a16d8da78792d5d2372e90713559134f1764df026a053a4374fb3468a6d82343

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 5KB
Sample260828-2f5rxsec77
SHA256 a16d8da78792d5d2372e90713559134f1764df026a053a4374fb3468a6d82343
MD5 c4a466128778d9d5445dc0b9e19501b5
SHA1 75d7be8906c92ba21bb60e25b6bee6208b79dda7
SHA512 770dbb88945457d1fbff2f6b46e04625139e6d68400550ae980827aa427cf68aed10c7956edb44e480d0e1cd1c78da70c92f0c5fe10474c4b4a3eaf9ce39ddaa
SSDEEP 96:PNyHtoXZzIEb0EaW871+5B+kVkMElFwv7NMELOXSggNKgVmYzueh8qwkfmw:PNatkCBQ5BDSdlezLOX9aLy8ew
TLSH
T129B13AE7DE3270124B792F6594F633589311F615BB05559CC6A18AAC45ECEDFC20A384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6632	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324299796344503"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4280	4336	chrome.exe	89
PID 4336 wrote to memory of 3196	4336	chrome.exe	91
PID 4336 wrote to memory of 3196	4336	chrome.exe	91
PID 4336 wrote to memory of 6632	4336	chrome.exe	93
PID 4336 wrote to memory of 2452	4336	chrome.exe	94
PID 4336 wrote to memory of 2452	4336	chrome.exe	94
PID 4336 wrote to memory of 1192	4336	chrome.exe	95
PID 4336 wrote to memory of 1192	4336	chrome.exe	95
PID 4336 wrote to memory of 3352	4336	chrome.exe	96
PID 4336 wrote to memory of 3352	4336	chrome.exe	96
PID 4336 wrote to memory of 1128	4336	chrome.exe	97
PID 4336 wrote to memory of 3624	4336	chrome.exe	98
PID 4336 wrote to memory of 6108	4336	chrome.exe	99
PID 4336 wrote to memory of 3624	4336	chrome.exe	98
PID 4336 wrote to memory of 6108	4336	chrome.exe	99
PID 4336 wrote to memory of 3680	4336	chrome.exe	103
PID 4336 wrote to memory of 4568	4336	chrome.exe	104
PID 4336 wrote to memory of 3680	4336	chrome.exe	103
PID 4336 wrote to memory of 4568	4336	chrome.exe	104
PID 4336 wrote to memory of 1408	4336	chrome.exe	105
PID 4336 wrote to memory of 1408	4336	chrome.exe	105
PID 4336 wrote to memory of 2844	4336	chrome.exe	106
PID 4336 wrote to memory of 2844	4336	chrome.exe	106
PID 4336 wrote to memory of 6168	4336	chrome.exe	107
PID 4336 wrote to memory of 5956	4336	chrome.exe	108
PID 4336 wrote to memory of 6168	4336	chrome.exe	107
PID 4336 wrote to memory of 5956	4336	chrome.exe	108
PID 4336 wrote to memory of 6976	4336	chrome.exe	110
PID 4336 wrote to memory of 1152	4336	chrome.exe	111
PID 4336 wrote to memory of 1384	4336	chrome.exe	112
PID 4336 wrote to memory of 4620	4336	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbbccdc728,0x7ffbbccdc734,0x7ffbbccdc740
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,2945792546669839996,6734984311486977972,262144 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,3917413243505953672,3038921574937765631,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,883336020570654965,11122944131903955736,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,1913888721893593944,17371766103243234114,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,1534902215671001569,8143090826775603744,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,13529513092930675036,8925169963181467205,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5536,i,8477225093853594559,11619903056689136800,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5564,i,16786426756288347147,10522175222580057986,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,6553507200502018533,12376295768777217797,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5864,i,16156719277926109963,2814718169650355542,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5320,i,12044842925172751025,1852982087100202367,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5612,i,8173449104047039406,17853912885772994600,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4900,i,12638473615550964329,3720109082545438427,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4980,i,10957882914822275182,2103498852874842995,2097152 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,16816373799474129703,4699197404224249432,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,4854792265124589825,16189292199969701249,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,7487349231914479739,13736168883180968031,524288 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4824,i,278834776285452071,4784428978860850716,262144 --field-trial-handle=1916,i,3853405552352171251,6788526046104343607,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62ae9613-1870-4001-920c-312112528c03.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\62ae9613-1870-4001-920c-312112528c03.tmp
