b4bc128eedac32f1f4517739be640dae99295b21846b98a511e3265b65804f34

Analysis

max time kernel
600s
max time network
594s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 285KB
Sample260905-ysdbnaythy
SHA256 b4bc128eedac32f1f4517739be640dae99295b21846b98a511e3265b65804f34
MD5 499770c470acdc1f4c9f8c066e7bc00d
SHA1 e9b31743555b34855efc2f846a8c8014e8d6d557
SHA512 b350955350c41696498195692070748998bde865d1a7425639405fa0b2b9c816d437a26e85dc3788322136a7371348f402c6465014dc8d9d72699c37111d8ef3
SSDEEP 6144:MDntbSpZwm4fjrTMjZTXF3ft17CKgs9JU6Acu:EntbgZwm8HTMvG6Acu
TLSH
T14254F9E1BA731539253F23BEE01BA30C21679753D74D26E1F4B8805899E4F9235E3A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331121927847354"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 1416	6112	chrome.exe	88
PID 6112 wrote to memory of 4296	6112	chrome.exe	90
PID 6112 wrote to memory of 4296	6112	chrome.exe	90
PID 6112 wrote to memory of 1516	6112	chrome.exe	91
PID 6112 wrote to memory of 4968	6112	chrome.exe	93
PID 6112 wrote to memory of 4968	6112	chrome.exe	93
PID 6112 wrote to memory of 5796	6112	chrome.exe	94
PID 6112 wrote to memory of 5796	6112	chrome.exe	94
PID 6112 wrote to memory of 4064	6112	chrome.exe	95
PID 6112 wrote to memory of 4064	6112	chrome.exe	95
PID 6112 wrote to memory of 4684	6112	chrome.exe	96
PID 6112 wrote to memory of 4684	6112	chrome.exe	96
PID 6112 wrote to memory of 832	6112	chrome.exe	97
PID 6112 wrote to memory of 4104	6112	chrome.exe	99
PID 6112 wrote to memory of 4104	6112	chrome.exe	99
PID 6112 wrote to memory of 2036	6112	chrome.exe	100
PID 6112 wrote to memory of 2036	6112	chrome.exe	100
PID 6112 wrote to memory of 1172	6112	chrome.exe	103
PID 6112 wrote to memory of 2660	6112	chrome.exe	104
PID 6112 wrote to memory of 1172	6112	chrome.exe	103
PID 6112 wrote to memory of 2660	6112	chrome.exe	104
PID 6112 wrote to memory of 4764	6112	chrome.exe	105
PID 6112 wrote to memory of 4764	6112	chrome.exe	105
PID 6112 wrote to memory of 3100	6112	chrome.exe	106
PID 6112 wrote to memory of 3100	6112	chrome.exe	106
PID 6112 wrote to memory of 4796	6112	chrome.exe	107
PID 6112 wrote to memory of 4220	6112	chrome.exe	108
PID 6112 wrote to memory of 4796	6112	chrome.exe	107
PID 6112 wrote to memory of 4220	6112	chrome.exe	108
PID 6112 wrote to memory of 4340	6112	chrome.exe	110
PID 6112 wrote to memory of 3748	6112	chrome.exe	111
PID 6112 wrote to memory of 5468	6112	chrome.exe	112
PID 6112 wrote to memory of 5016	6112	chrome.exe	113
PID 6112 wrote to memory of 3944	6112	chrome.exe	114
PID 6112 wrote to memory of 3944	6112	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbb995c728,0x7ffbb995c734,0x7ffbb995c740
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11699783519540794583,14428577248271319995,262144 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,10531225624537230250,12076867884818677604,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,15117769476913749757,16593935810243123331,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,13858830668371551279,4839992216015872072,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,7977540164238956733,12814889487026351670,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,6521264359180604805,13457769076914644143,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:12
