fd0d27238f394d841e47d11805a6f250566908c0448c54a097766047ad086e8f

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 481KB
Sample260810-jsj2wayvey
SHA256 fd0d27238f394d841e47d11805a6f250566908c0448c54a097766047ad086e8f
MD5 648803de240d6b488b034c95c571af4c
SHA1 cf3ad707ef8267ce1fd4a7b403fed7d36c026836
SHA512 2594ce4e3df7631d0b7be63921a213cddb853688a28072ce6b7aab559c5efac990599a8f1599c8145a70660de4eb145ffa1be3137b56711fc302fa339ef2d6e4
SSDEEP 3072:e2q8x3xJXWY2uNYSrOz0Y1yrH+gb9y969F/x03C+MCfOUW2xeE7vZ8YtG2rRUUp:68x3xJXoyrH+gb9y9692n2ZcFqYT5
TLSH
T1B7A47CA5E7257F6FD29B4F6A6827F14CB3ED2099D8C01DA0F21A8D1C5CDCB45056B838
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2060	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308222073101053"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4812	2836	chrome.exe	89
PID 2836 wrote to memory of 3276	2836	chrome.exe	90
PID 2836 wrote to memory of 3276	2836	chrome.exe	90
PID 2836 wrote to memory of 2060	2836	chrome.exe	91
PID 2836 wrote to memory of 1996	2836	chrome.exe	92
PID 2836 wrote to memory of 1996	2836	chrome.exe	92
PID 2836 wrote to memory of 2820	2836	chrome.exe	94
PID 2836 wrote to memory of 2820	2836	chrome.exe	94
PID 2836 wrote to memory of 2740	2836	chrome.exe	95
PID 2836 wrote to memory of 2740	2836	chrome.exe	95
PID 2836 wrote to memory of 2896	2836	chrome.exe	97
PID 2836 wrote to memory of 5268	2836	chrome.exe	98
PID 2836 wrote to memory of 5436	2836	chrome.exe	99
PID 2836 wrote to memory of 6052	2836	chrome.exe	100
PID 2836 wrote to memory of 3304	2836	chrome.exe	101
PID 2836 wrote to memory of 2672	2836	chrome.exe	102
PID 2836 wrote to memory of 3304	2836	chrome.exe	101
PID 2836 wrote to memory of 2672	2836	chrome.exe	102
PID 2836 wrote to memory of 712	2836	chrome.exe	104
PID 2836 wrote to memory of 712	2836	chrome.exe	104
PID 2836 wrote to memory of 3788	2836	chrome.exe	105
PID 2836 wrote to memory of 3788	2836	chrome.exe	105
PID 2836 wrote to memory of 1204	2836	chrome.exe	106
PID 2836 wrote to memory of 1204	2836	chrome.exe	106
PID 2836 wrote to memory of 868	2836	chrome.exe	107
PID 2836 wrote to memory of 868	2836	chrome.exe	107
PID 2836 wrote to memory of 4944	2836	chrome.exe	108
PID 2836 wrote to memory of 4944	2836	chrome.exe	108
PID 2836 wrote to memory of 4940	2836	chrome.exe	110
PID 2836 wrote to memory of 4940	2836	chrome.exe	110
PID 2836 wrote to memory of 4740	2836	chrome.exe	112
PID 2836 wrote to memory of 4140	2836	chrome.exe	113
PID 2836 wrote to memory of 4140	2836	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff962c728,0x7ffff962c734,0x7ffff962c740
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,15297372808299359742,9129432714687327804,262144 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,8212926676927647616,5663042869889799989,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,14519753435878975978,8075869211440278861,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,6524686134842175209,7540078900629330901,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,18332728918426294365,18052357401981707873,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,7092374537441284007,10422274175476637081,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,1368302944251592427,5605389279669051442,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,11875603664453698299,12695304061278926633,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,8186516341412131933,5592485820992776974,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