e25c9f9041db3dcb143ace1eba4c22dd58f503c957708698cd753472671041c7

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5985.Original agrario-cuenta.xhtml
Size 7.4MB
Sample260813-2m7vvszelh
SHA256 e25c9f9041db3dcb143ace1eba4c22dd58f503c957708698cd753472671041c7
MD5 12989a589a086defbf34c09fdb88daf1
SHA1 345ff86c6f43d56e11b355cd92dec8f28406e0ca
SHA512 71860d6247ee0f1d136a64ab95de19620702b871f41fc288122e0edcb36540012f150bceca25ec58a61fc1c57d615b3ae4d633ccf507feeb554963e4954a2d93
SSDEEP 24576:cm1LWdVHNjC7nvSUVsTe8XprmzsO4cOwuil+G3gJ4PJ59dr7TI3Gii411U5cZY6F:le9M7K7GkB
TLSH
T1E4768EB876043CD55A6F466FED93ACEE23AA17628A8B98C54459BBC30573375FF03804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5176	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311346141892900"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5812	1964	chrome.exe	88
PID 1964 wrote to memory of 5176	1964	chrome.exe	91
PID 1964 wrote to memory of 5564	1964	chrome.exe	90
PID 1964 wrote to memory of 5564	1964	chrome.exe	90
PID 1964 wrote to memory of 4192	1964	chrome.exe	92
PID 1964 wrote to memory of 4192	1964	chrome.exe	92
PID 1964 wrote to memory of 2548	1964	chrome.exe	94
PID 1964 wrote to memory of 8	1964	chrome.exe	95
PID 1964 wrote to memory of 2548	1964	chrome.exe	94
PID 1964 wrote to memory of 8	1964	chrome.exe	95
PID 1964 wrote to memory of 1200	1964	chrome.exe	96
PID 1964 wrote to memory of 3856	1964	chrome.exe	98
PID 1964 wrote to memory of 3856	1964	chrome.exe	98
PID 1964 wrote to memory of 1600	1964	chrome.exe	99
PID 1964 wrote to memory of 1600	1964	chrome.exe	99
PID 1964 wrote to memory of 980	1964	chrome.exe	102
PID 1964 wrote to memory of 980	1964	chrome.exe	102
PID 1964 wrote to memory of 3124	1964	chrome.exe	103
PID 1964 wrote to memory of 3124	1964	chrome.exe	103
PID 1964 wrote to memory of 2348	1964	chrome.exe	104
PID 1964 wrote to memory of 5844	1964	chrome.exe	105
PID 1964 wrote to memory of 2348	1964	chrome.exe	104
PID 1964 wrote to memory of 5844	1964	chrome.exe	105
PID 1964 wrote to memory of 4324	1964	chrome.exe	107
PID 1964 wrote to memory of 3088	1964	chrome.exe	106
PID 1964 wrote to memory of 4324	1964	chrome.exe	107
PID 1964 wrote to memory of 3088	1964	chrome.exe	106
PID 1964 wrote to memory of 296	1964	chrome.exe	109
PID 1964 wrote to memory of 3420	1964	chrome.exe	110
PID 1964 wrote to memory of 3432	1964	chrome.exe	111
PID 1964 wrote to memory of 1740	1964	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\5985.Original agrario-cuenta.xhtml
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd3089c728,0x7ffd3089c734,0x7ffd3089c740
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,17625933738429809660,92009964083569093,262144 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,1169329441829012701,9814983473795394168,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,7088699748176374595,7714299880507198017,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,600080852142056673,6197289778408372700,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,6543929283868932320,16581046261964378154,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,12445693662083652864,14637382351442895657,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5252,i,1212305338235667844,9118577742140852171,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,15813519051350838276,10544890889465673052,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5440,i,7659689494384819349,9523397977112767723,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5232,i,805791833249918428,6217241713140700282,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5800,i,14972196426533684019,14529786182802223891,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5324,i,14159386073278361224,7155040657116085854,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5228,i,17471944150017218984,12383368438018794695,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,5555331764869232220,14586007790940888906,2097152 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,9082211657391868660,2846332217409175599,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
