3cf72edcd7e38ef5dfb2714a4669cd21cfa67883861c81d86939e6f4875183ef

Analysis

user interaction
yes
max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 81KB
Sample260813-c4m5cazemb
SHA256 3cf72edcd7e38ef5dfb2714a4669cd21cfa67883861c81d86939e6f4875183ef
MD5 e70349c94e6e2ec30337023131fa6d3f
SHA1 8effb984b9a81c062328e7b3294f5f687bad7d81
SHA512 b12128cd8703e38ab8cdf41211797b49d7ff970305ce8141a24ec1398e579558a0d424d5a2de73f16dcd345f9421ce589539051a716e7926cdd62c5e0043a349
SSDEEP 1536:qnmVLjAdt1cdDxOMrlKNbFDdII2cdDxOMrlKNbFDtjE1cdDxOMrlKNbFDRTH2:qmocNcUl0pDicNcUl0pDtjE1cNcUl0pw
TLSH
T181839E2AA6960116B4637070B7EF570D7365D007E506CF2936DC1088DFCAAE9CAB7BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5560	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310623131084813"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5548	chrome.exe
5548	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 4300	5844	chrome.exe	88
PID 5844 wrote to memory of 3956	5844	chrome.exe	90
PID 5844 wrote to memory of 5560	5844	chrome.exe	91
PID 5844 wrote to memory of 3956	5844	chrome.exe	90
PID 5844 wrote to memory of 4124	5844	chrome.exe	94
PID 5844 wrote to memory of 4124	5844	chrome.exe	94
PID 5844 wrote to memory of 3492	5844	chrome.exe	95
PID 5844 wrote to memory of 3492	5844	chrome.exe	95
PID 5844 wrote to memory of 4904	5844	chrome.exe	92
PID 5844 wrote to memory of 4904	5844	chrome.exe	92
PID 5844 wrote to memory of 2064	5844	chrome.exe	96
PID 5844 wrote to memory of 5524	5844	chrome.exe	98
PID 5844 wrote to memory of 2764	5844	chrome.exe	99
PID 5844 wrote to memory of 5524	5844	chrome.exe	98
PID 5844 wrote to memory of 2764	5844	chrome.exe	99
PID 5844 wrote to memory of 1996	5844	chrome.exe	100
PID 5844 wrote to memory of 1996	5844	chrome.exe	100
PID 5844 wrote to memory of 2164	5844	chrome.exe	101
PID 5844 wrote to memory of 2164	5844	chrome.exe	101
PID 5844 wrote to memory of 2972	5844	chrome.exe	102
PID 5844 wrote to memory of 2972	5844	chrome.exe	102
PID 5844 wrote to memory of 3804	5844	chrome.exe	103
PID 5844 wrote to memory of 3804	5844	chrome.exe	103
PID 5844 wrote to memory of 4884	5844	chrome.exe	104
PID 5844 wrote to memory of 4884	5844	chrome.exe	104
PID 5844 wrote to memory of 360	5844	chrome.exe	107
PID 5844 wrote to memory of 360	5844	chrome.exe	107
PID 5844 wrote to memory of 2896	5844	chrome.exe	109
PID 5844 wrote to memory of 628	5844	chrome.exe	110
PID 5844 wrote to memory of 2028	5844	chrome.exe	111
PID 5844 wrote to memory of 5548	5844	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb5eb9c728,0x7ffb5eb9c734,0x7ffb5eb9c740
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,2809698026445499909,14338258573307037428,262144 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,7898014664822587451,10316651267604633145,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,1450689855128933830,17796371443979736269,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,4610650447821196258,9526009614794076839,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,17886263275722287263,10910771262126244326,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,15543869687332598445,1272605408455403852,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5384,i,17206514976996235535,16546985185674718316,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5420,i,512355239821455060,8150064335796998885,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5404,i,17093110767472568241,814422098880693745,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5412,i,9333054183563461688,10972168108058763712,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5416,i,12439715447691901143,13515006107917698564,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,3808184295804236676,12066074655058182453,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5492,i,1543615533143913059,13116098223037014753,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5600,i,4513114853740262799,18278071207747121310,2097152 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,314364986900034656,1866849631114324422,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,11241919430677438074,14872072958732132494,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,17382923409249987898,6457086908226801345,524288 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6608,i,11027460305082814228,2318225244112602380,262144 --field-trial-handle=1908,i,9208593836317409419,1765070859661634470,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2db97f994d31f234201eb027be990671669a167f5baa465f8826341f69182c9c
