e538783d4bd9b8f5041cb228ef9d7c12262f152e0538fa86058dced135806137

Analysis

max time kernel
300s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 2KB
Sample260928-qs46davy3l
SHA256 e538783d4bd9b8f5041cb228ef9d7c12262f152e0538fa86058dced135806137
MD5 500ac7cb725ff867fe93847ab33fdfef
SHA1 c330f6e065f36a8cb5c9a6109bd29a080af7f96a
SHA512 1f8b75e8e4a96b1b1d28a097040f7dbe4f12941b410ff8ac6fc239cb367cc84155064e02be828533f91577abcd2f8abcf082140ac0c1e1c3a62882b7452b2ac0
TLSH
T1CA51C761F216893D1E23C7F0ABD9F3677071C391C6971ED1B0389329ABE9805779326A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4700	1224	chrome.exe	89
PID 1224 wrote to memory of 764	1224	chrome.exe	90
PID 1224 wrote to memory of 1924	1224	chrome.exe	91
PID 1224 wrote to memory of 1924	1224	chrome.exe	91
PID 1224 wrote to memory of 2636	1224	chrome.exe	92
PID 1224 wrote to memory of 2636	1224	chrome.exe	92
PID 1224 wrote to memory of 5308	1224	chrome.exe	94
PID 1224 wrote to memory of 5308	1224	chrome.exe	94
PID 1224 wrote to memory of 3108	1224	chrome.exe	95
PID 1224 wrote to memory of 3108	1224	chrome.exe	95
PID 1224 wrote to memory of 4252	1224	chrome.exe	96
PID 1224 wrote to memory of 2200	1224	chrome.exe	99
PID 1224 wrote to memory of 4796	1224	chrome.exe	98
PID 1224 wrote to memory of 2200	1224	chrome.exe	99
PID 1224 wrote to memory of 4796	1224	chrome.exe	98
PID 1224 wrote to memory of 1572	1224	chrome.exe	100
PID 1224 wrote to memory of 1572	1224	chrome.exe	100
PID 1224 wrote to memory of 5408	1224	chrome.exe	103
PID 1224 wrote to memory of 5408	1224	chrome.exe	103
PID 1224 wrote to memory of 4076	1224	chrome.exe	104
PID 1224 wrote to memory of 4076	1224	chrome.exe	104
PID 1224 wrote to memory of 2392	1224	chrome.exe	105
PID 1224 wrote to memory of 2392	1224	chrome.exe	105
PID 1224 wrote to memory of 1252	1224	chrome.exe	106
PID 1224 wrote to memory of 1252	1224	chrome.exe	106
PID 1224 wrote to memory of 1740	1224	chrome.exe	107
PID 1224 wrote to memory of 1740	1224	chrome.exe	107
PID 1224 wrote to memory of 4344	1224	chrome.exe	109
PID 1224 wrote to memory of 3196	1224	chrome.exe	110
PID 1224 wrote to memory of 2680	1224	chrome.exe	111
PID 1224 wrote to memory of 4984	1224	chrome.exe	112
PID 1224 wrote to memory of 1072	1224	chrome.exe	113
PID 1224 wrote to memory of 1072	1224	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb13e2c728,0x7ffb13e2c734,0x7ffb13e2c740
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2091439055365637937,17481132201322005134,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1894195892047088817,8558415054334285434,262144 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,5966435061407516922,13878548893090670252,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:13
