4efb499ab8d7da85faab76d349cc567de38a25d9d380edc9ae8942a75fee4b2b

Analysis

max time kernel
300s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
donate-to-educate-and-help-us-build-a-school-of-hope.html
Size 1.7MB
Sample260806-xdeeqsgr5v
SHA256 4efb499ab8d7da85faab76d349cc567de38a25d9d380edc9ae8942a75fee4b2b
MD5 c7586443acc4d2eefda0915e7c2f8794
SHA1 54693a40223e9f45f0b628174508a413bcc46329
SHA512 09d7a2502fe35cade10de285a72827a636373fe3ba9cc2751b4ac0c31bc156e74594158ab30f1efe1391fd7dce41f737b3845d8f539e85102d5c3faf206e9bdd
SSDEEP 6144:dtFPrnRX2p5G1cxj9KLOO11cx+9K259KtGal1CtQqCNcda4M5StLf:xDW5sOOhYzq3a4MM
TLSH
T19985C79BE0E459736BCBC49FFE8B4837592C61DEA3CA581C0855CB3D53C86D81217AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3172	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305154804974114"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 5216	1188	chrome.exe	88
PID 1188 wrote to memory of 1960	1188	chrome.exe	90
PID 1188 wrote to memory of 3172	1188	chrome.exe	91
PID 1188 wrote to memory of 1960	1188	chrome.exe	90
PID 1188 wrote to memory of 1212	1188	chrome.exe	92
PID 1188 wrote to memory of 1212	1188	chrome.exe	92
PID 1188 wrote to memory of 2952	1188	chrome.exe	94
PID 1188 wrote to memory of 2952	1188	chrome.exe	94
PID 1188 wrote to memory of 2576	1188	chrome.exe	95
PID 1188 wrote to memory of 2576	1188	chrome.exe	95
PID 1188 wrote to memory of 1628	1188	chrome.exe	96
PID 1188 wrote to memory of 1628	1188	chrome.exe	96
PID 1188 wrote to memory of 2168	1188	chrome.exe	97
PID 1188 wrote to memory of 3756	1188	chrome.exe	100
PID 1188 wrote to memory of 3196	1188	chrome.exe	101
PID 1188 wrote to memory of 3756	1188	chrome.exe	100
PID 1188 wrote to memory of 3196	1188	chrome.exe	101
PID 1188 wrote to memory of 716	1188	chrome.exe	104
PID 1188 wrote to memory of 200	1188	chrome.exe	105
PID 1188 wrote to memory of 4356	1188	chrome.exe	106
PID 1188 wrote to memory of 4904	1188	chrome.exe	107
PID 1188 wrote to memory of 1616	1188	chrome.exe	108
PID 1188 wrote to memory of 716	1188	chrome.exe	104
PID 1188 wrote to memory of 1616	1188	chrome.exe	108
PID 1188 wrote to memory of 1600	1188	chrome.exe	109
PID 1188 wrote to memory of 1600	1188	chrome.exe	109
PID 1188 wrote to memory of 3564	1188	chrome.exe	110
PID 1188 wrote to memory of 3564	1188	chrome.exe	110
PID 1188 wrote to memory of 928	1188	chrome.exe	111
PID 1188 wrote to memory of 3456	1188	chrome.exe	112
PID 1188 wrote to memory of 928	1188	chrome.exe	111
PID 1188 wrote to memory of 3456	1188	chrome.exe	112
PID 1188 wrote to memory of 3916	1188	chrome.exe	113
PID 1188 wrote to memory of 1968	1188	chrome.exe	114
PID 1188 wrote to memory of 1968	1188	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\donate-to-educate-and-help-us-build-a-school-of-hope.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbe72bc728,0x7ffbe72bc734,0x7ffbe72bc740
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,8846296009258135177,3049745861163109403,262144 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,13594145180454576276,13027149967988820254,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,6538487711614196142,6368213547285375471,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,10175481416258000101,1763208966195631644,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,887959546689275031,4155601479177092689,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5000,i,10609358761198676240,5571921312222797552,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1621376674417945960,10750468121480569815,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5756,i,7693847879406131713,5711894269000917068,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5768,i,7256505322997165510,16466057531099681370,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6084,i,2350283948981196295,6162524245565039281,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,2401611006756223105,15870929897229956326,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,11075387934933075197,7296458916498620448,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,11308168759347291138,18031546886020098054,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4756,i,485648421110757320,10847214898530600062,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5744,i,10929552938657792387,11914371500350353511,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,10398826251806635878,17401777959920132371,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4676,i,9329884650874482302,5781158438065531773,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5644,i,2626786901590048902,1432262564654604966,2097152 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6064,i,10462486481312860,9798274005883974622,262144 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,9179683227483817709,13294446803328658893,524288 --field-trial-handle=2016,i,8756363192615487653,1869955469264461074,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
