6aa655b4d9f6b1810a58ace1567e229f8c55227348de07b518a1a13a9b174603

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 5KB
Sample260825-dsxp3sstdz
SHA256 6aa655b4d9f6b1810a58ace1567e229f8c55227348de07b518a1a13a9b174603
MD5 949458a05f523848aa4b8bc4a758f13f
SHA1 d5c5ea396357f53e18fcb0f370fe25f7279a612f
SHA512 445201d0f8c99fbc85f7c569dda1f4a432a7968f73b5a89b839f6e43ee8f4d8f2d1a11667b099cd697b517dfa593eacfba307fdd558ed925f3a7e25451368e03
SSDEEP 96:PNyatoXZzIEb0EaW87a5nb5zD6yD6Ee42EU66Spb2DAGNRYzueh8eD6zmw:PNrtkCBwnVzmymEefP6Bb5G0yQmyw
TLSH
T1C5B14AF36E71C137A3F12B4120B6B39CD261F04A6B01D097D9B2961DD6EEE5A80241A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5916	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321014274475186"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
5412	chrome.exe
5412	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2820	3036	chrome.exe	89
PID 3036 wrote to memory of 2232	3036	chrome.exe	90
PID 3036 wrote to memory of 2232	3036	chrome.exe	90
PID 3036 wrote to memory of 5916	3036	chrome.exe	91
PID 3036 wrote to memory of 2388	3036	chrome.exe	93
PID 3036 wrote to memory of 2388	3036	chrome.exe	93
PID 3036 wrote to memory of 4156	3036	chrome.exe	94
PID 3036 wrote to memory of 4156	3036	chrome.exe	94
PID 3036 wrote to memory of 2660	3036	chrome.exe	95
PID 3036 wrote to memory of 2660	3036	chrome.exe	95
PID 3036 wrote to memory of 4076	3036	chrome.exe	96
PID 3036 wrote to memory of 3524	3036	chrome.exe	98
PID 3036 wrote to memory of 3524	3036	chrome.exe	98
PID 3036 wrote to memory of 3400	3036	chrome.exe	99
PID 3036 wrote to memory of 3400	3036	chrome.exe	99
PID 3036 wrote to memory of 424	3036	chrome.exe	101
PID 3036 wrote to memory of 1128	3036	chrome.exe	102
PID 3036 wrote to memory of 424	3036	chrome.exe	101
PID 3036 wrote to memory of 1128	3036	chrome.exe	102
PID 3036 wrote to memory of 4616	3036	chrome.exe	104
PID 3036 wrote to memory of 4616	3036	chrome.exe	104
PID 3036 wrote to memory of 5992	3036	chrome.exe	106
PID 3036 wrote to memory of 2056	3036	chrome.exe	105
PID 3036 wrote to memory of 5992	3036	chrome.exe	106
PID 3036 wrote to memory of 2056	3036	chrome.exe	105
PID 3036 wrote to memory of 5912	3036	chrome.exe	108
PID 3036 wrote to memory of 984	3036	chrome.exe	107
PID 3036 wrote to memory of 5912	3036	chrome.exe	108
PID 3036 wrote to memory of 984	3036	chrome.exe	107
PID 3036 wrote to memory of 5392	3036	chrome.exe	110
PID 3036 wrote to memory of 3944	3036	chrome.exe	111
PID 3036 wrote to memory of 4840	3036	chrome.exe	112
PID 3036 wrote to memory of 5412	3036	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8a117c728,0x7ff8a117c734,0x7ff8a117c740
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,13304619821138407684,11364649247325360631,262144 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,3372222202522247275,28343832402906723,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,5029584465517002736,9664273123452601548,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,15297902634948302336,14640644064819795811,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,18414017891952283729,3386295435928460744,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,12087587443802228555,10490593487416001668,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5260,i,9328064249990185161,837851782662219644,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5296,i,8282628763834537968,6886782985413281184,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5696,i,8427123128935876874,15059385712482388792,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,7848546704880632819,18005358582537146382,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5628,i,5455087655315858252,680451079404908325,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5616,i,7195413873801050247,344168434580831397,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6304,i,8729972126511590398,6638546097307229702,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5616,i,4747176080425820648,2305297973473364618,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5340,i,7007619244854593638,12708485190714972067,2097152 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,5098108268997902155,5402977067925218207,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,3260565910727529314,18107695523781137434,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,13043683500687849141,17432336986888261053,524288 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5388,i,4513786554050787676,5381038795241084915,262144 --field-trial-handle=1928,i,15294469912792535281,12174669280992152456,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 12002537caee1e5ac438fcb4463031da04c274f63d9d539b0e180233a98af79a
