0fa65632098500971f936fc42a95b3a8e3a4b2dc91b845f958fb3ed2551d0046

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Medical_1696230469.htm
Size 431B
Sample260925-lcsp7axzht
SHA256 0fa65632098500971f936fc42a95b3a8e3a4b2dc91b845f958fb3ed2551d0046
MD5 84444f8b9d6f6a723cf83e838091df4d
SHA1 632f99d33f609e593b9077161909664a4ec3322f
SHA512 cb98afbbb7c95d5d0679e7fe6e7294da62edcd99bf04e21986b2ee9c5c1b6f21fe6bdb571aaa3ba86113cee3c50fe0105e386c6be9ba24501b70b67fd780c156
TLSH
T101E0ABEFEC4219912D7192002B9EA338ECEF9A4314D0D40A4589F04BA886E46EAF341D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2032	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348018369623515"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4316	4732	chrome.exe	88
PID 4732 wrote to memory of 4160	4732	chrome.exe	90
PID 4732 wrote to memory of 4160	4732	chrome.exe	90
PID 4732 wrote to memory of 2032	4732	chrome.exe	91
PID 4732 wrote to memory of 2388	4732	chrome.exe	92
PID 4732 wrote to memory of 2388	4732	chrome.exe	92
PID 4732 wrote to memory of 4700	4732	chrome.exe	94
PID 4732 wrote to memory of 1156	4732	chrome.exe	95
PID 4732 wrote to memory of 4700	4732	chrome.exe	94
PID 4732 wrote to memory of 1156	4732	chrome.exe	95
PID 4732 wrote to memory of 4928	4732	chrome.exe	96
PID 4732 wrote to memory of 4928	4732	chrome.exe	96
PID 4732 wrote to memory of 1920	4732	chrome.exe	97
PID 4732 wrote to memory of 1920	4732	chrome.exe	97
PID 4732 wrote to memory of 4884	4732	chrome.exe	98
PID 4732 wrote to memory of 4884	4732	chrome.exe	98
PID 4732 wrote to memory of 1308	4732	chrome.exe	101
PID 4732 wrote to memory of 4380	4732	chrome.exe	102
PID 4732 wrote to memory of 2912	4732	chrome.exe	103
PID 4732 wrote to memory of 4380	4732	chrome.exe	102
PID 4732 wrote to memory of 2912	4732	chrome.exe	103
PID 4732 wrote to memory of 2520	4732	chrome.exe	105
PID 4732 wrote to memory of 2520	4732	chrome.exe	105
PID 4732 wrote to memory of 4232	4732	chrome.exe	106
PID 4732 wrote to memory of 4232	4732	chrome.exe	106
PID 4732 wrote to memory of 5672	4732	chrome.exe	108
PID 4732 wrote to memory of 5672	4732	chrome.exe	108
PID 4732 wrote to memory of 5172	4732	chrome.exe	107
PID 4732 wrote to memory of 5172	4732	chrome.exe	107
PID 4732 wrote to memory of 5368	4732	chrome.exe	109
PID 4732 wrote to memory of 5368	4732	chrome.exe	109
PID 4732 wrote to memory of 3180	4732	chrome.exe	110
PID 4732 wrote to memory of 3180	4732	chrome.exe	110
PID 4732 wrote to memory of 4648	4732	chrome.exe	112
PID 4732 wrote to memory of 3308	4732	chrome.exe	113
PID 4732 wrote to memory of 4624	4732	chrome.exe	114
PID 4732 wrote to memory of 4460	4732	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Medical_1696230469.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bc0fc728,0x7ff8bc0fc734,0x7ff8bc0fc740