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,13723738473974836038,2168828526204404889,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5768,i,15632832039246873496,16699081481559823306,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5824,i,13989869303758774502,4735005182393070689,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5856,i,7629478274774940324,10896033039462579658,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6076,i,4235278125338137489,865065780943503903,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6116,i,8067001025818695462,11898735608670974557,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5888,i,5503606905634241011,4247027704090750360,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5792,i,11925144923270459054,5950190379412205494,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5908,i,13170626380272121083,1228917273959114157,2097152 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,11466058077037083476,7704895388391355556,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,4010057553666247523,8407174369110027674,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3176,i,5227900421902833051,9965565471123454253,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6004,i,9817646936208213729,8185870992010075401,262144 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,17996466522229332697,10105924445161470422,524288 --field-trial-handle=1900,i,16748620507736017681,2124524559945447816,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:3944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

88bf996a-164d-4269-b0d5-72e4dda1e263.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\88bf996a-164d-4269-b0d5-72e4dda1e263.tmp
Size 11KB
SHA256 f93f867aed6fdd4efe723a23efc9ec995a4143bdd1fe0ad6bad29ce78cdc7d1f
MD5 e1f89343be87188fe80b095e9ba7a424
SHA1 f07dc9e86f4e2636a80150f400a2394a2fce1731
SHA512 65ba0049732a60c12305e5cc1da3fdfa30ae45fce46926bf1d6f1d6c249951f9c67c86d02a3972d4c7426106e8ada13b358efa94cf29f12fb22f0663b196705a
SSDEEP 192:dRUXb466v7DvAPRp2r0964Hsb+WNn01PHU23zgekeahyjVyIsnAUgR:dRUrFWH6XTbwaP023zHah6R
TLSH
T19532B73EB964697B6DCBD319F9253B97E7F9102221902E84E7FC492C11E79CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d2785f5152b02c49e044dbfe2439316f6fbe7facfb72a74ff2918281046750c
MD5 b82aeb0fe7b8b419394f4d2d7aa7c71e
SHA1 c0d8ec372982d2f6fb8c5dbf392bdea49e1bbe47
SHA512 bef011b4453073fdb253250f5ee9683f5ef88207313f4e16e0eb0008ff4727e40792fb225797f2a99ce90f02271228f1834d1b05ad4bb8568eb529146b05d69e
TLSH
T1C251AFF783E4477E8A1152F09B15AE1FCE7A1516032C3CA688E4AE1B67E25B1D20139F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 48de547e3d3bc352bb87a054e3598b013c2cc51355762fb43bb49c093c92abc0
MD5 2559b18e52afe50531606afdc7689b38
SHA1 07e29dc43d811fc9d0a25ee4a4f0b8c0deb0e0ca
SHA512 50fd75e64b8be850822a9dc9b0036e196d628d958c2efefbe7ebbe40d13a91e378cfe74a3a875810dc9a164cbd702d4cafd2a8f06b7692df8f2fb537e450e260
TLSH
