6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6

Analysis

max time kernel
900s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sxTe0JYy.html
Size 3KB
Sample260827-kdfxcagg89
SHA256 6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6
MD5 bee2ecad568cca3bbba7dcb9f3ced48b
SHA1 927852d4fc04ce2952187f54179d0f651be57179
SHA512 b759f1f046960c2c9bc20b1f874fadaf76ec9caa7321fcb0bcaf5ffe7b7a7828a84ca4b7d3a0030c08aa20966fe2394fc071b5b1b5de0ae938043b8a2b96ca1b
TLSH
T1656142038840C8279165A3347AD2F508CA68D183D35DADA9B29E119E5AC7FA1C7F72F5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2056	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322929561642286"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 5396	1080	chrome.exe	90
PID 1080 wrote to memory of 4292	1080	chrome.exe	91
PID 1080 wrote to memory of 4292	1080	chrome.exe	91
PID 1080 wrote to memory of 2056	1080	chrome.exe	92
PID 1080 wrote to memory of 404	1080	chrome.exe	93
PID 1080 wrote to memory of 404	1080	chrome.exe	93
PID 1080 wrote to memory of 548	1080	chrome.exe	94
PID 1080 wrote to memory of 548	1080	chrome.exe	94
PID 1080 wrote to memory of 2584	1080	chrome.exe	95
PID 1080 wrote to memory of 2584	1080	chrome.exe	95
PID 1080 wrote to memory of 5520	1080	chrome.exe	96
PID 1080 wrote to memory of 3268	1080	chrome.exe	98
PID 1080 wrote to memory of 3268	1080	chrome.exe	98
PID 1080 wrote to memory of 1812	1080	chrome.exe	99
PID 1080 wrote to memory of 1812	1080	chrome.exe	99
PID 1080 wrote to memory of 2024	1080	chrome.exe	102
PID 1080 wrote to memory of 700	1080	chrome.exe	103
PID 1080 wrote to memory of 2024	1080	chrome.exe	102
PID 1080 wrote to memory of 700	1080	chrome.exe	103
PID 1080 wrote to memory of 1504	1080	chrome.exe	104
PID 1080 wrote to memory of 1504	1080	chrome.exe	104
PID 1080 wrote to memory of 5072	1080	chrome.exe	105
PID 1080 wrote to memory of 5072	1080	chrome.exe	105
PID 1080 wrote to memory of 3628	1080	chrome.exe	106
PID 1080 wrote to memory of 1564	1080	chrome.exe	107
PID 1080 wrote to memory of 3628	1080	chrome.exe	106
PID 1080 wrote to memory of 1564	1080	chrome.exe	107
PID 1080 wrote to memory of 884	1080	chrome.exe	109
PID 1080 wrote to memory of 2920	1080	chrome.exe	110
PID 1080 wrote to memory of 240	1080	chrome.exe	111
PID 1080 wrote to memory of 6108	1080	chrome.exe	112
PID 1080 wrote to memory of 3916	1080	chrome.exe	113
PID 1080 wrote to memory of 3916	1080	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sxTe0JYy.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff917eac728,0x7ff917eac734,0x7ff917eac740
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,16017570606342877578,2594217001723726525,262144 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,5292002660928654693,16463140773299784082,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,6676745107206501592,4945478790476285580,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,17679895116218191548,17088220830912061433,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,3921164962725370072,13061992544481662016,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,15985014133080030871,3864682169102739622,