5588,i,6080565163656593643,3003576324098420300,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,15069973420167855772,14497772898785871520,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5632,i,2265224062384162741,11866327435347659644,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5580,i,9253986237142486657,16187533947778784688,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6164,i,2147490839427673024,15724985634279484766,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4860,i,14623998537778661991,160996337667840238,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4828,i,16425683018386292125,10987380551618290342,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6504,i,12822769868002127276,13224180021150222584,2097152 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6272,i,8131136847714978791,213667174357963878,262144 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=1064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,12985590817318990873,15142261286312536088,524288 --field-trial-handle=1940,i,8002177687729222973,14312120349499648818,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:4140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1276

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 728525cd55d4de2d30dbc571dc7e9f0ba122e644c65d9578f6eaaf3b31c59ff6
MD5 368493aebb0660b03f548c16dd589b50
SHA1 443149076095eaaefadb79a5e51e18bb57a24677
SHA512 75a0575c5a776e1ca3fedd1d90cbd98f7c96c295ecf85ca430a97694e4162e2b8cf7f0e585a545316b359760824ed7c4aae8fc80f69eeb066c069175494a10dc
TLSH
T18A4180FB43B4867E8A1592F4DB156E1FCE690126032C3866C9E47E1B53F2971D00575F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1fa4a6c26cdb0cd4fda9f4c97047e5d4f854cbf89bba885e2d86aac665d5bb2a
MD5 10586c7d5b8d51c93cc979fffd9f082d
SHA1 d3032978e496510a663cb4798eec0be5b9172daf
SHA512 39b35cd8dc98293db886461fdc5dfd5d96cfce01155d7d256609b62a9414eb47ce18175a1939d58a51a6f9b5b3682c01d44b22c8ca08761929db45aef45f0591
TLSH
T12E418EFB43B4967E8A1592F4DB156E1FCE690126032C3CA289E47E1753F29B1D00535F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 698ffa9ef71ce8e1eecda26a4ec08da56411ce36d947e91fed4ca83b39eb4d44
MD5 c3a41df97d441138f4fff6a5b622c1d4
SHA1 a2bada783b45d8e5865f2a6ad5a70dd8e5d3c76a
SHA512 0e1c19ba7f36c876c5585bfc7f99eff4079e6a825c613e25837269f575adbdc0c8ff8b3e34a5aa2d6c4c5178789c39a9e2468fc2f16bb1e3c4b1ce0bc61bf6f3
TLSH
T16F41B1FB43B4867E8A1592F4DB156E1FCE690126032C38A2C9E47E2753F29B1D00535F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 f391a37bd575e36b66335f9109c2adf6eff1ca3f93c984425c740fb4d6d813ae
MD5 2517d2b5155796f8770f35d6a31d73d9
SHA1 1d2f6fea023e95f4f8f500639e9060bbb6a2e6e2
SHA512 e43b7155ea2b1ddb145c725be731680eaa13802fb52a25516def295ccd0b6231b8a37d226e1dacbcc4b8f825e5c0fc4c62f2c5a96fc06c28f52cf03ad217166c
TLSH
T16011CE5B967F746720280C7F6E047C8979F6B8310180A4F8DBBAC26CE1C55FB0B2A417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4b022d0ae0eb8b62ccfc9eb9ae188223514d459eb7b1edbaafa366e8f6b203d7
MD5 9afd78e133ac9980f79e5cd8ee4c8753
SHA1 e597f093cf6485ca51786e7d8ffee3e955757e6d
SHA512 eaf49842a79fd7537d158be5ad0a5312775b360b418796b730142ab87323f15b5de1fd5f7f42b6150ba7962c1b92f4a80504d0d3fd1fa058c578b5e148de570a
SSDEEP 192:+RokYxNv7ivAPRp2XZ9rHsb+WNn/7PR8lk4E8AVyIsnAUgR:+Rokutm6Xa5wDPK5ER
TLSH
T1F332962AA9113D7BADDBD229F9217753E7F5103225E42E84E7FC8A2C14E75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d0abdb6976d6f65e97779986e1cda6abe1cc5dbae9d84427e04674386194ec0c
MD5 18f76accf7efe81971ea94cab1d86538