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,15707612305803890686,5569757793712684166,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,13503586483089175281,2479042228240498186,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,13707822834364948688,645652431140092516,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5268,i,10738541721399461778,15709983330794238023,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5292,i,13574392763339452997,6805934965304091018,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5268,i,8456272689540882410,16854834678463934023,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5764,i,6940531954554425804,11009112154476093018,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5332,i,6644648082419840392,11885475858187351743,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5592,i,6250664286137585571,5478424646962029125,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5672,i,7123619210386989940,9409726148161367791,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5232,i,13644166827538886769,15042244398866555874,2097152 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,3209038249062344138,3913680861665002392,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7362986961742764233,3960750298101100363,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,13234017576992172454,12615548218591803864,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5872,i,10158750812390575926,16342318693005198801,262144 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=1128 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,17842464784950095577,8626261242664801584,524288 --field-trial-handle=1936,i,9388333061194484736,10302064088298557918,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:14
  2⤵
  PID:1072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 888b59555d97e39842874a2d9093b7798fc8f7d748b36f420d8d4b3688249e78
MD5 d5a9c4421337cf6c3e409adfa97055ec
SHA1 380ac704f37192c603805d94fa19c5c858e70190
SHA512 8423d761c9f3e2794f645f4bba6ebe17601abb6198495e372a81b3315629b027c53b061f0fda68d3068f7582553ce31bb8ce32be9df92af95b034a057dea29e3
TLSH
T11151AFF7C3D4967D880256F59B256F1FCE290A14532D3C27C8D8AF1B97E2871D24024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3e82680bb4fba38c591cf76cd02cb580018c01fe049a97028ece8142f43c959c
MD5 469f9c346080fdbb28b1a8c7c6ff3b9e
SHA1 722bbcc43acba270ec9b48f81a398b0d90b8ef1a
SHA512 9783085d5be2f7eed70a3e60c0c45fb02b7ed0d33c8136a45d95ee441094cefeb1108c14bd3ff0e254ba979e5c49946eeac748158d4d1f4d366718dc27997683
TLSH
T1C551AFF7C3D8963D890156F5AB256F1FCE2A0A14531D3C17C8D8AE1F57E28B1D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d99614f818fde44b9d9aa206b507a5995e0053374445d68b8eca611028fe4668
MD5 bd509e5abcb0cade3f042d8773cb8506
SHA1 ad58ff7baa0cc058fde1a803eecdbbaf776ad978
SHA512 14159d12a75ea319669c641e18075cac22dddb50f6811373c3c781ca6cdca0293bba2ec6318109c62734c12fa792896f08e3312c4c4ed7a563cc7ac216ca0a72
TLSH
T192417CB7C3E4967D890156F5AB156F1FCE2A0A14531D3C27C8D8AE1B57E28B1D24028E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 85df43e97e475e7d1ee77c126dcdc9dfa483bd17e4e78d16a35ee35a03bae5df
MD5 69cc92fd797cba7ee898ecdf84e01642
SHA1 09d4edb34c058dc1c45f77a62ab771431e71f669
SHA512 c53cf342cc5f0922e11f91e56863894f03fb9f1a65dd1588ef3e680d704b4bac214797467f125ca9d442da74c8fd887821da31aa3b45e2731055d14d7fbfd065
SSDEEP 192:RReIDBDv7YvAPRp2S79xHsb+WNnhvPIiX9EkwQVyIsnAUge:RReI17k6X7DwBPxu0e
TLSH
T10232942EEE60797F4DDAC22AFA257B53D7F5202160A42E84EAFC893C21D75DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 10143f4957ded3cd63dafafdb43edb7ca9b71fe0cb6bd1e2c4168f68a953a9da
