8de4275b1fbe721b9cd81de75d3e66b7e06ae254e3d7404742d807be61e0911b

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ls.html
Size 20KB
Sample260810-nsb4gsgm2w
SHA256 8de4275b1fbe721b9cd81de75d3e66b7e06ae254e3d7404742d807be61e0911b
MD5 543b2767b3a3562dbac36d94c45c6152
SHA1 98712bcc9f8703b883a62efd9b610dafa46aca07
SHA512 47dbbd2278bdf6f7409e30b9d7dc450bf6132f07c1c0fc18dadda449149da19b66988ae37f55719ae3578d4fb071700660dea802208e8d9f7b9bd5f7fd13fc77
SSDEEP 384:R7vxOOtQqSCLExKVhBi0duRXft0C1iRjzqvI7IKHnx/jM:dkOt7SCLEsuWuRXftgqvIMmx/4
TLSH
T1A192FA21D8F22173416341C67AE65B5A6FE1C503E6092501B3BC8BDC4FEFE49E98725E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308356031738610"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
676	chrome.exe
676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 992	1060	chrome.exe	89
PID 1060 wrote to memory of 3876	1060	chrome.exe	91
PID 1060 wrote to memory of 3876	1060	chrome.exe	91
PID 1060 wrote to memory of 4100	1060	chrome.exe	92
PID 1060 wrote to memory of 5896	1060	chrome.exe	93
PID 1060 wrote to memory of 5896	1060	chrome.exe	93
PID 1060 wrote to memory of 2884	1060	chrome.exe	95
PID 1060 wrote to memory of 2524	1060	chrome.exe	96
PID 1060 wrote to memory of 2884	1060	chrome.exe	95
PID 1060 wrote to memory of 2524	1060	chrome.exe	96
PID 1060 wrote to memory of 1624	1060	chrome.exe	97
PID 1060 wrote to memory of 5996	1060	chrome.exe	98
PID 1060 wrote to memory of 4728	1060	chrome.exe	99
PID 1060 wrote to memory of 5996	1060	chrome.exe	98
PID 1060 wrote to memory of 4728	1060	chrome.exe	99
PID 1060 wrote to memory of 2260	1060	chrome.exe	103
PID 1060 wrote to memory of 3348	1060	chrome.exe	102
PID 1060 wrote to memory of 2260	1060	chrome.exe	103
PID 1060 wrote to memory of 3348	1060	chrome.exe	102
PID 1060 wrote to memory of 3216	1060	chrome.exe	104
PID 1060 wrote to memory of 3376	1060	chrome.exe	105
PID 1060 wrote to memory of 3216	1060	chrome.exe	104
PID 1060 wrote to memory of 3376	1060	chrome.exe	105
PID 1060 wrote to memory of 3364	1060	chrome.exe	106
PID 1060 wrote to memory of 3364	1060	chrome.exe	106
PID 1060 wrote to memory of 1428	1060	chrome.exe	107
PID 1060 wrote to memory of 1428	1060	chrome.exe	107
PID 1060 wrote to memory of 2860	1060	chrome.exe	109
PID 1060 wrote to memory of 2280	1060	chrome.exe	110
PID 1060 wrote to memory of 4164	1060	chrome.exe	111
PID 1060 wrote to memory of 676	1060	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ls.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa8a48c728,0x7ffa8a48c734,0x7ffa8a48c740
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,7354624729781563342,8604033960012682349,262144 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,7548559190621501945,1176608040386966894,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,3385867247957666233,2960197540268938144,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,9401494353447980657,18276823060412051591,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1932513371722024447,3075014451435439561,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,4250453169193563748,10203919498620593820,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5424,i,4895325253213915246,3124163223346668283,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5404,i,1851810840595502073,2240682747512564069,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,17862279422678397373,11619046766925495373,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6052,i,12098665306345856485,15509522948253672491,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4884,i,4733189338041305184,12581714271567876058,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5872,i,17363502842139724524,11143015937046209430,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5516,i,3750236248484609871,14370618974472142564,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4944,i,13947274637978365807,12276898301825577996,2097152 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,11426815503608651447,9788543815756961792,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,18343195476156410492,9554727716773822320,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,14317701010250438993,18161301667413700061,524288 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6016,i,8224409842795932098,10549830920307580175,262144 --field-trial-handle=1924,i,11429761363681367583,3053604592711029243,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89f1f516-24ab-4eea-bb4c-0c87388451ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89f1f516-24ab-4eea-bb4c-0c87388451ba.tmp
