hxxps://annas-archive[.]gl/slow_download/2df7a3e8c6f46294c7f3e984a3096ea3/0/0

Analysis

max time kernel
900s
max time network
889s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://annas-archive.gl/slow_download/2df7a3e8c6f46294c7f3e984a3096ea3/0/0
Sample260827-tkv5aaxfmf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5832	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323204905471711"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{82594860-B4FB-4C66-B686-BE948BE7BCBF}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 5896	2396	chrome.exe	88
PID 2396 wrote to memory of 5876	2396	chrome.exe	90
PID 2396 wrote to memory of 5832	2396	chrome.exe	91
PID 2396 wrote to memory of 5876	2396	chrome.exe	90
PID 2396 wrote to memory of 4756	2396	chrome.exe	93
PID 2396 wrote to memory of 2484	2396	chrome.exe	94
PID 2396 wrote to memory of 4756	2396	chrome.exe	93
PID 2396 wrote to memory of 2484	2396	chrome.exe	94
PID 2396 wrote to memory of 2072	2396	chrome.exe	95
PID 2396 wrote to memory of 2072	2396	chrome.exe	95
PID 2396 wrote to memory of 3228	2396	chrome.exe	96
PID 2396 wrote to memory of 1220	2396	chrome.exe	97
PID 2396 wrote to memory of 1220	2396	chrome.exe	97
PID 2396 wrote to memory of 6120	2396	chrome.exe	98
PID 2396 wrote to memory of 564	2396	chrome.exe	100
PID 2396 wrote to memory of 564	2396	chrome.exe	100
PID 2396 wrote to memory of 2600	2396	chrome.exe	101
PID 2396 wrote to memory of 2600	2396	chrome.exe	101
PID 2396 wrote to memory of 4788	2396	chrome.exe	104
PID 2396 wrote to memory of 4788	2396	chrome.exe	104
PID 2396 wrote to memory of 1792	2396	chrome.exe	105
PID 2396 wrote to memory of 1792	2396	chrome.exe	105
PID 2396 wrote to memory of 4840	2396	chrome.exe	106
PID 2396 wrote to memory of 4840	2396	chrome.exe	106
PID 2396 wrote to memory of 5976	2396	chrome.exe	107
PID 2396 wrote to memory of 5976	2396	chrome.exe	107
PID 2396 wrote to memory of 2340	2396	chrome.exe	108
PID 2396 wrote to memory of 2340	2396	chrome.exe	108
PID 2396 wrote to memory of 4616	2396	chrome.exe	109
PID 2396 wrote to memory of 4616	2396	chrome.exe	109
PID 2396 wrote to memory of 5116	2396	chrome.exe	111
PID 2396 wrote to memory of 3508	2396	chrome.exe	112
PID 2396 wrote to memory of 2848	2396	chrome.exe	113
PID 2396 wrote to memory of 4464	2396	chrome.exe	114
PID 2396 wrote to memory of 4248	2396	chrome.exe	115
PID 2396 wrote to memory of 4248	2396	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://annas-archive.gl/slow_download/2df7a3e8c6f46294c7f3e984a3096ea3/0/0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9e4a4c728,0x7ff9e4a4c734,0x7ff9e4a4c740
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,18192147672362672968,5185712961066926768,262144 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,14145530503203264811,5201444407320948430,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,10127550407681618371,4870289828266335892,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,2869658105283606268,3848811642107904391,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,7069181719657438707,8733399456522676243,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,16711467245653137108,8154821805432668844,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,12996069124085014120,12263983513742735915,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:12
