8d8af550d861cb38460bc11ca228a34f5adfe3acea64970d23d3f1d19ec37b44

Analysis

max time kernel
600s
max time network
598s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nAVLHqWqYeJsSIeDzQoz.html
Size 32KB
Sample261012-vrvmrsvv5l
SHA256 8d8af550d861cb38460bc11ca228a34f5adfe3acea64970d23d3f1d19ec37b44
MD5 1115c4fcf2fa444aaff5dc46a51349de
SHA1 8eb50fd37998b1371e4363a5035464ad1484b1e5
SHA512 ca04f2a7aed47354356131614030fa220d3f4220ad07299cfb9cdc2b20d2276774c192b14cdb2a53dde58a7304368493fd5ebf01ec125466ae738a7d82a8a206
SSDEEP 768:cstkmllI1rTJ/iJ2AxeJi9xskcdUrFZ2rMex/k:csyTUxskDhZ2rMex/k
TLSH
T113E21BB1B206D039F133C06A3A95A3DD3425A523DA274A78D7D1F73C46C6BD61A71B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe
Token: SeShutdownPrivilege	692	chrome.exe
Token: SeCreatePagefilePrivilege	692	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3180	692	chrome.exe	89
PID 692 wrote to memory of 2924	692	chrome.exe	90
PID 692 wrote to memory of 2924	692	chrome.exe	90
PID 692 wrote to memory of 3432	692	chrome.exe	91
PID 692 wrote to memory of 5040	692	chrome.exe	94
PID 692 wrote to memory of 5040	692	chrome.exe	94
PID 692 wrote to memory of 5480	692	chrome.exe	95
PID 692 wrote to memory of 5480	692	chrome.exe	95
PID 692 wrote to memory of 4444	692	chrome.exe	93
PID 692 wrote to memory of 4444	692	chrome.exe	93
PID 692 wrote to memory of 5624	692	chrome.exe	96
PID 692 wrote to memory of 6048	692	chrome.exe	97
PID 692 wrote to memory of 6048	692	chrome.exe	97
PID 692 wrote to memory of 6068	692	chrome.exe	98
PID 692 wrote to memory of 6068	692	chrome.exe	98
PID 692 wrote to memory of 2624	692	chrome.exe	102
PID 692 wrote to memory of 3528	692	chrome.exe	103
PID 692 wrote to memory of 2624	692	chrome.exe	102
PID 692 wrote to memory of 3528	692	chrome.exe	103
PID 692 wrote to memory of 1112	692	chrome.exe	104
PID 692 wrote to memory of 4864	692	chrome.exe	105
PID 692 wrote to memory of 1112	692	chrome.exe	104
PID 692 wrote to memory of 4864	692	chrome.exe	105
PID 692 wrote to memory of 1456	692	chrome.exe	106
PID 692 wrote to memory of 968	692	chrome.exe	107
PID 692 wrote to memory of 1456	692	chrome.exe	106
PID 692 wrote to memory of 968	692	chrome.exe	107
PID 692 wrote to memory of 3460	692	chrome.exe	109
PID 692 wrote to memory of 4400	692	chrome.exe	110
PID 692 wrote to memory of 2784	692	chrome.exe	111
PID 692 wrote to memory of 4044	692	chrome.exe	112
PID 692 wrote to memory of 5428	692	chrome.exe	113
PID 692 wrote to memory of 5428	692	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\nAVLHqWqYeJsSIeDzQoz.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7ffefd5cc728,0x7ffefd5cc734,0x7ffefd5cc740
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,4790033277226688398,3295597071514686828,262144 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,117467561092701513,1237267103625803586,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,12028853152404825777,4118648582716044795,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,2559183583992403465,13295377497039473960,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,3776244938991038926,9369887809314007816,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,2374007730899161529,14754420112275579930,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5244,i,9689498338192030060,3640970293366902693,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5256,i,210627562637135287,9514983707258890994,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5236,i,234514592676335822,7258302526680137576,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5248,i,2471055399202482917,9841378208148949919,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5252,i,15416866123121434205,12913880012907520712,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5440,i,14149973403024679892,4682264860119871982,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5536,i,8548841668891727191,9008810222943770377,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5480,i,12811130307721128027,16224605769556051423,2097152 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,1467072096327526083,15524405251809375797,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,9364150681067583697,4312862335719901522,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,16161979108111537365,4578632520517367305,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5720,i,6561665164008651419,13504937905934971426,262144 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,11342935137285172249,6453021839481907000,524288 --field-trial-handle=1948,i,4439811847226167379,15782802031690529279,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
  2⤵
  PID:5428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

