6b18a8a1ef86262bcc630fee465d84cf0d8e860d9a55ff0b465cb27f2f29f0f9

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 60KB
Sample260822-3ja76avybt
SHA256 6b18a8a1ef86262bcc630fee465d84cf0d8e860d9a55ff0b465cb27f2f29f0f9
MD5 3f9b3a9fbbf48e9ab25433ca01c0b7fa
SHA1 f7403baa7de3889fb8f8efb4b4ef0598da1afb15
SHA512 e7cf4448073f2161180b4850933350f64030dbaf7aa3e16c002048c503184deacf8247ae74ee246fc2619302630783113a6cd37ebe99730d71e4ac51637f12fc
SSDEEP 768:akyvV72MqMZRfmzOt26Ws/g36Or9v96AgtWNyvV72MqgZRfZtWL/g36Or9v96AGi:akakfxleHfx9BqSSx/a
TLSH
T15D53EB6CA62C1EC44E698EE11DA162F16A1E032F8749F74CC3A7C774A52C0EDED51D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319151554437614"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
5288	chrome.exe
5288	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4660	4908	chrome.exe	89
PID 4908 wrote to memory of 2572	4908	chrome.exe	91
PID 4908 wrote to memory of 2572	4908	chrome.exe	91
PID 4908 wrote to memory of 3096	4908	chrome.exe	92
PID 4908 wrote to memory of 4452	4908	chrome.exe	93
PID 4908 wrote to memory of 4452	4908	chrome.exe	93
PID 4908 wrote to memory of 2656	4908	chrome.exe	96
PID 4908 wrote to memory of 5804	4908	chrome.exe	95
PID 4908 wrote to memory of 2656	4908	chrome.exe	96
PID 4908 wrote to memory of 5804	4908	chrome.exe	95
PID 4908 wrote to memory of 4796	4908	chrome.exe	97
PID 4908 wrote to memory of 1648	4908	chrome.exe	98
PID 4908 wrote to memory of 3872	4908	chrome.exe	99
PID 4908 wrote to memory of 1648	4908	chrome.exe	98
PID 4908 wrote to memory of 3872	4908	chrome.exe	99
PID 4908 wrote to memory of 3496	4908	chrome.exe	100
PID 4908 wrote to memory of 3496	4908	chrome.exe	100
PID 4908 wrote to memory of 1544	4908	chrome.exe	102
PID 4908 wrote to memory of 1544	4908	chrome.exe	102
PID 4908 wrote to memory of 4324	4908	chrome.exe	103
PID 4908 wrote to memory of 4324	4908	chrome.exe	103
PID 4908 wrote to memory of 940	4908	chrome.exe	105
PID 4908 wrote to memory of 940	4908	chrome.exe	105
PID 4908 wrote to memory of 4152	4908	chrome.exe	106
PID 4908 wrote to memory of 4152	4908	chrome.exe	106
PID 4908 wrote to memory of 1124	4908	chrome.exe	107
PID 4908 wrote to memory of 1124	4908	chrome.exe	107
PID 4908 wrote to memory of 5176	4908	chrome.exe	109
PID 4908 wrote to memory of 5548	4908	chrome.exe	110
PID 4908 wrote to memory of 1488	4908	chrome.exe	111
PID 4908 wrote to memory of 2444	4908	chrome.exe	112
PID 4908 wrote to memory of 2444	4908	chrome.exe	112
PID 4908 wrote to memory of 4968	4908	chrome.exe	113
PID 4908 wrote to memory of 4968	4908	chrome.exe	113
PID 4908 wrote to memory of 5948	4908	chrome.exe	114
PID 4908 wrote to memory of 5948	4908	chrome.exe	114
PID 4908 wrote to memory of 4124	4908	chrome.exe	115
PID 4908 wrote to memory of 4124	4908	chrome.exe	115
PID 4908 wrote to memory of 5288	4908	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa0638c728,0x7ffa0638c734,0x7ffa0638c740
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,4974029455491728158,18358170689031840155,262144 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,2618771777020530608,14855073127600660624,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,7741455253428009099,13799279174333641711,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,13275952800472255973,13626579742964099042,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,12108608016939767517,3399172815891226850,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,12582262680329392803,847019841946741051,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5316,i,16335862369208104486,17842379208720812713,