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5276,i,9822932550609956028,8963034372387949965,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,7200935175239700937,14601280563439478351,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5556,i,16716601697131799838,1260010429584975289,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,1160701118215220529,5787204926393076847,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5532,i,9988522019820955710,7847266444914827697,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5496,i,13887568538819234722,6128619056658214216,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5864,i,12417011442147889630,18064009119806598719,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5508,i,7837704363277031178,4384108385938339826,2097152 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,7589941025486610402,8151535689605352263,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,12197253591620659950,2835807227426439540,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,16564126846613660804,14972151455441082324,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,7441725870004275109,10045961260382127216,262144 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,309617704169367736,1816942126435793623,524288 --field-trial-handle=1912,i,10463925673334054922,11099380599255327941,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  PID:3916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5636

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf922a412c278fbae9bcf2a391366b657419036d1c7e00c001930c8458e60c2f
MD5 edd52a3af9f5a387d0d9913b5c26b79d
SHA1 c784e2e526bb7123f2ead1eb708c9d14aa8fa294
SHA512 b2d12d9e0b8737f2e76107bdfd36ee4fd7ed2d5383f1bdb254dc666c71d141d745ca1330502cef8d6630bf9c902b1a9f66f368e1b696e17ca40e96fa1e0b3c5a
TLSH
T1C0E068E5ED28EC3B09FD0B6860804747E75403976B42481F3A3D810C8FB067B4A8A85C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ec57569c16b8c6c21bda81c6b9d3e367a70a979183be3fe7b68c2e8248a0f308
MD5 66814de96596a74ece1ee8f3ecdff29b
SHA1 1a1e654d206e60596b9e1428db455f775ae30366
SHA512 e1272beece516785997275acbd08404e58da35678dbc3ef49d8ff9611014eaeabd494d277eb55e0e1d9c33b85804a09885256a6efb4f6b742934b5daec89ca0a
TLSH
T16031ACFB83B4957E8A1592E4EB15AF1FCE6D0524031C387688D46E2B93F2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 7b65c60163af22d3c7134b1345e2618a78d3c764fd520a69c35d7832cdaff5d7
MD5 fcbc52f384d72d4e52aba1882cd5a5b0
SHA1 d30ff564b370392611f3b1773af4b77832106ca0
SHA512 6b26e684a7a652100636fcf46900729acc3aa56e9d95072b009d6bf7afdcec9124e017d69a4b5234a6757d95261e82b6b09a8629921c0d91e559ec888ddeaad6
TLSH
T16CF0C0A3E6BEB01B107D44AF4E08BD0568B5A435014019F0CF56926CE0810E71B02453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 44c8d5ed5231416fa89787ff60ad4c7f2758332557a69d0c92847d39912a26a8
MD5 3464852a887b7aea8dfc8f8af85540dc
SHA1 4f9c0f4c0a2e23fcebe354fefac24f5a71373b3a
SHA512 837e791c0eaf7c787692a7760fd30c296979fd2e62d86ebc2c308d1b72fd4171815ddc685b9b7792139c2cda76beea67ba419836aa677e6998c16f902a7d5906
SSDEEP 192:3R7Hqgqfv7YvAPRp2E+9SHsb+WNnxFPU82heLvTfVyIsnAUge:3R7Hu306X0EwjPd2UvT5e
TLSH
