93d2f1fb8326d6a6ecd48fe756c0625164f9904195a02131acf6081830832e3a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Findurlovely.html
Size 27KB
Sample260806-tmlzdser6v
SHA256 93d2f1fb8326d6a6ecd48fe756c0625164f9904195a02131acf6081830832e3a
MD5 c02ffaea038211c334bab02823a4d1a0
SHA1 002ec3164d4d224618780c9860804534c75d3818
SHA512 1d4405204b8cd3f923f3282416865201771cb1199ce116c3163bbf9dc7886344bd80aee515cf178821099b38fea7cf600d0eebba4959d3f533cb70f45357543a
SSDEEP 192:rs0VP3RRIER+C59OMMdUjY+6EdUzdcpOzplB8yIiu+inwM2Lg1fcgBfhFWYaHn+:o0VLH+eO3Kb6JdcpIlayIiu/VrBa+
TLSH
T1C7C2D65899F225FA105F407AABB7721C6B146207CA0BC90D3ABCC2B41F46D568CA73FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2584	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305062445522889"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
2916	chrome.exe
2916	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe
Token: SeShutdownPrivilege	5900	chrome.exe
Token: SeCreatePagefilePrivilege	5900	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 4920	5900	chrome.exe	88
PID 5900 wrote to memory of 2968	5900	chrome.exe	90
PID 5900 wrote to memory of 2968	5900	chrome.exe	90
PID 5900 wrote to memory of 2584	5900	chrome.exe	91
PID 5900 wrote to memory of 3368	5900	chrome.exe	92
PID 5900 wrote to memory of 3368	5900	chrome.exe	92
PID 5900 wrote to memory of 4888	5900	chrome.exe	94
PID 5900 wrote to memory of 4888	5900	chrome.exe	94
PID 5900 wrote to memory of 6140	5900	chrome.exe	95
PID 5900 wrote to memory of 6140	5900	chrome.exe	95
PID 5900 wrote to memory of 4900	5900	chrome.exe	96
PID 5900 wrote to memory of 4760	5900	chrome.exe	97
PID 5900 wrote to memory of 4760	5900	chrome.exe	97
PID 5900 wrote to memory of 1496	5900	chrome.exe	98
PID 5900 wrote to memory of 1496	5900	chrome.exe	98
PID 5900 wrote to memory of 4408	5900	chrome.exe	102
PID 5900 wrote to memory of 4408	5900	chrome.exe	102
PID 5900 wrote to memory of 948	5900	chrome.exe	103
PID 5900 wrote to memory of 948	5900	chrome.exe	103
PID 5900 wrote to memory of 3656	5900	chrome.exe	104
PID 5900 wrote to memory of 4076	5900	chrome.exe	105
PID 5900 wrote to memory of 3656	5900	chrome.exe	104
PID 5900 wrote to memory of 4076	5900	chrome.exe	105
PID 5900 wrote to memory of 2732	5900	chrome.exe	107
PID 5900 wrote to memory of 5504	5900	chrome.exe	106
PID 5900 wrote to memory of 2732	5900	chrome.exe	107
PID 5900 wrote to memory of 5504	5900	chrome.exe	106
PID 5900 wrote to memory of 3684	5900	chrome.exe	109
PID 5900 wrote to memory of 5944	5900	chrome.exe	110
PID 5900 wrote to memory of 5076	5900	chrome.exe	111
PID 5900 wrote to memory of 2916	5900	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Findurlovely.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc6be3c728,0x7ffc6be3c734,0x7ffc6be3c740
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,1076648898276618319,2504040013170211570,262144 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,8289056315965950436,11891164476114259044,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,10709338180036297020,5479614063550420003,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:13
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,3402425219924926096,18061065474595523177,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,6314471753173892839,4381734575778840212,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,15941432849479265735,10554758696995899929,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5272,i,9311844264690231198,13396513258476870496,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5284,i,4440718891740142335,10110796521116343116,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5388,i,14121298849495304927,3047075141363134985,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5796,i,13796374409323659812,17639475656142467338,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5788,i,8923757840472181434,14914329020496925365,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5852,i,2778765555603198818,6313318438709997092,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5920,i,14160771088617822591,18372830543412541793,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5196,i,18194585957677728661,7854987186810549698,2097152 