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5272,i,13283559097736448689,8632896260693175305,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,5380915322368988331,15627280673545646064,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5876,i,14354535672982308184,9801807109101372384,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,2276750602876499530,14169863429786109098,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6024,i,5203395913616273223,13612362816619528768,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6280,i,6644912306736339383,9254391317751326158,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6400,i,11166430127378914519,8502978375291364547,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,13743406306705693458,15095388378680602958,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,14544834973589050014,7880225597168899463,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,11022294390705725258,18074210003471881367,524288 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5532,i,6856983785168894119,12655602352853162648,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5964,i,8184965888006897552,5266572450850153759,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5548,i,2816753423708295695,12413873225720579076,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5444,i,17390365656535266774,2119450208864300762,2097152 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1124,i,12001866856956411948,18138754924146826767,262144 --field-trial-handle=1912,i,1782467837947301293,15695085253408940624,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

330e8e84-c23c-4688-ae57-ff4a5c447c61.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\330e8e84-c23c-4688-ae57-ff4a5c447c61.tmp
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7f8d1e739352f862c2f66ca5e101c1aa4fa7e32e6d4d99a1444c0eadb8960fa2
MD5 e149f90d63cb61563f824498d86a471b
SHA1 5292a39e8e6220626d0a5f1bc6e1283c1d82bf9e
SHA512 e43a660d9b85832a4cd84033a544ce19e21b6baf22bca5862833456cb187fd7be0ca85116ea5aa128c7f0220b6c39223abc7abc6703d53b619fb1c6fb2a36241
TLSH
T1F4D080153BC40105F7413FF31059D5F530315DE019711E838955579A8F633727C092BD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 55af96692a9f65700de7aa3feabb76aeefa496e1410293bf604cdee80ae7ce9c
MD5 e877239fd4ff92bec90926b724d110c5
SHA1 e75326e0708029655c4d9acac40092da5d5ecdc0
SHA512 fbd2bf8b1a735499b366e008299034a84a3732ce153820a43cc313193437321db3fa980f3637b011ec5d54f205649df2c97cab75647e8f63fc09044bbbeea158
TLSH
T144817CF7C3E4C66DC91156F49B156E1FCE690924022C3C66C9E8BE5B93E2872D21538E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2e6f7350c800ad5024cba81a37fceca8ab52c35eab5785f052a372426a2550d6
MD5 c6883f96e7e051e185a86e183f7194a9
SHA1 c10a20e9a50b1cbaf75e4eb6f9ad0364f9d54a29
SHA512 05ea8740e0c757a815b30f98147300dc429ef85a597d110a4eb61eec19cc5e100f28c500dfe35fe62fe9513ef2486b43a3b044c6bbeb3eded30a35f89f413ab1
SSDEEP 192:5ROyAkhv7JnvAPRp23l99Hsb+WNnDIPM2kHLW7La8B7VyIsnAUge:5ROyPxd6XivwsP+HqXaUe
TLSH
T1FC42B62EBA10653B6CDBC219FA227763E7F5103571D42E84EAFC892C16E7ACC2117447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd526ef24f0206d4af484a2a288c96c1e0cd63c6514d2bfc791886b021601264
MD5 6ea8e3fa6903f62a58acbe4a0821aae2
SHA1 db90b2239feff55d14aabe2a709dbc9dbfea18d1
SHA512 aa0979f41c1abe793fc5437619ff03e449243cc9b85f5305ae20541a6083ce129d9fd09808382f945b0d31cc674519934d2595fe74abc386ccba16e09b7b4314
SSDEEP 192:5ROyAkPv7JnvAPRp23oh899Hsb+WNnDIPMHkHLW7La8BXVyIsnAUgE:5ROyPHd6XcvwsPjHqXaoE
TLSH
T1D742B62EBA10653B6CDBD219F9127763E7F5103561D42E84EAFCCA2C16E7ACC2117447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fb851d75ac5fdf3fc41e3ff8dcd57fb90a887f71a6e347cd44537ba5ab9021b1