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,536113810838948101,3807172462003849021,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,11240667570121747125,17942070970438723076,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5784,i,4692062198682922533,10301776496392124959,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5892,i,11335210675844882388,13511028564765852028,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6320,i,13692488651539253637,15389463171361650133,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6092,i,18334616183028018691,17776630360101381759,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5420,i,1495435442068236725,10088790139360342351,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5812,i,9338326844736935225,264410659227194744,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5444,i,1257937267412516351,13120498538036662509,2097152 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,6719304120818424948,2955424104209773979,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,12477152863469801507,16912276393855304949,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,18418456653663571771,11596728829135133781,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6200,i,4963788885739855153,5500107314541786943,262144 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2928,i,2873451314539692651,863345608094263209,524288 --field-trial-handle=1904,i,5631622446961508481,16933512124068997739,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4644

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 750566713acd4c9aa1b1839f483b6edc0eb98cecbc1acaec487edd9827b7cb35
MD5 81c6b30dacf7cb3a8b4d7fd2b514f904
SHA1 13e830d43ee7c752b6f47965951e7c390dd4d9b7
SHA512 b1d224b1356ac3e11a6f6e3e21fab1773fbb11998dcfc6d7e199ce5a0fc4a18244b39ddd0ecc07b3db8ddc7345415dbb93a8c91ca5a81026c6187d0682194bac
TLSH
T161C08C1890CA834AF78617BC1CB52A5126F00EB8124263C604C29141963A2E189950D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 13d9d86595c96b32d7ab644a643eb53def23743c29006dcff0cf30236bf8de8d
MD5 89bd00573d490a7d18f40822d6aaa6af
SHA1 b5603e036e1cb78a10942dd4019fa5733abc378a
SHA512 3ab08c514e4f4afe2e56f4575ca11427ec5639cdbc54ecbc0690142761a627bd90e0f5f90e5c61f152082d41766206ac46aa897f07926aa67906d66565939b8e
TLSH
T1BFD08004D0C64145F7C3177C5CFA5D513CF10EB8CD0262D654C5555157362F04E461F5
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5c52854753f28824e11a45a4a9f4bf1b403c5170e009ff34b39bd616bdb71b9
MD5 7f105dcebbc4b877b5064de7dfa91d08
SHA1 7d4664744be14c9b61b46faf054df6b357dd9ad5
SHA512 3e9cc66f915d169ceab07814e690959921485de04614065922e282f4899be113b4ad8d19a24ff4a543f82f0066f845a6247cfcc5009a64fa9fff836fedb4adca
