0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7

Analysis

max time kernel
149s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/public/index.html
Size 383B
Sample260808-jl68tscd68
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1340	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306494406914453"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
2584	chrome.exe
2584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2492	4228	chrome.exe	90
PID 4228 wrote to memory of 3524	4228	chrome.exe	91
PID 4228 wrote to memory of 3524	4228	chrome.exe	91
PID 4228 wrote to memory of 1340	4228	chrome.exe	92
PID 4228 wrote to memory of 2576	4228	chrome.exe	93
PID 4228 wrote to memory of 2576	4228	chrome.exe	93
PID 4228 wrote to memory of 1600	4228	chrome.exe	95
PID 4228 wrote to memory of 2984	4228	chrome.exe	96
PID 4228 wrote to memory of 1600	4228	chrome.exe	95
PID 4228 wrote to memory of 2984	4228	chrome.exe	96
PID 4228 wrote to memory of 756	4228	chrome.exe	97
PID 4228 wrote to memory of 3560	4228	chrome.exe	98
PID 4228 wrote to memory of 3560	4228	chrome.exe	98
PID 4228 wrote to memory of 5916	4228	chrome.exe	99
PID 4228 wrote to memory of 5916	4228	chrome.exe	99
PID 4228 wrote to memory of 1900	4228	chrome.exe	101
PID 4228 wrote to memory of 1900	4228	chrome.exe	101
PID 4228 wrote to memory of 5552	4228	chrome.exe	102
PID 4228 wrote to memory of 5552	4228	chrome.exe	102
PID 4228 wrote to memory of 3612	4228	chrome.exe	104
PID 4228 wrote to memory of 3612	4228	chrome.exe	104
PID 4228 wrote to memory of 3496	4228	chrome.exe	105
PID 4228 wrote to memory of 3496	4228	chrome.exe	105
PID 4228 wrote to memory of 1324	4228	chrome.exe	106
PID 4228 wrote to memory of 1324	4228	chrome.exe	106
PID 4228 wrote to memory of 2748	4228	chrome.exe	107
PID 4228 wrote to memory of 2748	4228	chrome.exe	107
PID 4228 wrote to memory of 3860	4228	chrome.exe	109
PID 4228 wrote to memory of 3204	4228	chrome.exe	110
PID 4228 wrote to memory of 5036	4228	chrome.exe	111
PID 4228 wrote to memory of 2584	4228	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffef7d2c728,0x7ffef7d2c734,0x7ffef7d2c740
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,14488057377863144870,12416769730158353633,262144 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,10805351676096252239,1259192938838741867,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,7994386827552915828,15664868336066673448,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,16123248742853045100,10966277031372351375,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,13513964046143363475,13876513568272256111,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,4783975811677339657,6285952848840414970,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5572,i,12851728358482488055,15961763196239697602,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,12905947764775013918,13493462564681992904,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6060,i,11293381147474978550,3637892996694446129,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6072,i,7225780140932150112,6194050412711374988,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6124,i,730076228264569353,15643763014130626552,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6420,i,1703831072235643834,9310413595754918958,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6584,i,1705526927282002337,10200425344341860006,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6708,i,5579504522520795421,18097966663864916953,2097152 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,7449648266083426368,16290832881606024198,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,6199863549838226115,7507370192877493168,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,1465432486459111805,8707056168069717632,524288 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6304,i,14101363451536188963,12507056658791101787,262144 --field-trial-handle=1912,i,16023761471204336222,14262495030526650578,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dc7fb3e7aa23bc90db8c95891b0f0e037f6d0f823f044585c557db5037f59a3b