195544db-e0f2-45fd-8445-a7c7d96a566d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\195544db-e0f2-45fd-8445-a7c7d96a566d.tmp
Size 4KB
SHA256 fea9d20e01c32f8e35f8157559ce653c884848601d142e1f64449a1f4eded8cf
MD5 8ff5f5c576df202d40e5c3358af63a7f
SHA1 1662155095631cc1b397dfdb7d5a075b8c9f2916
SHA512 ee89abb7b90e013c6ddb9142d9fdc8376cb2e1e153c510ac337ebbf520b8ed92f64942fca6e2ea2cd82fb627295ecc8b31daf96b65f02be4057e73eeb2da5894
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5hbDHB6RGyvLsTFYebQMUpv4a:uC0CvgFrp65DUDxhJVTFYeb3UF
TLSH
T1EEA1F931E0A9597B05B6D489B8812A03CF74617BF951AF84D9ED5E1C28B70FC1382627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

224165a8-51ca-47aa-abb0-e04055e63449.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\224165a8-51ca-47aa-abb0-e04055e63449.tmp
Size 5KB
SHA256 3e482603d46e8956ad29d3ef6359966de1e4f0655c17db5d1a78fc5d417e656e
MD5 077de00947b0c48337a89b1212c351bd
SHA1 e29ac50f47e75f0ac681c6c43301f8d9d45aa522
SHA512 4741dd4f8b890cfe40628e233636d45b51050cc8d3f5f9c7a59192d459a58487c1d19d692bafc87352ad3d373ec159d22b50e08b364ff7f69d4b1c1f82f39011
SSDEEP 96:vC0d+6K6ujgRdfB7rsM6Rbo2Sl8h4otop5hJDHB6rGyvLscPvh3PkYbn0j9IooO+:vC0CvgFrp6myiU27hLVcPvh3PkYbnURm
TLSH
T109C11A70E4AC6D7705FBB586B0422A43CFB561ABB944AE54DADA1F1C04E70EC1382637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3745145a-080d-480c-9fbe-0e1f0e12b9b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3745145a-080d-480c-9fbe-0e1f0e12b9b6.tmp
Size 5KB
SHA256 191668002a5a3046dfdb852bc8b37903699be07ee240eb85cc8faf4bb200172a
MD5 e99482fb92f7a680429d612f74d2ff27
SHA1 27bbd40d9e8dd690d75d1a89b8b1cea069cbf9ca
SHA512 d77f88894a841972b79c667905e473b0f3d302288f56fe04f71d446ed5f08bc885c7531c6593677f62ebc6688f6e32307366518276a56bf74d4c1f6a7211b6d0
SSDEEP 96:vbJ0d+6K6ujgRdfB7rsM6Rbo2Sl8h4otop5hJDHB6rGyvLscIh31kYQRNC39ISya:vt0CvgFrp6myiU27hLVcIh31kYQuC/Cx
TLSH
T107C1E870E49D6D7B09F6B886B0422D43CEB451ABB904BE58EDEA5E5C10E78DC1383637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