TLSH
T1E0516CFB83B8896DC90152F4EB15AE1FCE290624036C7876C4D4AE17D3E2871D11075F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b503e2adcb89a05947de6cdcd1f97d96c5d66e585b71811f5a43335e51d3cd0b
MD5 6d836632a032ff2304a63f311d15ab35
SHA1 ffb4a2e23e8601a2947f40aa11e82f908bf1eea7
SHA512 e2804bb0868da44fdb53c5b7898878d80be2532d6b42515efd1cb56ebc8e20b2fba8f4692853d67092bd7f5aed79a3b743a7fdba208b3241ea755d8b5da57a18
TLSH
T1FA516CFB83B8896DC91252F4EB15AE1FCE290624036C7C66C4D4AE17D3E2871D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 883fd6be06989a5876f1d21199e6784443b0e27861eb78699b564b4e11fa48e8
MD5 f8976d6d53cd1e3e0730a4a514baf513
SHA1 3ed2d05dd431d9d411bdcb3bfdc4fcabb6a356c3
SHA512 bd4a0b26b660f8b2977fc4bd152baa05fd02744d5517f0133059f6947633c0cda6d4b45ff7875381859c93142693792ac5c52395a63e2659b5bfe8c8ee5e6812
TLSH
T1D2414AFB93B8896ECA1252F4EB15AE1FCE690624036C7876C4D4AE17D3E2862D10475F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 33ed038d1948f51c8de3a89cf104aa52f746f794cff1e39ee284c398a8191815
MD5 727986e512926e9865849b5ad2a1b4b8
SHA1 2107bb66fab65530b0f0bfde50cc66b6fc31bbe6
SHA512 d238dd786a8ef3bb98fa23fda2d5001fd6c2ab8662d35f382a9d7dce0aab72e9ebc1dc8049f6383066ab79bacf2ef06fc28fa838c3779d23fffe08b091e472a8
TLSH
T199415CFB93B8897E8A1152F4EB15AE1FCE690624036C7866C4D46E27D3E2871D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a4375ae715054bf47b07422a0e38b252698b1bd8e74c5083318a3340c9fb7d76
MD5 f42b1d7e9a92daa2b21f91bee76f625b
SHA1 48b33ef96840472788ec2042cde2bce04115c384
SHA512 4ff44ce7aadef95ad6388d08495593bc55acc5b4115a28a2975d19e587027f31a11bbd44e137f5c620d514afd74a73d4b9aa66cd84a59fe4516379a9633674a6
TLSH
T1E2417CFB53B8897ECA1152F4EA05AE1FCE690624036C7876C4D4AE17D3E28A1D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 09e808e670478236b8d7070727a11c3367afb2f46243d490f326ead9a7a3379d
MD5 e93f9896f6ea1c639d31b20b4a3defcf
SHA1 bde40c758456611303ce4af9b02ec43f580a8769
SHA512 3d0dcabd543821a466a581ba3e1854c8c91c96c10d6796edfb6b4dc09239843c903c3d79fd4ffcf3687195650b651fd905691a96217b30a55d8f91a6c9b76d48
TLSH
T1D5118CA7E63EB41B007C49EA5D05B8466CBEB830865279F8DF6A826CB0D58F70B12007
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b236b44d23464b79dc55b97ab78c2808db330ceee6ed060804c92ad00ba438a4
MD5 0ac3637473c5cf6718b88de1f7d4da86
SHA1 8cb1adb362f23719b55614030e02da34dea69c1b
SHA512 81b60c404ed5d6654a6d1d9cf427ab7064bbb3f05cf525c6454a48b0b4dd5e97619a293543c90301bba2c011256164ede7bb616c2ac27b8ae090b4e155551e7e
SSDEEP 192:yRjHA31v7FrvAPRp2Xdl9EHsb+WNnSFL9pj2qxkxbPRqkwMKF3na5VyIsnAUge:yRjHcFx6XOmwEL2qmxgR1afe
TLSH
T11C42B63AB914793B9DCEC229FA61B753D3F5203265942E84EBFC892C15E75CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7d221f58e6ce8ed5f9074b180d97a7a23155f529a600f13bd829aceb92d003a0
MD5 161ac8ee282db8790f1c502bff1e36aa
SHA1 0a4ba9660e092af12f3dee63681f1cebe015b9a7
SHA512 745f615c7d8a5078154b463990591cf1ad496cd822ad6a1e78aca64fe55c69687966695ecc9023b6ac6ef7d51dfd688e3cd3debaac201267d3dd36dbd3471063
