996621852976,16382297708360703310,262144 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,16173677153651919708,320013780812796515,524288 --field-trial-handle=1908,i,17578985089417369124,12540466573380611949,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 623956ab9ad4bd176ff6051909118b393c58f2e42b9ac2a644cbaa0669e19bbc
MD5 1540da68a643226d7259eeef9e71070f
SHA1 d78b81169aa3a0f2f7e90b95cc902fdf4dd26b8d
SHA512 e00d6c6da77a79b3873521a43e24838b8e975d24ab6a370f2458689a340cd1d2a607b48071b0c9732ce077ca3c3412f92e0b99f10fd9cc8b9099c475711ce232
TLSH
T169317CF7C7D8857D891516F4AB157F1BCE2A0A18532C3C66C8D8AE1B97E2871E10065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9fbde6f06e8b561b24cc6c8b42997ec106ab3185d9c94de721883ddb8fe63ccd
MD5 f4bcc0634078a915f9b9ecce2821ee68
SHA1 fe2821e3aeabb88deab180523ac84dd74a531f07
SHA512 3b52895ebe57ece798cc6bf21e88e6166644fef3a27e5a957553cf43f1e85c1cba26b1b17c1a47f0b9a66fdf5b81e2a20f453b9eb3cea242a8ba015428739dc3
SSDEEP 192:+Rk5RL5v7FTvAPRp2CD9CHsb+WNn+9PtB21JEkwylVyIsnAUge:+Rk5VZ5T6X/kwsPD2USTe
TLSH
T12832932EBE64687B9ECAC22DF9657B53E7F5202171D42E84E7F8892C14E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e0dd17492cb1390fbf077ec4315735b6ee88bb1579ca1c06a72686dbaa7f366f
MD5 7b662c97fdef072dd1516fe24fa93901
SHA1 4d571577785e1efbb76bca1eaf1f7d4b20fc06c2
SHA512 1f4e1a50fb5aaf89302007d2d87abb28543e27c85426306d1830cf58453764f83062055a315da72ed9e49bbaade3d6b9118caaedfcc25f63a868c5f472fdbd75
SSDEEP 192:+Rk5RL5v7FTvBPRpJCD9CHsb+WNn+9PvB21JEkwBlVyIsnAUgE:+Rk5VZ5ThXWkwsPZ2UhTE
TLSH
T18142946EBD20687BADCAC62DF9657B53E7F5202121E42E44E7FC8A2C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e376c7f6-3827-41a4-b788-6f94f08de70b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e376c7f6-3827-41a4-b788-6f94f08de70b.tmp
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8624f99cac321b25060d7f65b25fb80d07cd2809f26f8944d31b37b71eed0be0
MD5 fb35fe86f8c959420cdca515a226bfa8
SHA1 78ead6d755ce63a9f94026fbeadfb44fc53ebd6e
SHA512 2b27729cbeb6fd240f9abf36fd0743adffd09e05ab118a5f3200dacc4a0415da1b3108da4f152bcb75e52e9cc07a0c1390ea7e02d20dd9c988600abeab78c4b0
SSDEEP 96:MWbJ0d+CNkx/Fc5vBh2F8vIfjnNA8rPSl8h4otop5oBDpB6fGyv1f+bGIWwRNC33:MWt01N2c6AQiU2cvvw4GIWwuCoX
TLSH
T171C1E871986DAC774DF2E54971032E43CEB8612BB951BE68FAD95E0C01E78EC1382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 db51c8f3c71f64296514f3e5b15295050e46fb0bc68405553c787aaaaf2bab7a
MD5 ca611b463cac7a8d1f4490693a5564c3
SHA1 7346f906149159cdd99ec78f8d80f6228916af7e
SHA512 b000c014fa3d84d2205fbcc3335024f0666cb534dd7c05502142029c8ccbec5126fb39630514485fc78711592d39443f64d7270ef63dcd74a2dd702e7bd99eba
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5oVDpB6xGyv1T5WqbKv4a:MkC01N2c6AGDDUD0v1U5WqbU
TLSH
T1D9A10832586D9C7788B2C549B5922E03DEB8612BF922AF94E6ED5A0C11F74FC2381517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fa3cea52346893b5a3afff141be48dd708132d124d992cd69c6cbe3f42d4a1a9
MD5 b52dae65ddbca671f37ae22411809b65
SHA1 9d621ba4de344668d5d899ac672fac4eaa14dbb9
SHA512 c59dcc30cb7d0790c80c66684ad65e3f3eef06a08fb5011dcaa0c7c459aed21fbb26ef4ccf11ac5e2b4857a11703c875727906c33a143267f921708a3f201a3e
SSDEEP 96:MWC0d+CNkx/Fc5vBh2F8vIfjnNA8rPSl8h4otop5oBDpB6fGyv1fQBFv1QzboXbe:MWC01N2c6AQiU2cvvwQBF+ywIWoU5b
TLSH
T164C11976686DEC734DF3D529B1432A43CEB4613BA611AFA4EBD95B1C01EB4E81383412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 51b5b48afca878a6414d190d27b7e8da8b7920629919deedff137b3952e8648f
MD5 bc858291ff0912bd9503828579701d15
SHA1 79dedcf0edc91f535d271b52f7a8d7c7f0ec9c1e
SHA512 8d150ee1b4393276865a49bc3e91baa6b9d766f76d96b23a64f83c6c6d2822176bcd78a3fff7712d36012ab37383b01e4df8c57f8324e13dedb102cd6ccdfd40
SSDEEP 96:MWbJ0d+CNkx/Fc5vBh2F8vIfjnNA8rPSl8h4otop5oBDpB6fGyv1fQBFv1QzboXi:MWt01N2c6AQiU2cvvwQBF+ywIWoU5b
TLSH
T17EC12976686DEC7348F3D569B1032A03CEB4613BA611AF60EBD95B1C01EB4EC1383522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 983e36f45bade543a07b355563f96619682dc8fe0af65d3bb3e3e239e6e2a695
MD5 8c428bfaad9822021d574ea313b8d274
SHA1 80ff5c1c614842b412021fa350ab605694fc784f
SHA512 96b62d55e636898a6083314806ae529382dbf3874264ed74c52f643ff360df60f96acf4d504333930cf16f50baa0d113a2937acda321d70ef138bce19dbb6336
SSDEEP 96:MWbJod+CNkx/Fc5vBh2F8vIfjnNA8rPSl8h4otop5oBDpB6fGyv1f+bGIWwRNC33:MWto1N2c6AQiU2cvvw4GIWwuCoX
TLSH
T1EAC1F871982D9C774DF2E55971432D43CAB8612BB9117E68FEE96E0C01E74EC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download