fe2a63bc761dbd9b4d4022960cc930b79e2ca42a46f490d01c1b8f8b0970ebc2

Analysis

max time kernel
150s
max time network
193s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.html
Size 34KB
Sample260822-d2s39aea99
SHA256 fe2a63bc761dbd9b4d4022960cc930b79e2ca42a46f490d01c1b8f8b0970ebc2
MD5 271861d872564725a6939bd0a381a3e1
SHA1 9b8e074a016c0c1ecc1ee092710e7dd37147cd8a
SHA512 f4f31070d986a14484f27258425ac2c268dff9c40d1153710a58f462404c496bc73ed88209ea884b119c8f92513bfa175fa5117d055625a9e6b981a1ce8de787
SSDEEP 384:LSn/iF+2qeobx1Gp6xjsibxMoKS/oFdWHEmA:LIiF+Ootu6xjzZKSQFdgEmA
TLSH
T1FAF2756592F301FB285795942BEB5B8B3F89A007D80AC9083FEC53988F87D94E95375C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318434818441784"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
6004	chrome.exe
6004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe
Token: SeShutdownPrivilege	5652	chrome.exe
Token: SeCreatePagefilePrivilege	5652	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 4128	5652	chrome.exe	88
PID 5652 wrote to memory of 876	5652	chrome.exe	89
PID 5652 wrote to memory of 876	5652	chrome.exe	89
PID 5652 wrote to memory of 4592	5652	chrome.exe	90
PID 5652 wrote to memory of 4144	5652	chrome.exe	91
PID 5652 wrote to memory of 4144	5652	chrome.exe	91
PID 5652 wrote to memory of 4380	5652	chrome.exe	93
PID 5652 wrote to memory of 4380	5652	chrome.exe	93
PID 5652 wrote to memory of 5900	5652	chrome.exe	94
PID 5652 wrote to memory of 5900	5652	chrome.exe	94
PID 5652 wrote to memory of 4276	5652	chrome.exe	95
PID 5652 wrote to memory of 6068	5652	chrome.exe	96
PID 5652 wrote to memory of 6068	5652	chrome.exe	96
PID 5652 wrote to memory of 2564	5652	chrome.exe	97
PID 5652 wrote to memory of 2564	5652	chrome.exe	97
PID 5652 wrote to memory of 3324	5652	chrome.exe	99
PID 5652 wrote to memory of 3324	5652	chrome.exe	99
PID 5652 wrote to memory of 1468	5652	chrome.exe	100
PID 5652 wrote to memory of 1468	5652	chrome.exe	100
PID 5652 wrote to memory of 908	5652	chrome.exe	101
PID 5652 wrote to memory of 908	5652	chrome.exe	101
PID 5652 wrote to memory of 4776	5652	chrome.exe	102
PID 5652 wrote to memory of 4776	5652	chrome.exe	102
PID 5652 wrote to memory of 3096	5652	chrome.exe	106
PID 5652 wrote to memory of 1744	5652	chrome.exe	105
PID 5652 wrote to memory of 3096	5652	chrome.exe	106
PID 5652 wrote to memory of 1744	5652	chrome.exe	105
PID 5652 wrote to memory of 4384	5652	chrome.exe	108
PID 5652 wrote to memory of 3304	5652	chrome.exe	109
PID 5652 wrote to memory of 5740	5652	chrome.exe	110
PID 5652 wrote to memory of 6004	5652	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffafc78c728,0x7ffafc78c734,0x7ffafc78c740
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,4459667505339731507,1831148231113812079,262144 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,3895971208406893405,950445568901783702,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,4897454184902451399,1705735547139322653,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,5669173828240219045,3020545506579379501,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,1542728822138212228,1726888698242290584,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,9660601694746431458,1716615330069898537,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,7759086968828286742,2303783108999163368,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5244,i,6419666597066931004,9344272455383167616,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5540,i,11795939970745424369,13946480547240894579,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5252,i,10698334785258105296,13592856298246421825,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5320,i,1762632390542268596,7879922131124992826,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5536,i,6253219862600280240,8086436745160406849,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,6462912511130527738,2845634710073721276,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6064,i,10690203480817084981,16577235524439116097,2097152 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,15593034463542755520,1564465115342692446,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,15090787096292560280,1196253528539653066,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,9290630936789214225,13815164005133319578,524288 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6336,i,723540738016596441,9323600585033213528,262144 --field-trial-handle=1916,i,6514526734496191452,17989682228262679490,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73af0ae3-411c-4c5c-b693-99f85e476ec2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\73af0ae3-411c-4c5c-b693-99f85e476ec2.tmp