  2⤵
  PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6940ad36e7d4b50535351977fa94340f9538d8e1a35c81ced8cd4860ddae25a6
MD5 ce836674bb7b40c4ecbb18d20002bd87
SHA1 c7d761ead9a71f9de98751d7d457813876c0e103
SHA512 0dacb5ddc857c275d0bf8c601f2ce7acbab45296ffcc260a0e47ab6ff7776085e0178ff186180c7439e9ea66bc6e8685bb98300bd7dd1a4ac2a8fd342e6e65ee
SSDEEP 192:DpDTiqD0gJ5dZDss5OkAzCKZOcRpqNIp3I1fuqTK:DpDTiK0gJ5dZDss5OkaCKZOcRINIBI1u
TLSH
T113D19BFBC3E4477E891152F49B256E1ACD2D051A432C3C5689F4AE1F63F29B1E24129F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e15d14c5fdbe96186220411a7a68b44ba42324d820f4cdb0ac19a740937204d7
MD5 2914dff8802bd52b45e5c6bbcfd9c110
SHA1 b1bdbacee972fb4a7db3234d1a0fea7b21e0a7bb
SHA512 9c8c6739cf32b6f1192832f279b53e92127a4924189ec885ce6f44e3a071ce939b26d6fbb5a56c4bf2d2a5a9752347993419e4b794f2653504ba6ca44774c571
SSDEEP 192:dRN1b42kv7DvAPRp2rH964Hsb+WNnqoP2ueI2hMAVyIsnAUgR:dRNd5AH6X8bwlPr2hMER
TLSH
T19E32953EBA64697B6CCBD219F9217F43E7F5102225942E84F6FC992C14E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b4c785403f3b8fc8ce1b02e6a448e3ddc63fb678b5a0d7792db54f9ea2828ff6
MD5 3892cdaaa10e591fcb4b100b96366e3d
SHA1 a73d2f08d84535c69cad5bd7dcfe2f171e40c406
SHA512 4901877aaeb33d998808f0dd666a9fe3b72b78438711947224eca0900cb727d4ae671440773cbcd96d98d6bdc7582b3d8dea6f2693dbc752747cccbc6dba1dc2
SSDEEP 192:dRN1b42kv7DvaPRpMrH964Hsb+WNnqoPaueI2hXAVyIsnAUgE:dRNd5AH0XKbwlPX2hXEE
TLSH
T10A42A57EBA2069BB6CCAD219F9117F53D7F5102225942E84F7FC992C15E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4af823e3b454607d7c5f70f3bfe1f382347442ee3dcf5d93265662f1a3ef6743
MD5 77123148f3039c06dd3d03eb000b850f
SHA1 96bb7049872c44e33e9d9f82532efe853e49d886
SHA512 94421c3df7a32b6c5a347bb82c6d083b155c20c3d33e41aef240e66ad540a445abdcb25d0d85d92f550ee2e1a689571c7b960ce34bc05c0512d9678b4e847d25
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7pclESl8h4otop508pDAB6hGyv9JtFiO0AuSwrSDhbn0f:Ct0LA/TE57CIiU20mkh+tFGSwrSDhbnm
TLSH
T10AC13AB4B86D2DB35DFA9950F5427A43CDB4A05BAD226E90CAED4F1C01D79DC2383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d094b6a71dd69f0c8e1a3a9aae6e4e54de8e9e25d416726e8793bb0f20ba8f18
MD5 cda0d08b7cd4644e2b2c9baf7325ea2d
SHA1 a7a2036111448417d37ef95ba573e493786c286c
SHA512 6c8008d35927796040cce2c98084f39542ad18d6f390a21aaeb28cd4e75dae533a4a86338b687643029975e3d68ba8cf9a3fa9275afed83cbd7d0b1eed3809ec
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7pclESl8h4otop508pDAB6hGyv9JxQDh4RNC39ISyVNCd:Ct0LA/TE57CIiU20mkh+xQDh4uCMJL
TLSH
T13EC1F7B4A46D6DA74CFAA891F1033D83CDA8A06B6D253E54A9ED5F1C00D39DC1383927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 110fc5a009920ee7d32bbb57aaf9400b80951d652631522d1c6a130c18fdbebb
MD5 81ff251ed294a97b093816fd1ab3d0c5
SHA1 1cf9b0f779e4deef1690e9dc5a2323ac89b1d5ec
SHA512 624fa35347802adcaf8e8aab5f5dfa70d1475e9635b7d215d2fd703819eb135a39be413e7a48a128192aa44627c5e219dd7a56c0765a7ad8bf3691b5f405d92f
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok508CDAB6/dGyv95Shhbb2Jv4a:gC0LA/TE57cDUD0XkUweShhbKl
TLSH
T15BA11975B4685EF75DBAC584F4827E83DF68A123A9216F80D8DD1F0C10E75EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e0966fc812d7ac2bf7851ec1e83c6fdcc688c9c17d32268c315d4fa6afa93e0f
MD5 144ab56c7162906c65d404bd83a2c555
SHA1 6c12a8e9f121e0e6bcd43b188c14f54e9fec88b5
SHA512 390710d4f90205ecfa7c981f81aa500defac1a8ab25f852b2f235d72c76f89e5e1f39fb53d1d16f8417f4127fad46a1dd0c4c40aedf2b3d9edc774ce173e8f86
SSDEEP 96:gC0d+cAOIt5aDVmufj7pclESl8h4otop508pDAB6hGyv9JtFiO0AuSwutDhbn0jb:gC0LA/TE57CIiU20mkh+tFGSwutDhbnm
TLSH
T166C12AB4B86D2DB35DFA9950F5827A43CDB4A057AD216E90CAED4B1C01D79DC2383613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3033a4d2cb6aff330dd4322300e98199f1cf393b4bf14cb6c947c9fd1a4355fe
MD5 a6424904a63303e56ad06a22ddb07515
SHA1 e6fca0ca051a3a54ae2eb04d6fee8fba7cd5491d
SHA512 3fdf9f1de97958ad8c62a52a63eff0b03e1db2c9a3d66d39864515ca113dbeac0fe1f4d8edf81577ee8e9c85c6f16f33417d6355b48142dea20bd06be3faddb3
SSDEEP 96:CbJod+cAOIt5aDVmufj7pclESl8h4otop508pDAB6hGyv9JxQDh4RNC39ISyVNCd:CtoLA/TE57CIiU20mkh+xQDh4uCMJL
TLSH
T17DC1F7B4A46D6DB74CFAA895F1433D838DA8A06BAD153E54ADED1F1C00D39DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download