748515f1-dfb8-49c7-aefd-300c5f822121.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\748515f1-dfb8-49c7-aefd-300c5f822121.tmp
Size 5KB
SHA256 a82fcafa4ce6a0c72d2f3a7e8e691fa8ca585f55dd6a7d0f511872259aabb1e0
MD5 ca044bfba7f6fde4417ce0c6da1fbce4
SHA1 26bac504b26e7bd3ea6a5d4aed19d2e4085b0033
SHA512 56bfde53ee3ae242b468dff8fcbb6ee71df360c464deddd31e13dd56563015f1565f0bbc7015b39d73182cce6e26513493bcd475d73c50b53e1ac1c3a7c8c735
SSDEEP 96:vbJ0d+6K6ujgRdfB7rsM6Rbo2Sl8h4otop5hJDHB6rGyvLscPvh3PkYbn0j9Ioov:vt0CvgFrp6myiU27hLVcPvh3PkYbnURm
TLSH
T1A4C11B70E4AC6D7705FBF586B0422A43CFB561ABB9446E54DAEA1F1C04E74EC1382637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a228c89-fee7-46de-a1b7-75c49eca923f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9a228c89-fee7-46de-a1b7-75c49eca923f.tmp
Size 5KB
SHA256 11fecf397d08adcd6b451127f05d94e2b7cf492429c5cf4e5dea7a6ebfc00e11
MD5 98bc247b2d74910a366490fea5da8651
SHA1 b8e1cb20bdf1ca537848c6f31bd35d2fd2124f0b
SHA512 be4364959beb00f3cc9fbb9b4197bb9abb77470e7d75edf36f87edea9573f35a39bb4dc649f9f7f0c39ffcaae0f2a7c656d58f169f8eb2131892de1ff37ed763
SSDEEP 96:vbJod+6K6ujgRdfB7rsM6Rbo2Sl8h4otop5hJDHB6rGyvLscIh31kYQRNC39ISya:vtoCvgFrp6myiU27hLVcIh31kYQuC/Cx
TLSH
T1D7C1D670E09D6D7B59F6B88AB0422D43CEB451ABB9047E58EDEA5E1C10E34DC0383637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4feaaa2e-988d-4b7a-bcaa-ec0e94b90cba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4feaaa2e-988d-4b7a-bcaa-ec0e94b90cba.tmp
Size 11KB
SHA256 c1507dcaae0bb698d42f3a776bb6f5862b70a0418a3a3b9c215995d5052f85d5
MD5 f5f5e8018dfeab73f4deef9dca1b11a7
SHA1 2085bf4165cbc6da84def6419ed2e3541b52dfa5
SHA512 8d85341dca60ca6c2f8dae3432991e80d65e4e5c831b33fa4a8794e22c96a001bfa121c068429e31c58e084bde1c45e9c90b7bcbac386564ad490739f53fb623
SSDEEP 192:VRQQPiKrBHv7rvAPRp2WUAXsb+WNn9oNPYNepcqkw0a1jhiyIsnAUgR:VRQQPiKrBPH6X/Xw9gPYNDqUaBkR
TLSH
T17E32B529AE11793B5CDBD22AFE657753E6F6102176942F84EAFC883C21D35DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ccaf401-18c4-4321-b027-872ff10d8773.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9ccaf401-18c4-4321-b027-872ff10d8773.tmp
Size 11KB
SHA256 7cf90f60717ea914eb93ccc6033befd5960eb8f4d3021cfe6133523579b6cfa6
MD5 37718b64a06a50e517bbe3f1c3c724fd
SHA1 e079d2a6cd0db714b76cff36bd7b1a38aafeb016
SHA512 9f7cd3c34bc9a2841fe5431b839f218dd2a816efe6d43c0687399577bdbd570eec24fc3f027d7fe60de1d4c244c271d7f0e2060b988ae52f31700822a57400f0
SSDEEP 192:ehu4K6Hr7KxkXqK4I40pUZNCgVLHrKHfFKslH5nXzKD/kH+ErUkKNIxrAfJWf4P9:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnw
TLSH
T15432D927948D9A3F4FECD908CC52AF4B6CF502927778092496FB9D1803957CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

81ea83d1-c9f7-49b4-b5a7-11766715e53c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\81ea83d1-c9f7-49b4-b5a7-11766715e53c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a201a4a5-5a0d-4071-9ef3-57bf0579c8ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a201a4a5-5a0d-4071-9ef3-57bf0579c8ee.tmp
Size 1KB
SHA256 f403bc8c7c4c10941e708ef8d8ef2f6e4d4b8bd3b8fbd63484e26759dac75f09
MD5 8285df2c0e100058b7b91d996da0250f
SHA1 7a08d20f14445798d264c0b3503081566d0ab369
SHA512 30eca2edade677ec51b64231055fac1f54d71d5f09f4afa92ec3cc4b82a35b20471ae910d9572dd6a771f62f771e9c8a4e298f586dfb3f7e063543f7d724ace7
TLSH
T151317EBBC3D446BD881552F09B256D1BCD2D151A423C3C6688E4AF5FA3F1471D11129F
MD5 SHA1 SHA512 TLSH