MD5 ca589744c849f7aee6bc175533336867
SHA1 ea97c7752d4cf52339ca9372f65cb104f076a2e2
SHA512 60bb68627aae5b60648b2659d0af07527c8df951cdf4377f1e02c646b88f01a4cdee4340442480b84eaacfe0ed153006b22e3914e7700e18a9b53f1ef51fd349
SSDEEP 192:1ROyAnPv7JQAPRp24dtEh899Hsb+WNnCY4Fr2M8kHLW7La8BXVyIsnAUgE:1ROyyHPX5vwVi2SHqXaoE
TLSH
T1A042C56AB910293B6CDBD219F912B773E7F6103661D42E84EAFCC92C15E7ACC2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 98d4e5970916b17d13217bf8e84c66fe51f4b13290f4a798899e3eb12b05c60d
MD5 b0a9341b289af85e11e7f07b4d690c63
SHA1 95671d1f7762e62027f1d7019e47f6744e88d209
SHA512 bafff607bd94a683f07fc27cb45232c0cf71a87e94fd272d5798550b7e93812f5e3b792a091bc2159b4e35ef808a695c0f3074b560ba75005fa35e01040ee2bc
SSDEEP 192:1ROyAnKv7JQyPRpg4dtEh899Hsb+WNnCY4pvdweMCKkHLW7La8BzVyIsnAUgE:1ROyyGhXHvwVYFweJjHqXaKE
TLSH
T19152B56AB910293B6CCBD219F912BB73E7F5103661942E84EBFCC92C15E7ACC2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b468dcdd219bdfaebfa06f19734bb3d4116a97cbbffe3cac91a588c58f89f94c
MD5 644fd935b1056e20a5c738526310b2cf
SHA1 505bc44f7e3cb186046ba2224fcd177d3b662055
SHA512 62352acb09239d4d8dfc824aacf69a543c216ca3dd2e70dc21fd38eecce2b661b48ad5536890d15517bf98c2f0d264c652d3b6acd01044d4e440fe57f339a538
SSDEEP 96:CC0d+CgjAe56y7nKZwpOfsO5afSl8h4otop5WIDwB6LGyvk5EMZH1Qzb/ZUWl2Gz:CC0Ngjf5ZKSNOSiU2Z0nWc2P2Wl2GUR2
TLSH
T15BC118B1A46D6D7368F3D1C9B0032A43DDB950BB9550FB80E9DA5F0D01FB19D2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 82fd21f384e9fd160ac732acf892bc481e6328fc5b2d16061de3ac1c8681104a
MD5 cf021185fce8d0abe88f2a06f2ebd683
SHA1 7fb35c480eb65017522360d37980ab6fb8978696
SHA512 83c5e37a897575981411b01d5ec2614e222e3e56d4227b53ff143e4647f5961a373e8b3f1ac3a97179aa089d971b796b635a19c668605dd151525b0640931fb8
SSDEEP 96:CbJ0d+CgjAe56y7nKZwpOfsO5afSl8h4otop5WhDwB6BGGfvk5EMZH1Qzb/ZUWlj:Ct0Ngjf5ZKSNOSiU2m0cv3c2P2Wl2GUY
TLSH
T1A8C107B1A46D6D6368F2D1D9B0032A43DDB550BB9550FA90E9EA5B0D01FB19D2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5f3fa42a4bbc8c680f0da00262227b472a15ae2ca552c8fd11b4b85bc6b56126
MD5 8ce6cf441debc518bc7195ce598755fd
SHA1 7a2865b2efdd5b85455ac57ca04fb1d302a40425
SHA512 3fd01021a6bb3016dbc3308a7375e98a133ef5842437baccd845c4fb862572ecd6d68d02c1e664aff2010df69d577dee8e2e798f37b7f7099a3532c36078d0df
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5W4DwB6vGyvk54E2TboRYv4a:5C0Ngjf5ZKSNqDUDJ07qE2Tbog
TLSH
T1B0A1F8B1A4694EB3A4B6C5C9B1467B43DEA561A7A561FF80E9DD1F0C00FB1E81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0b47e99459315dabd1d29463bd8ea5c5cae11098967394e8071246bf126f38a9
MD5 ec6c9d6776a3ff84df7bdeb076dc6b82
SHA1 65be86b0dca8a3711c77f148c4e976f090061e6c
SHA512 f40b9e6bb83e937a8a54b3b5caad267712281bb0b7f84bba3b92e8526df131b3a3ec5050d602da943db81160cda1b1418e6198b3011b451ad767aea0ea80cdb8
SSDEEP 96:CbJ0d+CgjAe56y7nKZwpOfsO5afSl8h4otop5WIDwB6LGyvk5EMZH1Qzb/ZUWl2K:Ct0Ngjf5ZKSNOSiU2Z0nWc2P2Wl2GUR2
TLSH
T154C108B1A46D6D6368F3D1D9B0032A43DDB550BB9550FB90E9EA5B0D01FB19D2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c3cea5f4f1b31c0559cc02334799148d7eb3bc376ece1e9e81394b920f2fc1a4
MD5 51fe364b6156f21094c1cdafab8da190
SHA1 85e95206c9ef666bd53d998104dc2e40fbdb43cc
SHA512 053870c12bb5b1cba2de7979b46ac2d37c7418b1f41ecefbdf144756393dac314ff8b515b97f1b6b69c2142e5a200e78bfcaef51164d97f5a10c792960bee25e
SSDEEP 96:CbJ0d+CgjAe56y7nKZwpOfsO5afSl8h4otop5WhDwB6BGGfvk5Erwl2gRNC39ISR:Ct0Ngjf5ZKSNOSiU2m0cv3rwl2guCmZ
TLSH
T166C128B1E46D5DAB48F2A5C9B0033D43DDA810ABA964BB54ECEA5E0C00F75DD2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download