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,2994729918178442700,7772189019096300792,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,6221677579833994982,1662775619458863444,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,7730272933007496133,10210539472753061951,524288 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,16954069816855092204,12303252419798151722,262144 --field-trial-handle=1928,i,8727439434020990981,17919174504278437069,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4107711c694482fad2f44fd921d69f67a57ef8db89033ff3403d67f03042cf8e
MD5 3512a18511f5ac68a73c29e6ff74e4a0
SHA1 6b70489fe15a60aeed1011eba610e7df873b237d
SHA512 75a3dbf733585071d1aa3a09ad28e0dc0afe9a521b3c1ce30ec85247fd3d1ca7cb7735208ad16a8ed30cfa1850fc006c846e6f181f382db13457f799615d4f08
TLSH
T175518DF7C3D89A3D890152F4EB156E1BCE290918432C3D26C8E4AE5F67E1875D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 866813f0dada4b81d72968518a777b6ced71b22c6fd47be4425afd7bb4b74408
MD5 3f333034e2eb6c05f15ba4cf1a6aa40d
SHA1 7e8b1f15e38a95d242d174be319b1c82e2cba4b7
SHA512 30cfcef2714d3cc118173fb20fc4c458bd6a542d88f2285994b2e320d37ae20f1e08d3e0e8fedfdbf5f107d482c29d68ea6946360fe89ed27a6d05a138c6d86e
SSDEEP 192:5BRq4a+08v7QvAPRp2W69XxHsb+WNnpiPdciex22SnVyIsnAUge:5BRq4p0o86XSfwEPdw22Ae
TLSH
T19D42C72DBE10693B6DDBC229FA657B93D7F6102121D42E84F6FC9A2C15EB5CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b50aee7b007c047ad5526c97529b7fe2477a5d1d73809b16a08b22bdca445521
MD5 b597112a181f4afc3beb89579a262ffa
SHA1 6d026a49f8dea572dca0b29378ee7d11b3b6683e
SHA512 1bc11eedb0e8dcdf422cd8d8399bba93ab8f83e81c61c1ccf24e01bf2a0f904db2fe9463beb7dcab9ed414065235461ee9f8d83020ca659cff542b7a44b926a6
SSDEEP 192:5BRq4a+08v7QvDPRpLW69XxHsb+WNnpiPjiex22TnVyIsnAUgE:5BRq4p0o8zXpfwEPl229E
TLSH
T17342D72EBA10693B6DCBC629FA657B93D7F2102121D02E44F6FC9A2C15EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2c512bb7b875ee9324b3cdf0edf92d67df5de5a763ae27d8364fd9b08a3c180a
MD5 af5ea8c4cb5484ecea2ab0ce3daed4d1
SHA1 ba22c017488e054127fa1c28a382187223a7dc8b
SHA512 80b17dac2abb7bda8a6ce17f46b923dcc35c7ebb3e56469f0563fdcf77958d3fff1502a8801ae2db54ddc37f8dca7db057a9a94962c3a859badafd72b5c05527
SSDEEP 96:RC0d+r2io+TJ/E0f6m934dM3Sl8h4otop5hicDXB621ddGyvn0SvQxwzQVEhjm+J:RC0ITo+TQ0IUiU2LRNdwPSIxmhjm+9uW
TLSH
T1C8C13B75E46C6C7705B7E442F1232A47CEB8606BDA51AF70EAD90F1D01E74EC2382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 2eaefb7b04c23abcab24ea2311c432a055281ccdb483bd100cf86829c41760dd
MD5 b3b2b6aede76cd51b405bef46b97c3e4
SHA1 73cce3408212a43efc00d1b00e4f5692867cfd17
SHA512 3064d8d65d2cadb3bc510b84ee7f6d47ee2367f307c8ce5568434824f6b5caeba25d66986b16ef84bddb52de6a18a59ed80a2ada6aea53045b39ab590d058138
SSDEEP 768:n98TNz4VTY9gJrvoxlalu/mBPDfNPZSMqHgd7l+z9wSMwyT2bnufIvstlRj+9jfD:98yVTYKFmGDftZ5qHXSShyiaJtlRj2j7
TLSH
T13D13F182971C0EAB0879F040F6061483CAEDB5EF6C557B109BEE364C119B4EA871B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 aff4328fc01d93cbdc65cb67517f5d77873682d27cac38ef33fd4382a6418096
MD5 3a9a0e998fa68624984acdbfdafbd37e
SHA1 0ba89b03c4f1dd6cfc4d5b8c59f2379156a986e5
SHA512 94520d4268399814f130b32161856aa20655f8d6aa5cdf49387b3350faa20a72a580d90c55dfceb8d209e895510eb19ec0e352c5d087d2cd8c2732085d5ebe52
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5hmDXB6nGyvn0b4T8uybJv4a:xC0ITo+TQ0InDUDKRPPb4T8uybl
TLSH
T18BA10875E0285DB74476D44AB1622A43CFB9B067E9B2AFA0EAD90E0D15F74EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c1d4f2c39de7d37de12c8f6478328685b3da92d2a239be8e5e7285fa7f11a2af
MD5 039d7cb92ec291e41404f5e1563f0682
SHA1 8b6f6187655571c0ac3e6cd1d8204eae42667684
SHA512 7003661cc9bc5ec480388f515e406bd6617710370860a112574154a719235b42e47c700ce83b453aa69fd2f07632345ff06cc083ec56a00ebc876a2b349c9e73
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934dM3Sl8h4otop5hicDXB621ddGyvn0SvQxwzQVEhjm0:Rt0ITo+TQ0IUiU2LRNdwPSIxmhjm+9uW
TLSH
T101C13B75A46C6C7745B7E442F1233A47CEB4606BDA51AF70EAE90F1D01E74EC2381627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download