Submit Download

a58deec2-6ee2-4da0-9542-826a7785e87d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a58deec2-6ee2-4da0-9542-826a7785e87d.tmp
Size 1KB
SHA256 77919ee30b7032aaa103f628929dc0ec392a54fb8ea47c96a5d7cb3e3814651d
MD5 2de276f7bf59e150984be4a62166c0a3
SHA1 5b3fb4a92224139e80ef7b6cd3cc23c67dc2f343
SHA512 4e52265253a3285ca5cd3feb7ca44ef70aa5123eb4161a7772abb58715fd1f6ec10cef3e68648ef42ecfa3dd8f80e5826c76f3c4523bcfaa2d849dea343e74e1
TLSH
T1D331AEB7C7D882BD881652F09B257D1BCE2E051942383C6A88E5AF5FA3F1471D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

d1db19c5-e927-49fb-916c-c69ab2de58e8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d1db19c5-e927-49fb-916c-c69ab2de58e8.tmp
Size 1KB
SHA256 60711e5e44794e93dd42c38b70e54ee131c70b197c49c98ffa63adbcd35dc8d4
MD5 b488514aefdc212100345823db0fe719
SHA1 186aa7619a71ad00ab178e55da35ece31bdb1913
SHA512 c1ece2a10b6bbc111be877e6e23962a0b72b5d9e11afbb6fccb49314b21b6a86264f45ae5af07646bb837abdf91b8908ed4b8fa49e256fbed1ad905485c79f6e
TLSH
T1653190B7C7D8827D882552F49B256E1BCE1E0519432C3C66C9E4AF5FA3E2470D21169F
MD5 SHA1 SHA512 TLSH

Submit Download

fb77e2bd-6c40-4ac0-b12d-f98f8a8fa79f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fb77e2bd-6c40-4ac0-b12d-f98f8a8fa79f.tmp
Size 1KB
SHA256 98535111e27325143da556a510aaec2cbdf96dfc975c2a6127d36a12fbd06d33
MD5 a05ed5be77a484302d0741a1df85b78d
SHA1 1ae20e1dc3fe500f8a51bd6320fde52369b91307
SHA512 70a296fbfcf2ec881102c769402793767d84e6cd6050c2496dc7f68b4c7f67977fad1e2d3ff8ffcd08465270c416d6a15707d33aebecf0431a1aa4640e0e6ecb
TLSH
T1BF319CB7C3D8867D881502F49B256E1BCE2D051942383C66C9E5AF5FA3F1470D24129F
MD5 SHA1 SHA512 TLSH

Submit Download

ab72f752-8ca5-43d1-aa50-2937d9aeeccb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ab72f752-8ca5-43d1-aa50-2937d9aeeccb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eb149ea8-5442-46e9-8183-f51402eaae6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb149ea8-5442-46e9-8183-f51402eaae6e.tmp
Size 12KB
SHA256 21ba39ecc1c9135247b87528feabf8562953b4bb51199986ad10556d5a1d39cd
MD5 99839f9b1c4ba2967e1fe69d675af68b
SHA1 a8e0eb7fbd02456b21847406ce363c68dca7358d
SHA512 e6641a174a699d2576fa7162a4aabf7221aebbdf86c82428a6e4b9ddfbe7703dd60d2c8f8967150d18d732f849aa6320c955ee85ca8397df96c2731a0ac3a27f
SSDEEP 192:VRQQPiKrBHv7rvrPRpDWUAXsb+WNn9oNPY23Uepcqkw0akjhiyIsnAUgE:VRQQPiKrBPHrXQXw9gPYKUDqUaqkE
TLSH
T18C42D62DAE11793B6CDBD629FE657B53E6F6102172902F84EAFC882C25D75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download