Size 5KB
SHA256 20727cc82a9e163bc856a58bd4a62fa5859c4209d557f94170728480f97aebfa
MD5 f049bf32d0e25893132b7445d7629eb4
SHA1 edd53370583f1852aefef1bc9f520d0eb0881417
SHA512 1d0b51e0ab206edb4fcc326f2521557fc9913e777fe938a7cb5c1eb4975e051871f3396c884ec94765f50dfc2bb752642b429fb34642b94932613aff5d9ea610
SSDEEP 96:LC0d+OI4Q2k7i/jfTVZ91TjSl8h4otop5dZjDPRB6dGyvX1f1I0jKHDLUyhZ50ji:LC0G4DkG/FZ9TiU2PXPnZcfm1DIyhZ5D
TLSH
T18CC11A71A87CF9B369F6A159B0832D43CEB8615F9505AF24DFD90F0801EB5D92343823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 876cccf098bed10abb521adbc9023f9a5297288b0038230152ec88e4d5236595
MD5 a03a60e33b9797184a17846120192176
SHA1 3dec0652ec6948d962615ccf5e1105c5db7a56b0
SHA512 6a99e1937a5661fafa5a07c50585efc6a952dca578a99433214214c77cd84830794fd4a318df5a364ebcf002efce91d974e147f83eeaac2ac2f4e28c8d9f6726
TLSH
T132416FFB87E4967D891152F49B156E1FCE6D0629031C3C6788E46E1B53F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 32c453a41be920604115779619e973cb3e40d16a35e5aa36f318b76a9bba3d7e
MD5 21ae400d29db3896d2d809f1e73b587b
SHA1 65ce91a6ec5e9691e5f2259b12267e6225209467
SHA512 09fa82332397b50aa0fc358d9919b55ac235188e95a940b4d74125e5b68155f7c35b46a50e26d1f8f92def1d74a0d739e50973cebd50ae1bd6492a1162e3289c
SSDEEP 192:vRr++trv7MvAPRp23h9gHsb+WNn0UPfbCQW8IzxoVyIsnAUge:vRr+kTQ6XiqwXPjcDdMe
TLSH
T1C642C62EBA15797B6CDBE219FD617B53D7F5202221952E84EBFC892C10EB9CC211740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 36b14837a2d1a18952a3dd2a49fd1ef59725067dfacf4ac4a8d048a11c5a8e5d
MD5 2a2095c3d4f1ba6862e2a4b8fe84b392
SHA1 247c8695b7de5b63d3b289126f7b1fca96b460cc
SHA512 79eeb7f23285716bdb5470a8495bc01a1d5c9e533d1221b3a1231522c202dd27330615366607d936e993d74f01a1120ab0a62f5cc6f6217fe275f7329215cc07
SSDEEP 192:vRr++trv7MvzPRpT3h9gHsb+WNn0UPQbCQW8IzxaVyIsnAUgE:vRr+kTQjXNqwXPScDdaE
TLSH
T1EC42C62EB915797B6CCBE219FD617B53D7F5202221942E84EBFC892C11EB9CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b65087a686dc5436128dd56b496f4e580e63873bcc93a84c62836303009d4abf
MD5 baf65bc0e6fc20b58fdb93b00a9265a5
SHA1 78d7048d8ad6ff5637f81f7752e2bb7fefb0d305
SHA512 9deac3e1920a674ec9782dd8497cfc267130740202eaf7a6bec369acb14adabce9e443e448b77c794224c916fa8d5c5dbd9b0b553f47449945bf59c2b7584d03
SSDEEP 96:LbJ0d+OI4Q2k7i/jfTVZ91TjSl8h4otop5dZjDPRB6dGyvX1IUYhZIRNC39ISyVJ:Lt0G4DkG/FZ9TiU2PXPnZcZYhZIuC2JG
TLSH
T168C108B0946DADA75DF6B489B0432D43CDB8616F6915BE18EED90E0C00EB5DD1383823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4c90b33051d44f96a28076e989bc85da4e93450af14a946fadb11d499f32fa6a
MD5 d4ddc6f736be24907bdf016e570a8643
SHA1 a5391712f7abff051ff2f8ae72cddfa2ee2af62b
SHA512 2ec15cc6d8c3fb9f6fccbe28bfb46128201ba43df7cf534f4b27eac2e55c00a4fb63d54a24553e614efd4ed1ebd81197d157cbf4c7104eddc0a0f61fa178fb79
SSDEEP 96:LbJ0d+OI4Q2k7i/jfTVZ91TjSl8h4otop5dZjDPRB6dGyvX1f1I0jKHDLUyhZ502:Lt0G4DkG/FZ9TiU2PXPnZcfm1DIyhZ5D
TLSH
T1E7C10871A86CB9B369F6A159B0832D43CEB8615F9505AE24DED80F0801EB5D92383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7f6c58a7caea1eb9c054053fa0e5e2aa74d401c94510c904ca8d0f84eb1775ee
MD5 38b48bf5457b94d745014860d9a3d1a9
SHA1 bd829d6bf2536d158a22c1235f60be5c3d3be53a
SHA512 699798bf22b18a36749aa44eae487a05d618a32375786c91d3a3a69a3f9cca21474963d27b0462a4e8991ccd7454eec3d8b0dc2f636276b07f0c41d93c4183a3
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5d6DPRB6gGyvXNQZrbfyYv4a:RC0G4DkG/FZ9kGDUDiPnMAQZrbfX
TLSH
T164A10871A47D9EB76976D448F5923A43CEA8A0ABA611EF44DEDC0E0C11FB1ED1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download