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,6462489412651324531,7282896260103969885,262144 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,10134640904403745679,4652816246464994381,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,15899279253433791409,10852965918821789210,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13335805828029864473,16147427572970629697,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,7472224311968749722,123245686812426108,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,13050936768558740950,8332367407476899104,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4884,i,12053861586702420769,9025730915959382835,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3060,i,6194921578482361282,511974305363098534,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1813455273978553048,2200291154984650100,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,3611392470373056392,8918294494056744062,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5552,i,17888786075275968311,5575991376371279586,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5836,i,1793538735027095349,6202491739459851813,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6076,i,3377354429190974013,1285023302470943402,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5420,i,16467993448825419872,2588106901216838240,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3268,i,16632006794029836185,16627636642296582680,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5472,i,8519068151589026558,8684729111744423265,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5452,i,12886972077914156686,4446866059846718548,2097152 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,9110149167559030556,7595709992068294845,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,5297631779034793225,4239788235312037205,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,9977594377235593187,1523867735706524664,524288 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5852,i,17101367675965345138,7984187058104798115,262144 --field-trial-handle=1896,i,3661632234256277564,10649174188759943975,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 cbd16a883c1a73c8d7e7b5134a7f0c3ed715e1d7c64d6d56b0c895c6687bb777
MD5 84d8b8b67f30bda62328c6f6699aee8b
SHA1 ccfd68a6b41cb79982b48196e4547dd096ea1b4e
SHA512 23ffcd022316b713c503eb4d0a38b49877d53f1647292395ec1e6ebd2d156c016db6434d871cc68cbd8e1d6acc3062773592a94a3ba8da462bdb8829ec0a08a1
TLSH
T1A1C08CA072E51820DBA3333BEC02250D3560140C0002127F82BABE989E273B5C2DC50E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 63b6b02675e11e6ea1c2a0ce569388269140d746253b2b84f178abea295da136
MD5 930482c515a2fb574013a09c370d95c8
SHA1 409cffba43b649a8f986d1153a179ace5fdc9465
SHA512 1e4002b474ac28090c185e0b8ad81c24418c02152f27579472d3961021f17d83c61912cb5f027c2cb86a5cdf5c067030247af0f655f1e793e9f2e4d3fbd83cce
TLSH
T16361BDF7C7E4867DC91052F8AB146E1BCE2D0924532C3C16C4D8AE1BA7F28B1E21024F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 09148186a514303192742e7b52d2609dd1a1991b4f1118ec3fd8769ed8d8b072
MD5 670e87469d47e8b0e3aba8c387687204
SHA1 c34c34fb05a7bbdae37518fc80d4087a930812c8
SHA512 f69640654e6baf5ef97e74650388ff4c4d278aba949dce2c21f895e5eed2091d9a983feb8db27394b6e11886a5ecfab0b4466e4d1085bb91b345785136bc7d20
SSDEEP 192:7ROiTT+rv7ALvZPRp0XOyDs9BHsb+WNjeemlPBhUeQlWIVyIsnAUgE:7ROiX+T4JXFZDwYPEFE
TLSH
T1D842B72EEA14397B4CEFC21AF9667B57E2F5102125D02E84EAFC893D14E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b5d9d05bd042a069c5d89b4a5dc35dabd074d3a72b508b3b4ebef9f417a4dfde