MD5 dd5a4988b81eb60f532bec4db57720dc
SHA1 69b9f1f3f842e21c7c79bb06e88695768b148796
SHA512 a824dcfc7da60a91b77608b1d8dabb7f043a09d5e189a5534259d90a1454c55b3becbc4ad83c916ea7d1fd2bafb8e3057903480c63f0076af66a219cb000cadb
TLSH
T162218CF797E4857D8A1546E4EB15AF1FCE6A0524031C387688D46F2B93E2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ce05e4525d8b781dfab3b9214b8cd295c17f09c8d9f64c8b4483c58374edd1d4
MD5 841e7b4e6fd510f563fdebaa661b3b2c
SHA1 56389b38844568b3380712206fa6b148172f8abf
SHA512 7be1494a7ec3924ff5fb43403d64a3b402f1e473ee315b1224459d882f61aec71eeec39a1f6637fda18f06f005450969814beb10ceb62b662cecd9db2e311ecb
SSDEEP 192:+RhsY4h0v7ivAPRp2XI9rHsb+WNnHIT31F2Nf2mepraZOKNVyIsnAUgn:+Rhsjhwm6Xj5wHUT2F2rlaZRbn
TLSH
T13B42D62EA921797B6CDBC229FA217B63D6F5103521D43E84EBFC892C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 402d32ad3438b9ec3cb02450f0184c72b1001ba6fc79b5fed35664704025edc4
MD5 fd8f1a9738b03520b846843cef269b12
SHA1 c5d062d5618ecaef35cb5dc0073c3aeefb12ab9c
SHA512 a91037c11a926326bf3fc8f032efae667167e0ec729f31aac583bdc8d3b6b3fa96dc7b8faafa91867bd3be70bbf268ef80d98ae38ace2db6e7d2a88525dcc848
SSDEEP 192:+RhsY40v7ivDPRp/XI9rHsb+WNnHIT31F2+f2mepraZOoNVyIsnAUgx:+RhsjwmDXw5wHUT2k2rlaZxbx
TLSH
T1F442B62EA9117D7B6DD7C229FA217B63E6F5103521D42E84E7FC8A2C25E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9228af0e7248179ce9a22d449c9d4b146eb9f5c6c5a6c996050ae03458ff1cd1
MD5 37319ce2e84e28a5fbc9bc61c023cade
SHA1 949a68214291cb8a5dfe3f6b924a3fd769664129
SHA512 aec51d95dbff9936cd20e4bbcf35e25bb4457b79da634087bc95eb4cd28973953a9b4af05b76e03ee8702f77914b3c1e4af7fa85dde3adb5643829322d6b98ce
SSDEEP 192:+RhsY40v7ivAPRp2XI9rHsb+WNnHIT31F2of2mepraZOcNVyIsnAUgx:+Rhsjwm6Xj5wHUT2u2rlaZDbx
TLSH
T1E442B52EA9117D7B6DDBC229FA217B63D6F5102521D42E84E7FC8A2C25E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d65d8dc1676de65b159f298b00fe86ece39a0f82cfbaf2de4c8d9b4473200da2
MD5 a5730dddaab3d6cbc1469c994a36a074
SHA1 e8501cbb4687100937b91818d705df80672cf515
SHA512 2539e615ad75f97e3959321d8d6ab6aa85bb5750048e81d796435742ec9cef9c40f25f1ec059c74880973f2a289ff78ad54f2b08f1f7a5d7a3239581edd0a648
SSDEEP 96:VbJ0d+PTkblaRZiIEby3rUfsfuZ8IUGGWSl8h4otop5WAFWD/B6LxGyv4Y+itcxg:Vt0cTkJaRZi/CF2lZiU2WoQJmMI+itce
TLSH
T1D1C1F771A4ADA8675DF2A989B0033D47CDB8216F7958BE58EEED1E0C00AB4DC1783123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 090a662beb57c17cdc81e5287e5b2044464ae013dc6609ae6b6a80310db1b766
MD5 cea5870861ef259200fecc678c5bd11a
SHA1 d6cff6242229f84b48a7f7f34295c391684f1bac
SHA512 6a7b09e446b61313fe1ce5dea53ec84dbcbf66928077cd634674411250caf5b2643ad3aa75081180426550f1121ef08818d8e38d55f5d869396023a546ee2106
SSDEEP 96:VC0d+PTkblaRZiIEby3rUfsfuZ8IUGGWSl8h4otop5WAFWD/B6LxGyv4Y+mE1I03:VC0cTkJaRZi/CF2lZiU2WoQJmMI+mEm0
TLSH
T177C11A31A4ADA87359E2D656F0433E43CEB8326F6954AE54EED91F1901EF1EC2383023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2409666ae2b9ee359b46386829cb8c3914716930fdff80fff5c4b620101367e
MD5 45d298e2bf7ca79b7dfbf4b5a011ae44
SHA1 b55b934f2e756fc6b000a7063ae1ad29aa86f084
SHA512 d7d55560ee8f4f16f31a7e67027533f918e07d2a9c2321c0d14954f93b965f0c75e5af15f264fe52b069ea2c65606661ab8294eb4a51908eee48e8bb0868987e
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5WAFAD/B6xGyv4YR5gqObETev7:TC0cTkJaRZi/CF2lIDUDWo2JZIR5gqO5
TLSH
T17FA13A3264659DB76976DA8AF5423A43CEBD722B7950BE84E9DD1E0C14FB0EC1342023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 094065a3f75ab63e8d4e1e2a74a7785d2c9f6cfef14b6f81f2a6c71b8996cbaa
MD5 7355d705c246db9d242dededfd3f8f9f
SHA1 53a330221103b951909c219a6d4cbdd497ea40fb
SHA512 66ced18e93681d55a932937cbde0b3bd9477557ff9e35bf2a3a2cf6f6c7c96cdb545e4f8646820270590b4b0903e189bd69205b706f71a775f9aca58ad02c301
SSDEEP 96:VbJ0d+PTkblaRZiIEby3rUfsfuZ8IUGGWSl8h4otop5WAFWD/B6LxGyv4Y+mE1I0:Vt0cTkJaRZi/CF2lZiU2WoQJmMI+mEm0
TLSH
T11FC11A31646DA87359E2E656F1433E43CEB8326F6954AE54AED91F1901EF1EC2383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download