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 629c7eefd10457ce4e5a9c9e6f1ef6c64f75d2ae94a469956e5e6cef0a4ecb6d
MD5 2594a49b29657b3836d754d29723ee92
SHA1 cbc3757769db47e85557a38faff03a52a456f753
SHA512 894309d11c11dccc5c5a5c96ae8793a3dc897077630ecf1f0a1adc63ac642afb44dd7759af13f03912e9e836882e85d6f7da3cf19d3c99b8aae3ed7a5457049f
TLSH
T193E061B5CD34EC2709FD175860540745E75403572B81464F363D911CCFF193B458A85C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9a052955d61f1bdaecce604e1dcccb29ebee7a63b963a385e9444c857ccc8ed8
MD5 261e8a4337146a1d47085ff7901f692b
SHA1 73707cf7cae2649b15f3ca37161c7658a0fbeee0
SHA512 c89310fceb9ea7cc6f5a46504d15c4b1212c1372bdfd05e7c0e0db4dbc9f442327e9c595198fc8d3dd0eca8096c2c46e256a572ef782b27cf6fd81bd347ce761
TLSH
T1D0318EF783A4957D851192E4EB156F1FCE690624031C3CA689D46E1B53F2872E10579F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6db9cc259c658c3105e1690b25095e6882e408206274403f24ea4ab40ca130f5
MD5 eed75218d69b17c7ecb163c41d2ae3c0
SHA1 b727e55dd88576085b47271ecee9dc971b4a73b8
SHA512 f0129704455ead890f4dfd1fbc2182da131c03b786f7e636b0682ffed8f7d518ff5c80b5f2fa5493af6d8ca8124c4bfd9943831d3c38171c65f61c2611493658
SSDEEP 192:3RhaqgtSv7YvAPRp2EG9SHsb+WNnyz1PD9e/20tVyIsnAUge:3RhaB+06XkEwW1PI207e
TLSH
T14442C82EBA20693B6DDFC229FD257B93D6F6102225902E84F7FC896C25D75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bcf5cf1916c266261490b80362041d0cc6754e58a9c2c118c2c3e31d0c3f642f
MD5 24fe2cd434d1df36422485f1a6146ebd
SHA1 19d01eb5c85f4b4729fc407f35972284989d7289
SHA512 c8ee8367ae9988a9dcdf4512119cd4bc4948a9623afd3055ed878e87c9d9246dcb4596556325de02b86429e0cc2b4959413fefb27d989346d5d8e6784d9915ae
SSDEEP 192:3RhaqgtSv7YvWPRpEEG9SHsb+WNnyz1Pe9e/20uVyIsnAUgE:3RhaB+0wXuEwW1Pb20mE
TLSH
T13342C92EBA20693B6DDFC629F9257F93D6F5102225902E84F7FC892C25E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 42KB
SHA256 cb51886e7cba225ffea1f384041d20325739a83ee5487bd41e65a9e1c83265b8
MD5 45a082a563b520cc14f31b29125a19bf
SHA1 5c8d9e7066702422b3c70ed5072811f2ee60bf49
SHA512 b6bca5ee3b86fd5d06d5741c4173caa00bcf90aef8bfe3c9cc330568afab1f3467ec96a25cd661eeea16882806197b504df53c3220b312075efcebe9f95e431b
SSDEEP 768:t0tLMGSPfi7A6xkFSMUmCRICqNVSQHPul/cdGDx1p2geitMTnY2zRvcdd5z:CtP2i7A6SFSMUVyCsSQmTPUlTnY2zRkJ
TLSH
T1FD13F121803CAD7F809AE4CB71066A47DE8655A6E85419D4FFFE6DA900FB0DC3346336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0a66f063b13160ae7298da0854ef9d1510311c875c2c60c92043457cb48c0ad0
MD5 b7c718be4dc5df61b903942b4236e866
SHA1 8b677bf7f24cd31c3cfdd6040ef15a09b056c7de
SHA512 2e94e42a1eef826a8a66f55f2c657fa6acaf21ab1964c33c250b13cbc4891b639e6183ca9b8c70e57a948e39a744b2fac09b811e322207607a0b63f858318a10
SSDEEP 96:nC0d+VUJ7oKfVHrSJEYvqVHfSl8h4otop5z7DQB6jcMGyvP/e4ilp1GiNTbHV16V:nC08UR5rYv+9iU2rUPae4ilCcTbHV16V
TLSH
T181C108BAA47DEC7399F69485B0036B47CEB571BB9550AEA4EEE91F0C01D71EC1342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6ac41981ac79834fe2c1b97cadbe052b6b3aacfbe30da7b735e0ea27faf3f42c
MD5 49f8dbc95a7bece9f78a84ad63a978fb
SHA1 e902e3ec4a16fc15150d26734cafc49a90a4f22d
SHA512 753569fda4d3042ea35ec55804f403726a2564d371cb26cc1771375099edf414b80438063c9f934721a0ce68b82fe639d5e4a41a57c02ef433811de70960ad8f
SSDEEP 96:nbJ0d+VUJ7oKfVHrSJEYvqVHfSl8h4otop5z7DQB6jcMGyvP/e4ilp1GiNTbHV10:nt08UR5rYv+9iU2rUPae4ilCcTbHV16V
TLSH
T184C108BAA47DEC7399F69485B0036B47CEB571BB9550AEA4EAE90F0C01D71EC1342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 44613f05492faafd86c5b416b395e1ad90c05e0ac9455bae68500a6e677e7da5
MD5 f580974df85b2e5d56de9e281ae84a8f
SHA1 5944ba208ee3bb0c7fbf37b7bbcf539c1d26983a
SHA512 8d74e5ecfa2a27317b826b833f47556791da50adc0376ec9e7d7f21811e8f574727be84b1b1e6bcfd1991fec72b6318f4b4a5a85560a0f9ce12ce4fa0ac14e86
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5z9DQB6EGyvP/e+01ZPEOLv4a:MC08UR5rYv3eDUDJUgae+01ZsOP
TLSH
T1D4A12973A47A8D7BA976C48575022B43CEB5B07BE521AE94E9ED1F0C01E70ED1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download