SSDEEP 192:yRjHA31v7FrvrPRp2yFjpl9EHsb+WNnSFL9pj2qtkxbPRqkwMKF3naXVyIsnAUgE:yRjHcFxLXHmwEL2qSxgR1axE
TLSH
T1E042C82EB815693B9DCEC229FA56BB53D3F5203265902E84EBFC892C15E76CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 31676b7ec9cb3c57bae3a467689e53d6aa76647a77f1c64b661d4e5ba0d2a47b
MD5 c472195ebe3129823f4dec9c76560498
SHA1 0da16df475075bb3b87a13596a3f261ff87e5e5c
SHA512 e5f46c432e1236aa94b1fec74581b84848dfb3bff5aab68a6ec830c43a0c23bed9cde77ef3b9f50a331bbdcbb566cc3b98cd3aacbb80e6c0eaaac7267343a03f
SSDEEP 96:9bJ0d+EZUAbKFKu0d6aF7QuGJfmb5D3iSl8h4otop5qND7B67GyvnpBkexQ2160Q:9t0PtbKFKu00UUSb4iU2aFnMBkUQ216V
TLSH
T157C12AB1A86D9C7399F6E596F5432A03CEB0616B9D515FA4CACE0F1C01E74EC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8b95f11deebd83a2ae162636087ef29a85208c1377966d320168dafee36f38dd
MD5 d551d33b0899ef76964ea01ce8dbe6bf
SHA1 138fa6008f136d9adb16e01a21c1c578285efe5c
SHA512 00019653e1502408d64a51744fa11bc948938a23ee5ad107095eb7396edfebfbee71ff2fd84743697c8bba48bf2285547670b9e565ea71a2a0a844fa387e23a6
SSDEEP 96:9bJod+EZUAbKFKu0d6aF7QuGJfmb5D3iSl8h4otop5qND7B67GyvnpdO21pRNC3m:9toPtbKFKu00UUSb4iU2aFnMdO21puCP
TLSH
T175C1E6B1A42E9CB799F6A549B5432E03CDA4A16BAE157E68EDDD0E0C00E74DC1383927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7bb331b46e5021e3e70e07fc52f2e8eb9f80d6143b024945ed419a06dab8f5cd
MD5 1ef16ea5171f95134aa272d309337b07
SHA1 ee2d4c59610fe059221b81004c04fbda1f712103
SHA512 d1fe4da304185d7f1d850e26f8df26eb0aad79caa7c30f3b0f3158e46d2e61a96daaf341c71c69c81d5481ac73e2a0ed24a85ef539fe2d5000e1f04a0f95e468
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5qlD7B60GyvnnX1lbKmb0v4a:xC0PtbKFKu00UUSb/iDUDqFECX1lbK7
TLSH
T1BFA10A72A4698D73997AD549F9A22A03CF74F12BAE229F54D9DD0F0C10F71D81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c568594b017469c50e8286bd93d44f30112c05cced55edce0fb39bd703c8d542
MD5 e892e13411d760986d03e00778d85175
SHA1 f8d8428d8bf1b248e84d2421c1dbfb4f484c9e9f
SHA512 e44fae189b3d813fb81e1ff2353eb3429964bc17a5126527dd423c6b13ed1fc5df1005b03cf0cea48d6e3d23d76bbf51d71d1585d22086dbeb2dbeaa5a805a14
SSDEEP 96:9C0d+EZUAbKFKu0d6aF7QuGJfmb5D3iSl8h4otop5qND7B67GyvnpBkexQ2160js:9C0PtbKFKu00UUSb4iU2aFnMBkUQ216V
TLSH
T1B1C13BB1A86D9C7399F6D556F4432A03CEB0616BAD515F94CACE0F1C01E74EC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8355c26-7e36-4985-ab78-36ddc3787f48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b8355c26-7e36-4985-ab78-36ddc3787f48.tmp
Size 5KB
SHA256 65358bbdbdf9baf9e97d6c915513879cb3aa8a43a83ce43c7f206a520e9cd579
MD5 e3b26ec7daf862f3a815661a16d45eaa
SHA1 441d6ed0e9aed7cb556be01cbc112b2529f77b3a
SHA512 1f423ad35e3d57434884d055b85aa45d37de60690b9f030487484cbc3916fcfc02b98be919f7cb9007317eab2ea7f486f7d42ac5a8c27d319d500aa70e911e81
SSDEEP 96:9bJ0d+EZUAbKFKu0d6aF7QuGJfmb5D3iSl8h4otop5qND7B67GyvnpdO21pRNC3m:9t0PtbKFKu00UUSb4iU2aFnMdO21puCP
TLSH
T1A3C1D7B1A42E9CB749F6A545F5432D03CDA4616B6D15BE68EDD90E0C00E79DC1383927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4920-207-0x00000187B50D0000-0x00000187B51F5000-memory.dmp

Download