MD5 bac3b8b3626bdc5e221314d7b2b78058
SHA1 e80b21c2bef17c992a37569fc47f34d0592b007a
SHA512 cfac42a91e9a77502e5ef1ad3b1984e5258b50ca92765f4bd73caaf8d32e7a4c67bc1799bd632cddb092c45ed985de7a9acc806f4917d6e088ac52052fab9477
SSDEEP 192:7ROiTT+rv7ALvAPRp2XOyDs9BHsb+WNjeemlPB7UeQlWQVyIsnAUge:7ROiX+T46XbZDwYPCje
TLSH
T15942A42EEE14793B4CEBC21AF9667B57E2F5102225D42E84EAFC893D14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 c0aeb1752aa0a030669b4d0019a8bc9a3bc19bd84f623de3ab6fe2cd01938575
MD5 2d8c8e4fcf012ebb46f7d6f5fdd11fbb
SHA1 013fd6fdc494fb55a6fcf3fc5527e54497f83b47
SHA512 cef3944977bb8f7d662ace8882bbee70b3884ba877de963c5b16eb0ff489fc001f639d669cf17add4fb6ca2b3aa498bd0539d47b81d20b8563cdb7ff7749ad96
SSDEEP 192:e+R4K6v77KxkXqK4I40pUZNCgVLHrKHfFKslEUWgXzKD/Y3+ErUkKN9mZVaC66/G:XRjg77KxkXqKf/pUZNCgVLH2Hfgslwga
TLSH
T1A132E927A48D9A7F0FD8D509CC576F8FACB5029272780D2456FB9C0803A578E124B6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0f54fc9b3854666cbf745a25df733a1e035b9be46734d072ecae8dc78f5c8165
MD5 b408caaff13a7a5b11e31917ff47a171
SHA1 6e3041d2ae951d901febedc4413f15e57643c5ac
SHA512 e4bf94ebeee7d6285cc365e507784f28a3615c12748e738a604958a2d68b6d960ddf4ccc62aecd157c7a9f38a740c13b3b13ada1ce0cea551ccfb0fd4df11c52
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIOMMSl8h4otop5XYDEB6rGyvzecdtvO0A0wW2HLiV0j9i:u1t0t+W1IwiU2eoLLcdtaW2HLiVUx0
TLSH
T1CEC13B74A46D6CB758F6EA45B1032A03CEB951AF68515F94DEE95F1C04E70EC1383133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7835d2bf6d7caabc0b6672e95731a4581f048bc2f598048f1734bf66b744264e
MD5 41daee8292c1db87f04859a93088c86f
SHA1 9cdca55ecf8cdc3905f8f3ae59a9e2cdea13c9ac
SHA512 9b5b06a292cf02cc840802567b8cee8baf3c6c9aa1d368f3d5c61c4ad3d2d7b125c5aa7185c7162fbac1278420cc9da4352a6a125ee65705871d3cd2cedb081a
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIOMMSl8h4otop5XYDEB6rGyvzecuT1LiTRNC39ISyVNG9:u1t0t+W1IwiU2eoLLcuT1LiTuC8j5
TLSH
T193C1F675A42EACBB49F6A985B1032D43CAB952AB78157E58EDE91F1800E74DC0383133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 17cdd5e90fae171dd65faceae54440b4eb3218f3c1415968ce40eff6f13b0419
MD5 2130037016c6bdcca4b06daa02fd804f
SHA1 65ad834aa34c2baad015e8b80f946c61441fbf4c
SHA512 dbd3d8d27c62d15015220e4a1723d3babb2c391ac305e42861a66060ea5737b984a362c7602b6be6d35dbd1a31e71560b69d859ec1be96a3e21a3be07d5128bf
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5XgNDEB6ndGyvze9aijbfEv4a:uFC0t+W1I04DUDMo4wL9aijbu
TLSH
T1F9A11931E52D88BB58BAD945B1533A03CF79A26BA8215F84D9ED6B0C04F70EC0382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 60da6a8db7b2287751e1ec8c7382f4445d90b56d48caeea02411a6171c0dd948
MD5 02ebc5c1b1a500f3441cf164575bb2f0
SHA1 90881f3c1a714d64657091bebc1493ff952eca52
SHA512 523749a390f74171ff21d4bc00264f5bf7bf94befded5251334c13cbd0705d4c4c584b8308220d0811f2cc449122f80defea50125f4754d9347b5b3e3e3ae08b
SSDEEP 96:u1C0d+qs7PiY+3oDfAIOMMSl8h4otop5XYDEB6rGyvzecdtvO0A0wW2HLiV0j9I/:u1C0t+W1IwiU2eoLLcdtaW2HLiVUx0
TLSH
T17CC13B74A86D6CB758F6AA45B1032A03CEB951AB68515F94DEEA5F1C00E70EC1383133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download