MD5 be96488e8b248098bf8202c7d4abfee1
SHA1 58dea4ba41d3e38338285b4806f5284f28448656
SHA512 edd0cff950e3a4715b32de9dc5f91aad8428597dc1604b94a851ebabbf82e800114ab64c2d0c0d31524a6cafd26cbf172947b410f3d3390f3fcb18bc26c71ac8
TLSH
T14B418FF7C7E4867E891156F5AB156E1BCD290615432C3C6788E4AE1BA3E28B1E10069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d0860b9707ac48a8e4a263d156734d78cc02f896c14cbca47c86d4cd869ebde7
MD5 9b74a3e3ca136de99764db097239567b
SHA1 ddbabe517a85087afd4d35a643dd262f51a08895
SHA512 ab80f71792422c029f89cc1bea1b65a51a3619bd57ca56215d98cf4b1f6125a63b41efd9f8cbe948631d59a11e845194056acca53429320608055694b2215ebc
SSDEEP 192:+R6noYITv7ivRPRpBXs9rHsb+WNnelPvE2k8Pm2gkwMagsVyIsnAUgE:+R4obrmhXO5wYPs2k8+FsagIE
TLSH
T10F42C82EA9117C7B6DDAD61AF9157B63E3F9102121E02E84E7FC8A3C14E75CC621B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 08733ba2f6fa2690f04ba844b2f55aedce2418a1d1dc4941e0a9f3e98d72d195
MD5 d3efb4eb38dd5b11c90090edba715914
SHA1 97482df34831c91a488e8d498e5f2cc7d2275b7b
SHA512 c4a5aafcd047499d70772541dd27d45ddf076dff65a6aa0487320f161039e7a776b8b8073c1e8046da57805b26ba07d5d8c1ad28b0dbb0b8e5760b2f751e37b0
SSDEEP 192:+R6noYITv7ivAPRp2Xs9rHsb+WNnelPXE2k8Pm2gkwMaksVyIsnAUgR:+R4obrm6XX5wYPU2k8+FsakIR
TLSH
T1C232B82EA9153C7B6DDAD22AF9217753E7F9102121D42E84E7FC8A3C14E75CC622B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 50c94aedbd71bbaac1d5781a34d2f7825c08f23768cdbff8a51379f482af5131
MD5 b14a3567364869709a4ff1146366c161
SHA1 8a8198944a74e8e291c87ba6f48314d4fe2c1e9a
SHA512 3b564c6e77312bbec7590a715ec5b0170a241026cdecd4d2815a39869fe9e810c270036683b857516724c04f1088a0c8baa69f90e59f0f8c7845defcb31f0e3e
SSDEEP 96:BAbJ0d+PTkblaRZiIEby3rUfsfuZ8IxrkGGOSl8h4otop5JFWDFB6LGyv4Y+jtcd:BAt0cTkJaRZi/CF2lV1iU2TQ7vI+jtcd
TLSH
T109C1E771A46DA8675DB2A98AB0033D47CEAC726B39547E54EEEE1E0C10E74DC1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dbf10fb43f735e77b3868dd296a6e3f12361ee0417b46e8cd2af2e50e4a9e234
MD5 34360ab7ea7ab5d4f47bc5a64cbd495d
SHA1 3170e5a3acf98219cdd5a8d5f5bcd6359747a9b1
SHA512 3e052a60d7cc53bd05dba65d27ad4c12bebc5d0f4a877091ea673aebd10e543e622ff10759707360e33d6047018e1e21d7f5749181052a40f4f10c8f0f0b5069
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5JFADFB6xGyv4YR5g7ObETev4a:TC0cTkJaRZi/CF2lIDUDT27ZIR5g7ObV
TLSH
T116A1393264659DB76976D98AB4423A43CFBD722B7951AE84E9DD0F0C18FB0EC1342137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cc4eef49727f927506161787d2b0081827269572c45f244d6d4cccc3b3e9bb36
MD5 5037c673096041600b2ec56d74f77723
SHA1 e7935b78a9e442cc4a1d10dcad2384bfaf14467a
SHA512 9f134ff71ade3f3318b3a3991b017fd036ecc2807b726e9cd759fb9b56253038b2e4a32936f656c3796a7531b1c07d67b03848a6b4cbf6b178eaa2192e02a423
SSDEEP 96:BAC0d+PTkblaRZiIEby3rUfsfuZ8IxrkGGOSl8h4otop5JFWDFB6LGyv4Y+mE1Im:BAC0cTkJaRZi/CF2lV1iU2TQ7vI+mEmm
TLSH
T1A3C11A31A46DA87369A2E556B0033D43CFBC326B68556E54EEDA0F0C01EB59C2383137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 619b61c41346188c5b05599edd1d5e7641341754b15c75f198d9b44390a506dc
MD5 6625909b821612265c7b1eff6fcb8cee
SHA1 4af8f897cb1455e8668bf3d0a1f54f4250086b20
SHA512 c3456450a36f8f8ab3c6c39f96f427a582d47ae20a2f30cddf6623b3992462b4af1379d21ce80fc74d3898dfd3182455d80bdc2b98dffb071f224fc0a63f69a0
SSDEEP 96:BAbJ0d+PTkblaRZiIEby3rUfsfuZ8IxrkGGOSl8h4otop5JFWDFB6LGyv4Y+mE1i:BAt0cTkJaRZi/CF2lV1iU2TQ7vI+mEmp
TLSH
T16EC10931A46DA87369A2E596B4033D47CFBC326F69556E54EEDA0F0C01EB59C2383137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download