9438609dc13afee60f90e6dedb7ede12f7f41e906c7e75b8dad6bba5eca51412

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 14KB
Sample260929-qy4rss1erd
SHA256 9438609dc13afee60f90e6dedb7ede12f7f41e906c7e75b8dad6bba5eca51412
MD5 2af2ddda56d4e7f4432ee855b919f22a
SHA1 3721eb758300ba0ea0aae36d884b2321cf50120a
SHA512 6e103803744f293b41e5bd64a30448be2216fba87c1d1579bfbe47337a0a9ae4110fc62e5e7231ba63c79f1c8d114c0c0297eda69ca5d4c55a8e76727802ec77
SSDEEP 96:ZJDuVn1rJFtJQ5/X9qlo8qixqcQo8/wZhYZhRZh4fZhYkMZhLyZh9OLDMMZhhSi8:Z8FUyosHN8kJAI6b/Agzv5KCmP
TLSH
T19E52D743F2D01D0954EB45E4A143B7BC7F3852C48B664FB874997BBE6AA8CE30252678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5588	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 716	3620	chrome.exe	88
PID 3620 wrote to memory of 2724	3620	chrome.exe	90
PID 3620 wrote to memory of 2724	3620	chrome.exe	90
PID 3620 wrote to memory of 5588	3620	chrome.exe	91
PID 3620 wrote to memory of 1072	3620	chrome.exe	92
PID 3620 wrote to memory of 1072	3620	chrome.exe	92
PID 3620 wrote to memory of 4516	3620	chrome.exe	94
PID 3620 wrote to memory of 2892	3620	chrome.exe	95
PID 3620 wrote to memory of 4516	3620	chrome.exe	94
PID 3620 wrote to memory of 2892	3620	chrome.exe	95
PID 3620 wrote to memory of 3632	3620	chrome.exe	96
PID 3620 wrote to memory of 556	3620	chrome.exe	99
PID 3620 wrote to memory of 5844	3620	chrome.exe	98
PID 3620 wrote to memory of 5844	3620	chrome.exe	98
PID 3620 wrote to memory of 556	3620	chrome.exe	99
PID 3620 wrote to memory of 4356	3620	chrome.exe	102
PID 3620 wrote to memory of 1364	3620	chrome.exe	103
PID 3620 wrote to memory of 4356	3620	chrome.exe	102
PID 3620 wrote to memory of 1364	3620	chrome.exe	103
PID 3620 wrote to memory of 1880	3620	chrome.exe	104
PID 3620 wrote to memory of 2420	3620	chrome.exe	105
PID 3620 wrote to memory of 1880	3620	chrome.exe	104
PID 3620 wrote to memory of 2420	3620	chrome.exe	105
PID 3620 wrote to memory of 4728	3620	chrome.exe	107
PID 3620 wrote to memory of 1336	3620	chrome.exe	106
PID 3620 wrote to memory of 4728	3620	chrome.exe	107
PID 3620 wrote to memory of 1336	3620	chrome.exe	106
PID 3620 wrote to memory of 2544	3620	chrome.exe	109
PID 3620 wrote to memory of 2820	3620	chrome.exe	110
PID 3620 wrote to memory of 6104	3620	chrome.exe	111
PID 3620 wrote to memory of 2944	3620	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x50,0x134,0x7ffed654c728,0x7ffed654c734,0x7ffed654c740
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,3194891699032096765,14936413603876346088,262144 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,4012966141982136279,9682209749120276741,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,2313050763160959809,12135285857325274725,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,8027899431201388943,13547665220509479022,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,3513055784383822051,15295756483313196497,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,3104617932225638969,12533057850415326421,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5300,i,12838500716923844360,190244838875780682,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5316,i,2595799616617091785,639526981211461075,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5684,i,17490890406209754913,17359315873525719112,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5808,i,1653572974412158275,7097740848136898437,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5900,i,6803025111735678034,5808680605101375038,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5368,i,3175692619499543195,1927887734917201319,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5676,i,15334730220972033413,522245666757320672,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5920,i,1425715839635606748,14651959253769865694,2097152 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,13203437992989544369,11858667226048125878,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,3176403266448266940,16770623434531916447,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,16297339553376853196,15012250171947974447,524288 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=260,i,17890360548057278175,5641310929821220610,262144 --field-trial-handle=1912,i,6248740252975336931,2644725419388343689,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1665ed6512469a06c6d5a9eee437cd6a28d08f54060b7c13250da8a9cef03976