Size 11KB
SHA256 f19e2c0ea0a7c46121687c1944b72b0a73d02b728cb8f46966a58a93e60c9602
MD5 5d4ca2078b5ba7d4db70c2f2a083fcd9
SHA1 b59f68da534f40e729cf8be98d5dab06b9b64911
SHA512 22ee370225389aa9605ad5d34b41f68cd389359e2d701ae7061467716f34b9710471f1d0586e2579136e670cf539da7e1fe237536696d90b48a64ab2b028a18a
SSDEEP 192:+RbVRkhV9v7FTvAPRp2Ck9CHsb+WNngFPYtea2CcaXEVyIsnAUge:+RbV095T6XAkwCPQ2Bawe
TLSH
T14E42B66EBE50697BADC6C21AF9667B53E7F5102531D42E84E7FC8A2C10E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

42df56cf-42c6-493c-89d3-5f17149788a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\42df56cf-42c6-493c-89d3-5f17149788a6.tmp
Size 1KB
SHA256 c2f9366974cbc968a49a5e4e8fd94120081b606599e34890eea70c5744f92dc3
MD5 5143ae493885591681151dee04f3eec6
SHA1 5e7bd948b117ee2f367957d7d108a5a5bf61ebab
SHA512 14f9d1e84574494b1d76b3c2911eb889bf89c1c0cfa550c62de4379c58e1014efcf5951773cacaa5fb8938344aa86dc70a6fede78d81af495b7e4489e159854c
TLSH
T1A0217BF787A4957D8A1142E4EB15AF1FCE6A0524031C38B6C8D46E2B97E2872E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8753aa6e75eed69207ed56c7b9bcba0fb1341997b19d0950a43515fb79055aba
MD5 3216e190d968467643b30a4edccae33b
SHA1 1fd9cc2634dba7882f3dc8b41810fc8d9a6f35ea
SHA512 fff36855b776ce3b02d6afb2ffc78284e676f4d235d67648620f66c1b30923c16ab349a1bf19aff30d06d61c8816981c2f88c770bd403391cb135d2c74c800a5
SSDEEP 192:+RbVRkhV9v7FTvlPRpNCk9CHsb+WNngFPStea2CcaX/VyIsnAUgE:+RbV095TlXFkwCPW2BapE
TLSH
T1E242D66EB910687BADC7C61AF9567B93E7F5102132D42E84E7FC8A2C11E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 51ffb33bd1240b38d9eb33e7e81bdb2beaf484af6e14337e18b2bd25608d9bc1
MD5 b0056147390918fc71b60c6e9d61238a
SHA1 bac1649df93fc37c97a511e009d316462998942f
SHA512 ed353ea3f61701681d8fefe2de884281c44becc21e626edb0641647ba196b9f41a34592cac5045e81fbb9d2e45b97785c36d7e7f31fce4c9822da53cd7856541
SSDEEP 96:MBlbJ0d+CNkx/Fc5vBh2F8vIfjnNAHg/erBSl8h4otop59yBD9bB6BQGyv1fkbG1:M7t01N2c6AniU2ozCweGI3muCodm
TLSH
T1F5C1D875985DAC7749F2E945B2032E43CDB8612B7921BE68FAED5E0C01EB4FC1382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1e8a4934668e46c72c9fe817b34d59ffb9bdca5fecbabb20dff4c65ba949ceb7
MD5 784fb8c16a5d297538e8ecb6478f1057
SHA1 a5f07792279bd88fd726e01ed20b44a1cf05db19
SHA512 01ce7ee1c68364a7fe74b72c8f46e45496519beecc65229d81cdefa3117f594fe6a625b1c4b87b07de10461b8b1dad66e42e7bc7239196514ecfb6bb9abf2f8d
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok59yVD9bB6xGyv1T53qbKv4a:MkC01N2c6AGDDUDAz1U53qbU
TLSH
T1D8A10932586E9C7788B2C949B5522E43DEB8612BF922AF94F6ED4B0C11F70FC1381917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2672e1e85e8eea55db8eed06b1c4a41df93847b5d4e123c1781360c1130302f5
MD5 dde05e61589002160f054ec470b5e3c9
SHA1 6ab9d178101b306366975d584fc16c6a73454edc
SHA512 3e0976f5e51e190165009d8d71704cc919f36d3a0265a56d87acafbfcc836cd51cc2c3e6031f17120ddc3b903977b44612f0fa4d6e00fed2765cf2ca82498d3c
SSDEEP 96:MBlbJ0d+CNkx/Fc5vBh2F8vIfjnNAHg/erBSl8h4otop59yBD9bB6BQGyv1fQBFD:M7t01N2c6AniU2ozCwQBF+EwI3CrU59
TLSH
T1F6C11975686DEC3358F3D86AF1031E43CEB4613BA511AF64EBE94B0C11EB0EC1386522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 088befa6d2873e4e6a00cfc1f14a374963f941a2ae78f4dfa136e42beca1f546
MD5 98102486c8a07ef57a507b3355cb525a
SHA1 edfa3bcd3a6cdaf7d158112bece70a3bbc68ef58
SHA512 15914883d6d1c16b1451dc25e93f072e5b4a258f03d42b35057f54031d7222456a4f220731ac8b11f04b69a6f80c88006e4b3aee939eb60e0fa9b0d721230949
SSDEEP 96:MBlC0d+CNkx/Fc5vBh2F8vIfjnNAHg/erBSl8h4otop59yBD9bB6BQGyv1fQBFvL:M7C01N2c6AniU2ozCwQBF+EwI3CrU59
TLSH
T171C11976686DEC7358F3D86AF1131E43CEB4613BA511AFA4EBD94B1C11EB0EC1386422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download