67b72461e9c58103c2f51e9e9c569fcf2b9c946d758d746926baeeba9697bd82

Resubmissions

10/08/2026, 05:56

260810-gnfsjsscrf3

10/08/2026, 05:55

260810-gmf2xsed533

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
javaw.html
Size 184KB
Sample260810-gnfsjsscrf
SHA256 67b72461e9c58103c2f51e9e9c569fcf2b9c946d758d746926baeeba9697bd82
MD5 076feac3a42cd22ca3d4882050ff67c6
SHA1 aa83e633cf072e8686f2978ec2669943e4ddd77d
SHA512 42edba6c002bb6fe96484163b1a9b3d0a4b6b372179a48052184fc2e25f331612c1939b1902d6acf88949a474e41957cfe55e5d9b3b04877cb3754632a656d2c
SSDEEP 3072:Ki2btktn73vGMtJmJ1HmHzqS1uDq0tjVZcVr0+Jr5Fft1BKw/uZjYXELWF7OtGu8:KGVRr5HO/8
TLSH
T1F604C8404C75DD072CC53FBD7CDA6E015ECA6382A6B04907BB295A6836F49FF31DA24A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3796	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308150356008314"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
2064	chrome.exe
2064	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4872	4884	chrome.exe	89
PID 4884 wrote to memory of 6012	4884	chrome.exe	90
PID 4884 wrote to memory of 3796	4884	chrome.exe	91
PID 4884 wrote to memory of 6012	4884	chrome.exe	90
PID 4884 wrote to memory of 5460	4884	chrome.exe	93
PID 4884 wrote to memory of 5460	4884	chrome.exe	93
PID 4884 wrote to memory of 4932	4884	chrome.exe	94
PID 4884 wrote to memory of 4932	4884	chrome.exe	94
PID 4884 wrote to memory of 2476	4884	chrome.exe	95
PID 4884 wrote to memory of 2476	4884	chrome.exe	95
PID 4884 wrote to memory of 4768	4884	chrome.exe	96
PID 4884 wrote to memory of 2836	4884	chrome.exe	99
PID 4884 wrote to memory of 4516	4884	chrome.exe	98
PID 4884 wrote to memory of 2836	4884	chrome.exe	99
PID 4884 wrote to memory of 4516	4884	chrome.exe	98
PID 4884 wrote to memory of 1232	4884	chrome.exe	100
PID 4884 wrote to memory of 1232	4884	chrome.exe	100
PID 4884 wrote to memory of 6008	4884	chrome.exe	103
PID 4884 wrote to memory of 6008	4884	chrome.exe	103
PID 4884 wrote to memory of 3688	4884	chrome.exe	104
PID 4884 wrote to memory of 3688	4884	chrome.exe	104
PID 4884 wrote to memory of 5456	4884	chrome.exe	105
PID 4884 wrote to memory of 5456	4884	chrome.exe	105
PID 4884 wrote to memory of 4424	4884	chrome.exe	106
PID 4884 wrote to memory of 4424	4884	chrome.exe	106
PID 4884 wrote to memory of 1940	4884	chrome.exe	107
PID 4884 wrote to memory of 1940	4884	chrome.exe	107
PID 4884 wrote to memory of 3012	4884	chrome.exe	109
PID 4884 wrote to memory of 5696	4884	chrome.exe	110
PID 4884 wrote to memory of 5748	4884	chrome.exe	111
PID 4884 wrote to memory of 2064	4884	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\javaw.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc3e9bc728,0x7ffc3e9bc734,0x7ffc3e9bc740
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,11435281845064020432,44957921510780759,262144 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,10262020742416713296,17123626724141390186,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,15838514891501842826,7229789282262636435,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,2337444254486830395,17525114557810156167,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,5555645152589190341,16663458517488104089,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,14571480974198277956,16023369288136024682,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5564,i,6231212409369984500,17968795323449238143,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5552,i,16015464417240528024,18298126477872744145,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,15532015734632658760,16940101531844365824,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5872,i,13795691838350116428,15701934245499749010,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5752,i,14681460079354029977,10683294886664938030,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,12111956831298872362,4935249913636948404,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5700,i,17919876490626159418,5999541327537712617,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5780,i,16569658660431654817,6559118000515635853,2097152 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,12974063155708218951,8160645758051532420,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,10134466334919196378,11898713309954388791,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,12290075656228538086,5464695107915196083,524288 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4764,i,13289055878363151585,14060794816678938530,262144 --field-trial-handle=1920,i,18368848745446168320,9167540048826663820,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6e266cbb48fa7e8ca36589b8c6d157515bac1e652bf0eabac4d83c05f11781ca
MD5 1ea6b8bce886a5d06c8c7824da07ea43
SHA1 7ccae2e55a0f36a98d90449b639e02a8a1c80255
SHA512 2751efe008b743816b37808a986aa985d8c4902cf67504f46152473bdbf9aaaa71b0aa151da78a31c1d7adec035b36928dd0533921d94587358a9bc86d27235d
TLSH
T1E141ACF783E4957E891152E4DB16AE1FCD6D0614032C3C62C8E4AE1B53F2872D10139F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 57c7f26930c4890a43b2ef24867c5d731a0ad0c540ecfbe44bfb247a371d6643
MD5 0fae7d69cd57e063f8841fa6c502c72b
SHA1 2721f3d80b0edc9dac0eb66ef25f2c212fe51394
SHA512 08431d870ef60909e5c1bbb1c6ff55a281ed742313cd5953fb51a02087aaab5d4e6a62c09ffa4fb66f41d764715bb6bcc36506c8899a3d9989372964e27cc6ff
SSDEEP 192:vR/Vm+Cpv7MvBPRpV3/9gHsb+WNnjuPBi19a5YNVyIsnAUgE:vR/w/pQhXRqwyPBSaAE
TLSH
T1DC42B42EAD29797B6DDBD219FE617B53D7F5102220A42E84E7FC892C14EB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