MD5 28115079f2b9d1ae50812d7c1a9a3c77
SHA1 b893910e84627a63c05b81bc43b319786b9db25d
SHA512 893293b2b89a47a37f99802ded020dff6b0ecf1ba785379c0ca285c73f3bef83165c050508adadff0e9ca3fed098375d33a827ab44107e3d9b0fb261b0fa5d9f
TLSH
T1B0417BF7C7D8957E890552F4A7156F1BCE2A0A18432C3C26C8D4AE5BA7E2872D21068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ea2d0450651372599b2e624ad86586927924c8a68cd03a00608c21e2b0cf65d6
MD5 60b27a9b653edf130a80e9f7acd3c04e
SHA1 f0d30dca1f4dd85ef2477cb3ef52d857160d3bd3
SHA512 8fc1d52a986d2b40dc2be930faa860b0863c93ef23a5c2077db3e4cb88cb0eb10270a9ce921e87817aa99beddc03526cc8514d9b9c20bb1efa3f1a6fabada033
SSDEEP 192:7RgRfcpv7KvAPRp2+r9NLHsb+WNnW+P8X2reu88VyIsnAUge:7RgREpu6XD3wLPW2Xhe
TLSH
T10842962EBE51693B6EDAC229F9217B53DAF5102121D52E80E7FC992C19DB5CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1501557803fb92193fd863c261832baba093bcc3cc8c42b03e472442a0570555
MD5 d4d8db772365d24945d6568ee3156bc8
SHA1 f3b625143c5c390a577df197fd48b50d5da18d89
SHA512 ec802c4cca749d8984c653200f984ee13cb7312c06c953fea47f753bc87813568ab326f7898ac771fabd743ce8841e65f9c4a479cf6cc65d02cd780f820ff52d
SSDEEP 192:7RgRfcpv7KvhPRpV+r9NLHsb+WNnW+PzX2reu8BVyIsnAUgE:7RgREpuhXi3wLPr2XwE
TLSH
T1B242A72EBE5129376EDAC629F9117B53DBF5102221952E80E7FC992C19EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3c6846e3c0ab29ccee28db7ba850f7b475066f55d4c2e99b909a090955616d03
MD5 7467b8ea5e8d9f7a92a8cac079c0ee5a
SHA1 011953aa378ff28fb1076e69c9ec1de3f035b4ae
SHA512 b1fbf1b66a88a60e1a424b78b5833ec5387fe6213bb6284018d396679b42f0e4323c44b20570f33157e1bcfe044086c97551adb1f951233621269b6168d35b21
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYnCtESl8h4otop526D3B6fGyvUgyKfOIwRNC39ISyVNC:ht0qDHUgvIdnNiU2PxDsyKfhwuCzg
TLSH
T15EC10971E86D5C7B0EF2A856F0132D43CDB8206BA965BE68E9DA0E0C11E74DC1393663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 84df1d00a223c0c13bc744c450ccfb7dae110dad63686767ae69372b59bdbe72
MD5 53c59bea10bd51b43ef1a786f2f4fa24
SHA1 446bce50f82f7d4a6e2bfffce8a53e574fe6c393
SHA512 cf42a1d739e0a07cb7108008e5cc0d7801a564c2aae67ed4653f21a9779cf26a2b49cf186394ca807b50080c7e446a794ee5e2454a789db2b55a0d4f9ed3dd14
SSDEEP 96:hC0d+hDK+UyKovbfaNQYnCtESl8h4otop526D3B6fGyvUgIlG1QzbOQNEfOIk0j8:hC0qDHUgvIdnNiU2PxDsIlTLNEfhkU+
TLSH
T1E0C12975B8ACAD731AB29516F4132E43CDB5606B99617E60CACA0F0D22D70EC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4eff39f1d83593960fe546f72106ff5422ba600c6eb7e686c8b269719126a167
MD5 e2dbe4f7b8ae39831677b6dfbf73eedd
SHA1 355a59213e21ebdc3126045c695d01c34b4caa92
SHA512 c82dd73f648815b6a8a5bf65eedbf3c357be479afb03ea5b3d584bece058d0f871ce7e00e4d90c7e72cd2c1dbcdcaf078d4a20805c514e39ecb87c6ca931c2ba
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok52qD3B6WGyvUU+OIsbL/Mmv4a:BC0qDHUgvIdaDUDXxCI+hsbL/N
TLSH
T120A11A31B46D4D775A76D909F9652E43CEB46027E922BE44D9DE0E0C11F70EC1302623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1a5d139354086ce34f50532aec077f5646ad941b268202dd0dadd8702a317bbb
MD5 980f6b977b6c2bed82e33ff160d75597
SHA1 cd403ca883e5fe0c32ecdf411209a17b4635873e
SHA512 b923a53203f36ab30f906c57c91b8044a05bdbdac7723eb652b4c7912d5d9acf1a6237f7417f7d8e2d891c6192259a6f6761bb871ea3a4a7a6f8bcc3ffa05a41
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYnCtESl8h4otop526D3B6fGyvUgIlG1QzbOQNEfOIk0g:ht0qDHUgvIdnNiU2PxDsIlTLNEfhkU+
TLSH
T1A1C13975B8ACAD331AB39526F4132E43CDF5606B99627E60CADA0F0C22D70EC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download