37b14c3ec6e804a213fd42ea71a3426c907f3cdf8af590cc3c8a24e2eb44f2a8

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
desarchivo-2473539_Edicto.xhtml
Size 6.9MB
Sample260929-qy4rss1erd
SHA256 37b14c3ec6e804a213fd42ea71a3426c907f3cdf8af590cc3c8a24e2eb44f2a8
MD5 46874c38e186f0ff6124bca5d9ecd8ca
SHA1 2c29bcb96ac3bbcfadac6508fa1516491e29f644
SHA512 6ace862d8c88f6c3dd6856be875c071624cf83957842bf4ac221f3108efc6c587466be757711d0e3a0a478f9e5316a9f9785296c358b4c57be5c619cba2df484
SSDEEP 24576:CvR1uPTHObSFII+wunJcNXMOGWyVX9PtEeNUdOyZmbm/P1x4XJjAshbsS7Rjpwzo:E6PTHmSFIIH2
TLSH
T1E976AEF5B504BDE5A76F532BD5A96E8903741733898EE9CC407877C30A63362FE0A849
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2820	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 944	2016	chrome.exe	89
PID 2016 wrote to memory of 4136	2016	chrome.exe	90
PID 2016 wrote to memory of 4136	2016	chrome.exe	90
PID 2016 wrote to memory of 2820	2016	chrome.exe	91
PID 2016 wrote to memory of 2136	2016	chrome.exe	92
PID 2016 wrote to memory of 2136	2016	chrome.exe	92
PID 2016 wrote to memory of 4396	2016	chrome.exe	94
PID 2016 wrote to memory of 1412	2016	chrome.exe	95
PID 2016 wrote to memory of 4396	2016	chrome.exe	94
PID 2016 wrote to memory of 1412	2016	chrome.exe	95
PID 2016 wrote to memory of 1760	2016	chrome.exe	96
PID 2016 wrote to memory of 5512	2016	chrome.exe	98
PID 2016 wrote to memory of 1112	2016	chrome.exe	99
PID 2016 wrote to memory of 5512	2016	chrome.exe	98
PID 2016 wrote to memory of 1112	2016	chrome.exe	99
PID 2016 wrote to memory of 3476	2016	chrome.exe	101
PID 2016 wrote to memory of 3476	2016	chrome.exe	101
PID 2016 wrote to memory of 3736	2016	chrome.exe	103
PID 2016 wrote to memory of 3736	2016	chrome.exe	103
PID 2016 wrote to memory of 704	2016	chrome.exe	104
PID 2016 wrote to memory of 704	2016	chrome.exe	104
PID 2016 wrote to memory of 4576	2016	chrome.exe	105
PID 2016 wrote to memory of 4576	2016	chrome.exe	105
PID 2016 wrote to memory of 4624	2016	chrome.exe	107
PID 2016 wrote to memory of 5064	2016	chrome.exe	106
PID 2016 wrote to memory of 4624	2016	chrome.exe	107
PID 2016 wrote to memory of 5064	2016	chrome.exe	106
PID 2016 wrote to memory of 2888	2016	chrome.exe	109
PID 2016 wrote to memory of 3504	2016	chrome.exe	110
PID 2016 wrote to memory of 52	2016	chrome.exe	111
PID 2016 wrote to memory of 4660	2016	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\desarchivo-2473539_Edicto.xhtml
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb7c96c728,0x7ffb7c96c734,0x7ffb7c96c740
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,16929221683187435965,4809867851687249823,262144 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,5821085653524129,8963122753936251361,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,8138424447849160572,6030997513237269757,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,15408706057878325737,11754315827996145046,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,7176368042957819953,9847821848861681310,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,13290638945645813674,1792202645813979096,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5308,i,2916476323698764401,2373299683425963764,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5336,i,7625186703038968685,3507940526331476031,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5532,i,15323430087032789362,7886697713474027794,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5328,i,8805118791660334815,6823102741407618925,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6068,i,7845795809112026600,15576793805733898532,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5776,i,6995236939394119554,10771420513259145972,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6200,i,10822138964636969282,3710347789635217651,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6332,i,5761759537977538939,6930399295799407428,2097152 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,1107569568122473733,8661888957155588967,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,10215116307960106634,14844655375140583412,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,4290359217827340004,2986808886445629828,524288 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:52