def03749-9850-48f0-8381-a4c384afee5d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\def03749-9850-48f0-8381-a4c384afee5d.tmp
Size 11KB
SHA256 162df5f19fa503bfee07c28d7f6480004c0aee22fe4b8a1939f24c8b694c73f8
MD5 87ffed3a87aa054715942a9e812b53e3
SHA1 8e1f9f51651c6428771402ce283f671707dd2527
SHA512 bb565dfdcc81a0dbb41bc1b86866c7dac7a6591f926567fe73dc2db2a10d6568e24eea47d9fd8a41b3cf4a4c05f11c19422addedc9236bb3e59dc97e222b3c76
SSDEEP 192:vR/Vm+Cpv7MvAPRp23/9gHsb+WNnjuPc19a5YIVyIsnAUgR:vR/w/pQ6XsqwyPcaZR
TLSH
T1EA32A42EAD25787B6DDBD229FE617753D7F5102220A42E88E7FC892C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ddf867c8b8b0e6622a3bf0183017ead0b6de1d838c4171f2fad98d5ab0a11b73
MD5 96d55ef416a1f6050c8ae6407bda9e8e
SHA1 606aec5fdd43819452bdd174e7344fe66d08907e
SHA512 ff9949cb79fd58a831bece5813401201b6de6d5321874828140477962170ac02a8ad16f9ab469ad13a57acde8c7a700524cc49f013cb4926c1cb4516a3bf6fb5
SSDEEP 96:9bJ0d+OI4Q2k7i/jfTVZ9UT6Sl8h4otop5lZjDbB62GyvX1j3UbhxhRNC39ISyVb:9t0G4DkG/FZ9DiU23XlmcjEbhxhuC2Jw
TLSH
T16EC108B1A47C9DAB4DB6E489B0032D43CCA890AF6514BE28EEED5E0C01E71DD4383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e49d355bdcf6a5f90ef2fbb3c7f7606d694dc51e261e47af9cede5a6ce2c745e
MD5 e3c8648e8ed2e5659e31f11e54133f9c
SHA1 d10e1bd5fecd519c4de20e2711ca045a5f4847d1
SHA512 6f3420c4ecbd9b359c03bfc5e110eb56f772a035220d95349d3361e2a8f31373303acfdc47146b38c50fc6fb98149e5701c4218e44cb378b0a96421d60c40999
SSDEEP 96:9bJ0d+OI4Q2k7i/jfTVZ9UT6Sl8h4otop5lZjDbB62GyvX1f1I0jKHxAU3hxN0jw:9t0G4DkG/FZ9DiU23Xlmcfm1xh3hxNU6
TLSH
T17EC12A71A87CEAB759B6E489F4433A43CDB891AF6510AE24DFE95F0C11EB1ED1342422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dc6d2ce2a7d39fa03cb26aff008d0739894a5a15d5d3e4f3385c4586dc9ab3c3
MD5 5b39d77014f0a12620748f1a9d261622
SHA1 8cead5bf654a52f5caf6d7981c38f4e446363131
SHA512 9fe356a0ae820b48e72dd800b99df8ebe60c9e47d5439b7b21cc79df2b8e645ba61cdb173e9eb29b01ed705bcc66570bd4e3d78e5677a80aff2e9a957612fcd7
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5l6DbB6gGyvXkQxrbfyYv4a:RC0G4DkG/FZ9kGDUDqlMpQxrbfX
TLSH
T13FA10971A47D8EB75976C448F9923A03CEA4A0ABA611EF54DDDD4E0C11FB1ED0342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3c303d7b99a112ad866ad021f3f5546ee82675a5f5eff551c6ae8904d36da44a
MD5 02bcefb67955c88831825941e4a5b449
SHA1 1c2df1064e6a5d433387f095bba1e35a12b45dc9
SHA512 589edaa4801a8cc5c88d3053d99a816c3deca39d720c52092c361e77fa38e53d474056fbef843568e73855f9cb9f6a99b2fed817e1e97ec41e1cc1cc635465b3
SSDEEP 96:9C0d+OI4Q2k7i/jfTVZ9UT6Sl8h4otop5lZjDbB62GyvX1f1I0jKHxN3hxN0j9ID:9C0G4DkG/FZ9DiU23Xlmcfm1xN3hxNU6
TLSH
T184C12A71A87CEAB759B6D489F4833A43CDB891AF6510BE24DFE95E0C01EB1ED1342422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download