  2⤵
  PID:296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,5360829913108910606,10535235881109759682,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,6964810598221295956,17312448854643070187,524288 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5700,i,3666766540539083326,2595727187202801113,262144 --field-trial-handle=1908,i,3592211823281395680,17580125033916532533,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f7cc3aa40daa2a04f08859537925616f934a8cff1d079b790b9705fd114cb633
MD5 a4f46a57e580882f32358f620c5d15b3
SHA1 7aa5c3a520ce3f0aeacb585f99b9a918ebd39cda
SHA512 975fd5b0bb915d2144c9b6a0081329c45214db8ddd4434d2a1d50ae6b5bca5e58d17c18ca43efd4f7e7f9a54f82fdabeca0c01111baa99d70feb9a72d11a8431
TLSH
T16E3179F793B4957E8A1192E4EB11AF1FCE6A0524031C38A688D46E2B83E2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 295f10398d0f99b2096451c93b0c89756975051abe15c89dfdf914c736ddea26
MD5 2a319b48f4e8f26ad99c64561d523486
SHA1 0436933e44ebf5d26ab05edfb47fc2d6f69c554c
SHA512 1c97ce96765b0065367c12dcac3b04765474eb503792875c71c953eab861fc42443bacba97bd04b88f3a4880c003a71f55bd82848e47ae43af7d33c74c80ca74
SSDEEP 192:dRdlb4rhv7DvAPRp2r8964Hsb+WNnHGPMd26eYuL7VyIsnAUge:dRdt4xH6XLbwmPs2Q69e
TLSH
T11D42A53DBA64697B6CCBC219F9217B93D7F5102221902E80EAFC992C19E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8cd042d29d675ec5ed82bfd858b1260857a89f1af69f05cb200dee80cbbcb2a6
MD5 d97f18bffb59feb4b17faa8d6d533d61
SHA1 5731e2a642e2383496b252ab312b71831a06a487
SHA512 cc39752555866404f6b3706088ab85a3d171641afc312c1bab56f5fef9978590b67b9931408f5da4de552670ee40e480c6f70818473237c11c194d8fc0857418
SSDEEP 192:dRdlb4rhv7DvaPRpcr8964Hsb+WNnHGPFd26eYuf7VyIsnAUgE:dRdt4xHEX1bwmP72QY9E
TLSH
T13642A53EB964297B6CCBD619F9617F53D7F5102221A02E80EBFC992C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2fd0e96d3f56fcff417f9cb7e389064115ca7c7537db2b4ba35d9f69573f1f3e
MD5 be5ed7192f80450a127ad5f17796359c
SHA1 e6cbe82dd94bc919fb37d3369431ee5ee2a206f7
SHA512 252b8c914fd2a3b4451101a27b0d68d4ef06cac87f5a59d42c3ad146e9e00066858244aa39bf0201f71a703f2d31f46d0edc4d8b7df79a0828751c83f338fcd8
SSDEEP 96:9bJ0d+cAOIt5aDVmufj7CcfSl8h4otop5VpDWB6lGyv9JFjQD0ERNC39ISyVNCFE:9t0LA/TE57jiU2HG9+1QD0EuCMJ0
TLSH
T1E3C106B0A4AD6DAB4CF6A881F0033D83CEB8615BA9257E84ADED4F0C01D74DC5383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5c0dd227794fa8d67c318adc1ccaf234682d28186d7a023daabebc37bd7956ce
MD5 c46c60f587a34bb9ca90fb246a256f48
SHA1 df515e28f3e05c82d5b22e13bf75199c8f5e9a2d
SHA512 1d87d2a35ec64e4294110238c04ed5c24b0b4c30fe81311e69448239214611984294f8512c377b738ce705b3359032b4a8ae827a8985adcb62fc964b04dff9e9
SSDEEP 96:9C0d+cAOIt5aDVmufj7CcfSl8h4otop5VpDWB6lGyv9JtFiO0AuSwxsSD0T0j9IY:9C0LA/TE57jiU2HG9+tFGSwKSD0TUZv7
TLSH
T1A6C13BB0B8AD69B35DF69950F1437987CFB4915BA9216E808DED4F1C01D70DC2383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a154c3515bf37e4e79740d0e07da544b0c35f94b44fc3c4782996de2fabbf0e1
MD5 a8a1e8d1fadb4c4b509a1bcc5268eb08
SHA1 1198d9105f86d0a03f1b63a8f20cdd28fddb2608
SHA512 54097fcd5c0c1fc0a7e2a2e0c17f45d60b66847e27522497c5d604b6c95144870380650cec02a95235bfdd449867b51fd12b2f2a9153c2f6403752da890a124a
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5VCDWB6/dGyv95S0hbb2Jv4a:gC0LA/TE57cDUD6GUweS0hbKl
TLSH
T154A1F871B4A95AB75D75D584F5827E83CF78A157A9226F80D8DC1F0C11E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5bbaebd36c481db48ff4083ca0709a2a3d1ee2e59291b527b19c798f1a4aa1d0
MD5 a2b19c8e42421367cb760786b286c1b6
SHA1 6c0f809539518d32d621dd50126ee07a78f7829e
SHA512 3b7c509344b657882c3b446e5fd2c557ebaf80e03a875f802f96604254d9226e9bccd3ebd3f6f9f8dadc8caee79e2e1e16ba28677060428de51b3c35bbe82268
SSDEEP 96:9bJ0d+cAOIt5aDVmufj7CcfSl8h4otop5VpDWB6lGyv9JtFiO0AuSwxsSD0T0j9R:9t0LA/TE57jiU2HG9+tFGSwKSD0TUZv7
TLSH
T13CC12BB074AD69B35DF6A950F1437987CFB4915BA9616E908DED4F1C01D70DC2383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download