MD5 5c728c2764400b8cd21bb22b9e40bd11
SHA1 47f7d9e2bfaab8c7acf8b8c57e0676bdadb94274
SHA512 a871244c4412c76bf65c316b813e1527c1fe35bfc0d58f44c93fa9bd99906df7895fbc237cc2492f298bac085a586d1941f7cb308893761dfaa3482155e40bf4
SSDEEP 192:RReIDBDv7YvhPRpNS79xHsb+WNnhvPPiX9EkwgVyIsnAUgE:RReI17khXuDwBPiuEE
TLSH
T16B42942EED20797F9CDAC229FA257F52E7F5202160A42E84EAFC893C21D75DC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2997464207ac49258a1ce9f587b03f7d9b85cfbb72b8a0e0d1e5c76194166aac
MD5 8894cd1d52ea1f95001b968d29712a34
SHA1 b0fc4725e0c77c3e47aadb684281cd893d4bdcb0
SHA512 e72d941c0d7af59df9262b188dc6f968d1fca8594d4539178ae67a341059e1dceab79eeba06153c92a9d361d4728f1f6209eb70c4729902e0c4a62f56b18ba7c
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVCsoESl8h4otop5WcDKB6NGyvoD3EFq1BpcRNC39ISyVN5:Dt0ESKkaIiU2Zapp4Fq1BpcuCUyzR
TLSH
T1B7C1F870A86DACBB5DF6A996A0032D43CEB8306F9959BD58F9DD0E0800D74EC1382977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 73fe093be8a4373a53400bfa0794e9720805ebb2221f5673a4140f41d22774e2
MD5 2689ef34f83c55eff8120b29e1c08a1b
SHA1 5c979592999fe697cb0366186f655281747028dc
SHA512 cb6bfbc65d2a9c8c408bd1204cdb2b8b0f9d7a1d952a16073de5759983daa13c2b092f73e2b5cdc25d55e142b9faebf39d3222b6dd0540e0ba800abbbb0ce6c5
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5WhDKB6FGyvoD3Emwp+Tbv4v4a:fC0ESKkdDUD2aBp4mwp+Tbvi
TLSH
T1FDA1F831E8689C7B59FAD889B8436E43CFB8307BD462AE94E9DD0F0814E70EC1342567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f027d8da490deb707fc1c2f9f38330b009cb4c8182635fb65ab38d33c28fff01
MD5 173fd05182566b71591af9b5e4faacdf
SHA1 f10104071c91bb33550afecf1eec7c5b1e97dd70
SHA512 38f9e1a6c2748272f4016f1624081d0deb743db9d55a01d28540d62bff434dbedba8245745f00c303e16e94806f640abf20d1eed5ed8c01e6f74f9e1ddb1aaf4
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVCsoESl8h4otop5WcDKB6NGyvoD3EFH0p1QzbpXKZQ3Bpl:Dt0ESKkaIiU2Zapp4FH0cZ3BpzU6X
TLSH
T1C3C1E875B86DAC7759F6A5A2A4032A43CFB4207F9541AE94EADE0F0C15D70EC1342937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 919bb12af137752b528759b9fedbbc1bd89d7b5ef4b370fe7d853cbf4b1e30c7
MD5 63617b5074b772aaf76271f217d349d2
SHA1 fb3fe4763d86ccab7989dda97a5d33f492ae14de
SHA512 1da10634a879eb460a8d4453fe0f30e9a88e91ac557e0d1c2962c579e1540d90a9d3c4724f58fbaecb8af04a4c0250f6ecd0c3ba9a105b62eadf42ea751f1fc9
SSDEEP 96:DbJod+7N0X7jVYVfGTVCsoESl8h4otop5WcDKB6NGyvoD3EFq1BpcRNC39ISyVN5:DtoESKkaIiU2Zapp4Fq1BpcuCUyzR
TLSH
T17FC1E870E86DACBB5DF6A995A0032D43CEB8316F99597D58F9ED1E0800D70EC1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e380709cb62e7e1964e30e861aedd063e802f21fcf66386f8199524c4c26f67a
MD5 10d673eefc9a44868b5f76d4437e13bb
SHA1 b752757f7469a512e1af3ac2cee85f36745dcefb
SHA512 99259e7581ab22e6b77d7f3ffb96928281ac49c8cdaddf2a291c7f8ae26cd8273e70055086deb6dc62ce2bc198de273364f1e1ee1f30a9893fb246d6713ad146
SSDEEP 96:DC0d+7N0X7jVYVfGTVCsoESl8h4otop5WcDKB6NGyvoD3EFH0p1QzbpXKZQ3BpzB:DC0ESKkaIiU2Zapp4FH0cZ3BpzU6X
TLSH
T1F1C1F875B87DECB759F6A5A2A4032A43CFB4207B9541AE94EADE0F0C15D70EC1342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download