T17351AEF7C3E8867E891152F09B256E1BCD3A0516032C3C668CF4AE5B67E2571D10139F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6d9e5283f5c9ab8f620edd4a0b655e0a24b08b2232390820721dd2484e0c99d2
MD5 25f7e4e6efeb35be9964f8a09e72acde
SHA1 8d787deecba97731235fe2f936b610d2271b9de5
SHA512 e62f57e8cb56351a83569a06ed42977a09d9458a71fac616eef32074edd850225c4f1a810aa5abc17ab1c662973f8ef354ac6665fb5a09c438cba792480e7b0d
SSDEEP 192:dRUXb466v7DvLPRpFr0964Hsb+WNn01PfgU23zgekeaZyjVyIsnAUgE:dRUrFWHbXmbwaPfF23zHaZ6E
TLSH
T11642B73EB96469776DCBD319F9263F97E7F9102221902E84E6FC892C11E76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 481233128c68c83d4311e1c5a0f0ea007a9c32d922ee39fe1ce98db615424d46
MD5 5ce2cac6f8156c7c680deb39fbde90aa
SHA1 db3146cd3e49fc9ce28f5fa60658bea75cda98b8
SHA512 c6422bb76002207a5134268cf1de0d0d3bc9021d89c4c872fc70d7acd406f88b0ea1339d3b49c53cda4a11644f2d9b41c38f5fff411363fc767d266797e44220
SSDEEP 96:nbJ0d+cAOIt5aDVmufj7ScVSl8h4otop5SpD0B6WGyv9JtFiO0AuSwJSDlj0j9IP:nt0LA/TE57BiU2046+tFGSwJSDljUZvQ
TLSH
T198C12870B86D6E736DFA9550F5427E87DDB8A05BA9216E8089EE4F0C01D74DC2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e86da480cf5b659972b71349be9474bf337bd06772a7cf7be89a3f87dbb6413e
MD5 8c7c7444b450aee05e478c0af01c11d4
SHA1 c27a19218416e29501e575a13f9949234d3edeee
SHA512 7a670a1bd3a0aade8003381b2c0c627850859438a5d8d39842dea2f620bc2f51f5760d60a5713768795864d1e291b3fa3e10b1355b5e10fe76017b43add7a903
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5SCD0B6/dGyv95Slhbb2Jv4a:gC0LA/TE57cDUDF4UweSlhbKl
TLSH
T164A11971B4685EB75CB9C544F5827E83DF68A117A9217F80D8DD1F0C11E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0eba1cc885a90eeb86cb6c5f3e342594058cf5eec5d6f6dd23c224fba25daef8
MD5 3e3d46c5b4211c1a6c0b11fb2c240f00
SHA1 b5689d94b844e391f854b3b59f5e4d46522856de
SHA512 00c5170021648d368129f64e14a29a18b57f8eeb01ed83f7e622bd9efd824a971bde7dc588a5051eff545eeaebcb94469e4836bb32b7a737e7464fd8e02eb525
SSDEEP 96:jC0d+cAOIt5aDVmufj7ScVSl8h4otop5SpD0B6WGyv9JtFiO0AuSwgtDlj0j9IKY:jC0LA/TE57BiU2046+tFGSwgtDljUZvQ
TLSH
T1FBC11770B86C2A736DF69550F5877E87DDA8A15BAD216E9089EE4B0C01D74EC2383A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 146f2016bfce64b1940330b23a1e5e1609a00c0187fc1153069f8614646e032b
MD5 dab47ed05991d25f1ae6e69c23ece133
SHA1 f0fe57f6b54bd7fc2acc611c8b59faaaf455fb2f
SHA512 bdced8e1fae725cda10e469dd6344d40d043b9653be700ecf3df183d7f2f53cfc5df0f176806b77ef48f7c25f95cf2aa02f52b87cb44de98344d5bda7079762d
SSDEEP 96:nbJod+cAOIt5aDVmufj7ScVSl8h4otop5SpD0B6WGyv9JT1QDlvJRNC39ISyVNC4:ntoLA/TE57BiU2046+T1QDlvJuCMJG
TLSH
T13FC107B0E46D6DBB5CFAA455F1433D83DD68611BA9153E48ADEE0E4C01E34DC1393927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 998fae00240ca9b1f0655246ef910b52eaaaf15da336d3972ef58e8353d9c773
MD5 86b55dac4ad59f2bcfababf9e330a390
SHA1 1c6c291b4ac08dec12c9d2be035d4ba2eb6be253
SHA512 30d5ba7ca42148a786b466c69f98f613379f6fd99797d5e9a7b0d78f078a0e70db4f4e0c5ec8b9d236eb5b2760662c4b25dcb14b2ee22173adbf0bf3656e9f3a
SSDEEP 96:nbJ0d+cAOIt5aDVmufj7ScVSl8h4otop5SpD0B6WGyv9JT1QDlvJRNC39ISyVNC4:nt0LA/TE57BiU2046+T1QDlvJuCMJG
TLSH
T10BC108B0E46D6EAB1CFAA451F1033E87DDA8615B69257E44EDEE0E4C01E38DC5393923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download