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5744,i,281151647610473364,17931453294153581176,262144 --field-trial-handle=1916,i,1119599304264543208,15413984695455719272,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8a90572d49e93f51f356e447e3c55a431e328ca9c5093de0c8a720540d22579f
MD5 e6f53b393159e36a6e390f19cf0c7ab1
SHA1 62bbac20a37a7e77fc9dd02b6f1295fcd1c641c5
SHA512 bf4e051be02d4fbd34887ca84c623098ed89339d749778cff3058b736f7c234139bce6e068811123931a68c12199a1457e613a0db43549bb25d4c22519c6cc36
TLSH
T102418EF7C3D8967D890156F4AB15AF1BCE290A14531C3C56C8D8AF1F53E28B2D21069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 415d1a925b87a297fe63928b7270335625ccc11f29841380a49208587bc9cdd1
MD5 29aac23321036436b33439190f113294
SHA1 919c5982bd543771554f13536599f6c66058d881
SHA512 57be48526c101092d1b3db66338d2d20d36f5f9a1e97a853897cc392e936361c2cd3f241ef132df2b20d737e88389d3dcf91d9de95384be288c482d1d686236f
SSDEEP 192:vR53AT1Sn30v7DvAPRp2DU9bHsb+WNnmzPZeg9AckwqCkVyIsnAUge:vR53E1Sn3w/6XfBwKPZHXKCge
TLSH
T16C32B42DEE10B97B9DDAC22AFA667797D6F5002161902E84E6FC892C10E7ACC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 134c04d8dcdd1a39719fc7bc55520c325c278543e6814aee0cb70169cae60f5b
MD5 e6a8440177d33fcec574829b544be26a
SHA1 35b74eaf06a5d10a7c98783541f1251c6061aaeb
SHA512 1f680e1d39dc8b3204b124aeee8c54b33a06e4fac0baf33c62c5f856442b9b65f3a54ab119dcf41e6858fe3ec5273ac7c3649b569e6479dae96a33ad876b0c62
SSDEEP 192:vR53AT1Sn30v7DvvPRp3DU9bHsb+WNnmzPYeg9Ackw5CkVyIsnAUgE:vR53E1Sn3w/PXIBwKPYHXZCgE
TLSH
T1A742C52DEE10797B9DDAC329FA657B97E7F5102161902E84E6FC892C10E7ACC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c6988656d48061566cfb6d666c96fbc09811b26601a0e517114d3dec811038dd
MD5 12b17afb932f2ad89a0f318d476f9418
SHA1 204b6833ca145783710bad84d5ece9d4c5b90359
SHA512 c7540dd45abb64eba0ffc316684e650723d6158124830dcd4137ef04b507ffa1629ad8824394aff20cf07b21046f6daa1072481c8b471907f79348bbb4b71087
SSDEEP 96:oC0d+qJw6eq8Em6eifKcIzIXNMMSl8h4otop5+dDVB6IGyvQH4Q8TBlanJEi0j9K:oC0xJPz8/CkRQiU2er4r4Q8WnJEiUK
TLSH
T148C11B70B87D9CB358F3D591B1432607CEF46167A615AE94EADB0F1C01E71EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 099ff3efccc5a1c056fa5627cfb60157a2f380d14a7676fda222971a5341b831
MD5 0f49e597b5bb3d15f5d911c858f39acd
SHA1 e21978a4317ca80440083b51cfea435137fefa0d
SHA512 9f0a7aab7a9e5aa3abf3430889e75686f735078c9e4fbcaaf69204a6a222a174d0b7661e87e9ac22cf16efb1d430348bb569619c52262a3b16303d6fb3bf211f
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzIXNMMSl8h4otop5+dDVB6IGyvQH4QvlJEERNC39IF:ot0xJPz8/CkRQiU2er4r4QvlJEEuCmQ
TLSH
T16AC1F970A86D9DB75CF6E495B1032D038EA8615BBA147E54FDDA4E1C00A74EC5353623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d9383065c60a4408441b59bf5342ad8b9f884be70577600c7c0ed9ed5c1a87fb
MD5 ce29c715febb0892f99dcd9effba3d71
SHA1 482a38612adf72aa92e9780ff9e758d40e1c3457
SHA512 57301e6a4665b4ab7f789ac3a1d00afd10fad82e8d21c86fc53bfb127d8b01783a561afbbc7e9df0de340523d7108215d32d7e4c8d484eceadfc26de59c282dc
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5+8DVB6vGyvQH4jYE0bblDv4a:qC0xJPz8/CkqDUDprfr4jYE0bb1
TLSH
T133A11931A8699DB798B6D585B2422A03CF64B197E621BFC4B9ED1E1C10F70E81342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3a1964746702e83f5e1c29f2c9fce6f47775ae7b61feb90b82508713959e4728
MD5 4bfa3e26e1fd6ccda043d2bc03a90623
SHA1 984f9cb9c7544f372231691c501c014167455ac9
SHA512 c002352cb0236b0232eaad531f567df56d5da320d8d4af32304e82a0fcbec9553cee0c55c6233bc2319e0dcf668ab3bfff9c0aa2370bc620e04af0f2005f2f99
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzIXNMMSl8h4otop5+dDVB6IGyvQH4Q8TBlanJEi0js:ot0xJPz8/CkRQiU2er4r4Q8WnJEiUK
TLSH
T1C1C11A70B87D9DB358F3E5A1B1432607CEF4616BA615AE94AADB0F1C01E75EC2342633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download