T16342B82EBA60797B6CDBC219FD657B53D7F6102225902E84EBFC892C15E75CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 46c4e0092d655023ae50ea89181f52befc12bd5c84f4c425ff5ec55b935a9a66
MD5 8e920f289ca81377f8fd9e396ed16d4c
SHA1 88db5004da3f7f57fc785c5f521be0a35e35c800
SHA512 93d43b50c7b39cb72f6565c6284049f3c61e12af948bb15d944cd20329f96527bec4e370f36ba199a52e39d7af5db76eba509fc48235adca1eac777bd6920683
SSDEEP 192:3R7Hqgqfv7Yv8PRpyE+9SHsb+WNnxFPC82heLvTxVyIsnAUgE:3R7Hu30mXYEwjPj2UvTXE
TLSH
T18B42C82EBA607D7B6CDBC229F9657B93D7F5102225902E84E7FC892C15E76CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 06c128f612d2a5ab2548233a0862e29035ca41d60c3f922750661ee9b69409e2
MD5 729911a87a014f2a0e6619f1263f961c
SHA1 9e967a3f4beec68112528067481f3e3398b887ac
SHA512 c7011402abe82d59f37161b4c491ab301f9b20fa45519c743a90416a0b6237bfef782a964b986b4f2c33c07701b0a0ee60374ece4711bd7ae75e754d6bab2350
SSDEEP 96:mMbJ0d+VUJ7oKfVHrSJEYvG5VH2Sl8h4otop5I7D+B6/GyvP/e4ZZVSEIRNC39Q3:nt08UR5rYvUSiU20+jae4ZZVSEIuHVxc
TLSH
T1D8C109B2A47D9C7B5CF2A485B0033E47CDA4607BA460BD64FEE85E0C00E74EC5386523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f69a5723b57e25716d32efbee40683615a895609e5913ae4ae1589c82c231c05
MD5 8337a498ca733d8b04744d0d2211194f
SHA1 058e204ca10a87a23a77d45d44799ddd13ec3e28
SHA512 359a09a14b9be5b1d7bbc211d36564cf109c0323bd6b939825786b386a98bfcc03f7dcf70aa86b9d619abe9fed610d604f108b94d7f1126884e29164186d469c
SSDEEP 96:mMC0d+VUJ7oKfVHrSJEYvG5VH2Sl8h4otop5I7D+B6/GyvP/e4ilp1GiNTlHVSE8:nC08UR5rYvUSiU20+jae4ilCcTlHVSE8
TLSH
T108C119B6B8BDED7769F29585B0036B47CEA5B1BB9550ADA0EED80F0C01D70EC1346523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f1b83d4257304d17f26d3faacbf6872639a841da6e00de7d2106cc27e6fa4827
MD5 bbc3f4442c4804a68c12390d8dea5597
SHA1 f1b64055ba535e5c23ce6e2ceafb790e044bebcb
SHA512 de9e6f965b4574fd9fab63433b927fc3603fd2f7a20f9caff59923af09d79efe43ddd314dfd15fbefb8e4886a841047fadc6b9c83374e2ee9db6a947a874f0f9
SSDEEP 96:mMbJ0d+VUJ7oKfVHrSJEYvG5VH2Sl8h4otop5I7D+B6/GyvP/e4ilp1GiNTlHVSH:nt08UR5rYvUSiU20+jae4ilCcTlHVSE8
TLSH
T133C12AB6B8BDAD3759F2A585B0037B47CEA5B0BB95509DA0EEE80F0C01D70EC1346123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 30d1f0d1e75d569002640de61bc9a86e997df66e0dc3bf51a06c3b1a3cc5e7f2
MD5 1531ca5ffa2900654ed0c146326245df
SHA1 ba315c4de9bbbf9709a496f2b48e51e618641778
SHA512 a63bb0a437c222d18b65b1d9604a51a536f1fd4056a815bf4df66967f226b7da6657277e8347c1e715e9085b76af4c11236f922cc3390d78a0d395c4c0696b90
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5I9D+B6EGyvP/e+0SEZPEOLv4a:MC08UR5rYv3eDUD6+gae+0SEZsOP
TLSH
T1EEA11973A47A8D7BA976C485B5427B43CEB5B07BE521AE90E9EC1F0C01EB0EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ac8b99d7c69061217bf0307db1dfa66eababae914b4cc74cc12d523f98909915
MD5 9d7cdedf23d11f3728d94ae4440f0ac4
SHA1 eb46d5555b7d303bbbdf7012adc821828371831e
SHA512 361331838b751064563900691cc62e744c382efbb49755de15d7fd032a12404fe204761a9e0e56f5d2ccf3a4e192a6a2755a15f3af602eb1c5033536a978f393
SSDEEP 96:mMbJod+VUJ7oKfVHrSJEYvG5VH2Sl8h4otop5I7D+B6/GyvP/e4ZZVSEIRNC39Q3:nto8UR5rYvUSiU20+jae4ZZVSEIuHVxc
TLSH
T1F3C1F8B2E47D9C7B5CF2A485B0032E47CDA4607BA864BD64EEE85E0C00E74EC1386527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download