MD5 75c116260d7d4ddcdc7005ebe589e836
SHA1 815f8ee25f0cf8b99c8765188a02f835c8b71f1f
SHA512 028dae6bca6983ffe25d9fcbc4e6f6cb78e4101ae9cfb0ee7861a6a3ca5f3c73f061af6edb4950cfc1fd64c21a267b427578ce91440442fce793ec7e0a591d09
TLSH
T181417FF7C3D88A7D891152F4AB156E1BCE2D0A14522C3C57C8E4AF5F57E28B2D24168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9f16f283d6f640c51036ed80890287429081dfd9073d7c43397e8e2c17c995d5
MD5 a46658962f685ac4b03a3736528b82e4
SHA1 4c526349e6a5da883287b5dd3aa0a5fadd00bc19
SHA512 39899c91e0a4a25ed63ac43b234ffd6823c1c9406e35dddd849bad555201d641ed11a9f4e1153dad24cd091bea6ce356e816f5239695d00cb9732912650ea3fe
SSDEEP 192:gRQ7sAUv7cvAPRp20uXsb+WNnaiPOx2q3kwYiyIsnAUge:gRqsAQA6X0XwrPK2MJe
TLSH
T18832932DED24B57BACDBD22AFE227757D7F5102120902E84E6FD892C15E79CC622740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a8a109869013c30dec939ec4dcbbbd0e34497dc4b8ead29b3d025d210f6ef1f4
MD5 dad8dcbb86e123165309e6cb5badf7c7
SHA1 dc45dfb534a02adca7c217b484e8fd08d4d8197b
SHA512 7cd83dfeae33559d84102929a2e6613966d3a2e019b14951e3ed543d5b93c5ecbbc5590354245b131d29efe097c2dca076a5aab62006e185f87ba1ff46541a59
SSDEEP 192:gRQ7sAUv7cvVPRpV0uXsb+WNnaiPUx2q3kwpiyIsnAUgE:gRqsAQAVXxXwrPI2MME
TLSH
T1E942A42DED20B97BACDBD21AFA267B57E7F4103120902E84E6FD892C15E79CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0ecc2687408665fa16ab6b5ba0b9401e999361ea9512bee5c7a7aaef24cd6ab2
MD5 71bfa83b1ed8ad9fe76e9a4e1dac7001
SHA1 a135b7fab58549329a18141fb7bd6cf6dd0e94bf
SHA512 e5a58dfdbafb48199e4ad2fff949fad4fee898eb9cda3e751f0b296a79865c66cb950f6c4b756d23cb1db88621462749b6f810fd34beeb725d12b0dc86058a3b
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUyduSl8h4otop5ZpVDIB6dGyvte/nWtRkda8:At0oWqNVVxi+9oPziU2Dd8Rt/nWtGda8
TLSH
T1C4C1D871A86D9C6B4DF2A485B0032D538EB8606B6925BF58FDEA5D1C01E34DC1343673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b938dc6fe0095f2d28abbb4bf64c3c6b4086551878b6f1b110281994e7854f74
MD5 5de83232264a1063273b51edaa994e47
SHA1 63fcdce496abeb3ed8da2ab6e889612e7e30bbf1
SHA512 447f59230d676d7bec00a2c9b141c827fad6e8b1de2a9ff4135569d9deea81c5eaf8f195a86dfca61bc60b4bb689ce91b856c00065cf3b13ad1b91f136cee297
SSDEEP 96:AC0d+TWqN/K890wxi+9M7fX3urjUyduSl8h4otop5ZpVDIB6dGyvteer5Au7Wtbv:AC0oWqNVVxi+9oPziU2Dd8RtM7Wtwdaz
TLSH
T1B4C10A31B86D68B759E3D455B4022D53CFB860BB5616AFA8EDEA0F1C01F34DC1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cc57505265504703225dcc83c6481cb60a8b06da8324984ecf3561029723be18
MD5 6dfa0badfc09a8b677832bf7ecf9766f
SHA1 29fd7471dc33f3894b2e2c0c70142131e72407af
SHA512 650f3c968fd72052cf8bcaf93dd58b548a229646dcd52596d10dab226a3074039dc7737b6801926f91a1d18cb29fe87debffd91d31b7e2ee780e89a642ab6fb3
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Zp0cDIB6vGyvtBWG0ca3bOv4a:CC0oWqNVVxi+9oP8DUDD0K8DeW9ca3bQ
TLSH
T1ADA12B31A879997789F6D485B1462E538FB870BBA521EFD4E8EE1D1C10B34DC0342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 50b08f09a686230e772dc6fc29de3d95e00e59320970ab166c8cadd723a247f1
MD5 9db21b961ea5dea4fefbbfc5387836e5
SHA1 608319ffa72bc379dd60bbdcc86c169e52fa09f5
SHA512 4b7a4a4508bfa348ab1894f63fd3a395034179e580898b308fa8edf51d580286522dd1e1bd839ab72f359281d8160ee513ded1c54a546db2c957b89a9997514c
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUyduSl8h4otop5ZpVDIB6dGyvteer5Au7Wt7:At0oWqNVVxi+9oPziU2Dd8RtM7Wtwdaz
TLSH
T15FC10A31B86D68B799E3E455B4022D53CFB8606B5616AFA8EEEA0F1C01F35DC1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-192-0x0000026F2DEE0000-0x0000026F2DFA3000-memory.dmp

Download