SHA1 fce4599b0858fad72986f51c22a0d249b75c822f
SHA512 9dda9162a04520026689b9eecf9181d252ec0fe64df11fd4fcdd4e3b9ca56de6aef2717f5fc12dcc4ac29450829345dc7d5fead199a031b77cc4eb94cc60d0d6
SSDEEP 192:+RokYxyv7ivAPRp2XZ9rHsb+WNn/7Px8lk4E1AVyIsnAUgR:+Rokuem6Xa5wDPqMER
TLSH
T1CF32A62AAA113D7B6DDBD229F9217793E7F5103125E42E84E7FC892C14D75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dec4c17c2623995ae7e7b2eb960b3fa2b62defb939d195e8004fd7dd8ef9d28a
MD5 8de906bafecc62974298f9a335029187
SHA1 375efd6381913b2f05537a71c8b4b67e081e7d9d
SHA512 59b284721ebfefbc078be0aa5432853e696b1e68d933442dfe62dc97def4fe9d07320d790f388a32f9bf630463753f4c84dabbf36f21bca23a6e0d244bf6542d
SSDEEP 192:+RokYxNv7ivuPRpiXZ9rHsb+WNn/7PB8lk4ESAVyIsnAUgE:+RokutmoXO5wDP6VEE
TLSH
T18B42C72EA9113D7B6DDBD229F911BB53D6F5103121E02E94E7FC8A2C14E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d34599db9f39956585cd1b4dcfc62189298dc1c83d26c97e9a6de4ded471f4c0
MD5 7a0cc401d61e3ff3b015217cd08d5045
SHA1 526e055ac0494cfb2b1d1445d14f20c2a1cf932f
SHA512 368d9d9aee6b5d588498d381ec33bc0766c5d37581e1ef7b15edfdf297b38fe55fcd90c2468a9eb20a22fc170e3f376834e7ebd3c8014d89d3067ba29a581bec
SSDEEP 96:vbJ0d+PTkblaRZiIEby3rUfsfuZ8IGGGSSl8h4otop5cFWD4B6xXGyv4Y+Glptci:vt0cTkJaRZi/CF2lziU2MQM82I+2tcxQ
TLSH
T17AC1E771A46D5CB75AB6A985B0033E87CDBD226B7958BE54EAED1E0C00E74DC1383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f9a6556e6b697426674026e3fca3a582094e00bcc82cd62c8a953ddfcc306e0d
MD5 8150d53621f309dcfd3ebf2f6ffb17d5
SHA1 c0ea6a0c142452ab8acde6376da1fb7c24894f88
SHA512 5080d1c83d57640713e64f9bd59311d40aafc0ab910f6de2c11c27b52bfcd4e5796331da4e4bc7249420caae88762dbb0325f4960c819a323c4397efc387a358
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5cFAD4B6xGyv4YR5gBObETev4a:TC0cTkJaRZi/CF2lIDUDM2MZIR5gBObV
TLSH
T1DEA14C3264659DB76976D98AB4423A83CFBD722B7950BF84E9DD1E0C18FB0EC1342023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 faf1c0aa93eefeac0f07ec5aad32565f762ea766e3e0fd90d4f408cf2d707206
MD5 ec55481cb06d255e1366104cc6c13056
SHA1 9093784141d5b6c40e453a0cff50cb45fb00abbb
SHA512 048c1f2f9bb589a065712cba34da91b72034a5fb0656af9ae23b168f15b296f500f001af1de772e21989247c7afaf7dd9146902a7357dad4e57f931881376706
SSDEEP 96:vC0d+PTkblaRZiIEby3rUfsfuZ8IGGGSSl8h4otop5cFWD4B6xXGyv4Y+mE1I07N:vC0cTkJaRZi/CF2lziU2MQM82I+mEmWN
TLSH
T12EC12D31A4A958735AA3D655B0033B87CEFD326B68906F54EED91F0801EB19C2343123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 061ba8673474012c1163dd670f461c156fd76d024c738d9441450b9e3340823b
MD5 412b4d56c64c55bf08606c2eafe9f887
SHA1 df32c044b971cad1971dbdfddfec552c13235f02
SHA512 8f6280a5646f49a30c5d0db21d11554a828ab80510d73316c2d4ac9dd97145911df3fe82ade6acdc26c01fdefc21943b0a3e15f90b97f69b0a44f9e2ec323242
SSDEEP 96:vbJ0d+PTkblaRZiIEby3rUfsfuZ8IGGGSSl8h4otop5cFWD4B6xXGyv4Y+mE1I0p:vt0cTkJaRZi/CF2lziU2MQM82I+mEmWN
TLSH
T11BC12D31A46958735AA7D695B0033A47CEFD326F68946F54EED95F0C01EB19C2343123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a685b9450ae4130565f51bb957d39b8e655489ca41171749ee03ca19a3a472a2
MD5 f6ffd4999a1332baa974668cef6efa6d
SHA1 76b5f34e44969e1e27133434ca3e62920bb3c852
SHA512 d8392a0aa36da1f0dc49a57a074f7523af6516dc3704152207ab269c2865f6825f3c096c8bea2b22084ddfb7be61b22d40a4bf7104c138e4c30df4a8774131be
SSDEEP 96:vbJod+PTkblaRZiIEby3rUfsfuZ8IGGGSSl8h4otop5cFWD4B6xXGyv4Y+Glptci:vtocTkJaRZi/CF2lziU2MQM82I+2tcxQ
TLSH
T12FC1D771946D5CB75AB6A989B0032A87CDBD226B7D587E58EEED1E0C00E74DC1383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download