hxxp://joliecarte[.]com

Analysis

user interaction
yes
max time kernel
899s
max time network
882s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://joliecarte.com
Sample261023-e5yzcacb92

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3304	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	2152	chrome.exe
Token: SeCreatePagefilePrivilege	2152	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1288	2152	chrome.exe	88
PID 2152 wrote to memory of 3304	2152	chrome.exe	90
PID 2152 wrote to memory of 2448	2152	chrome.exe	91
PID 2152 wrote to memory of 2448	2152	chrome.exe	91
PID 2152 wrote to memory of 1972	2152	chrome.exe	93
PID 2152 wrote to memory of 468	2152	chrome.exe	94
PID 2152 wrote to memory of 1972	2152	chrome.exe	93
PID 2152 wrote to memory of 468	2152	chrome.exe	94
PID 2152 wrote to memory of 5540	2152	chrome.exe	95
PID 2152 wrote to memory of 5540	2152	chrome.exe	95
PID 2152 wrote to memory of 3192	2152	chrome.exe	96
PID 2152 wrote to memory of 3192	2152	chrome.exe	96
PID 2152 wrote to memory of 4148	2152	chrome.exe	97
PID 2152 wrote to memory of 5532	2152	chrome.exe	99
PID 2152 wrote to memory of 1204	2152	chrome.exe	100
PID 2152 wrote to memory of 5532	2152	chrome.exe	99
PID 2152 wrote to memory of 1204	2152	chrome.exe	100
PID 2152 wrote to memory of 4600	2152	chrome.exe	101
PID 2152 wrote to memory of 4600	2152	chrome.exe	101
PID 2152 wrote to memory of 5304	2152	chrome.exe	102
PID 2152 wrote to memory of 5304	2152	chrome.exe	102
PID 2152 wrote to memory of 4768	2152	chrome.exe	103
PID 2152 wrote to memory of 4768	2152	chrome.exe	103
PID 2152 wrote to memory of 3204	2152	chrome.exe	104
PID 2152 wrote to memory of 3204	2152	chrome.exe	104
PID 2152 wrote to memory of 3452	2152	chrome.exe	106
PID 2152 wrote to memory of 3452	2152	chrome.exe	106
PID 2152 wrote to memory of 2716	2152	chrome.exe	107
PID 2152 wrote to memory of 2716	2152	chrome.exe	107
PID 2152 wrote to memory of 2080	2152	chrome.exe	110
PID 2152 wrote to memory of 5764	2152	chrome.exe	111
PID 2152 wrote to memory of 1412	2152	chrome.exe	112
PID 2152 wrote to memory of 5132	2152	chrome.exe	113
PID 2152 wrote to memory of 3096	2152	chrome.exe	114
PID 2152 wrote to memory of 3096	2152	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://joliecarte.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffccca6c728,0x7ffccca6c734,0x7ffccca6c740
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,7837907603312701590,7258527175615159828,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,8044711115102826149,261540761924649775,262144 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,7295340304540444299,16761058572409308706,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,16060128840998639224,1484335348494362935,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,10643236418394042955,6640428358039005380,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,10668924136312807006,3739971401036990001,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,4251948720035720376,5647303245076133046,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5428,i,17654677417690867827,10705695361730836239,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5404,i,9461501180235933415,7287662937936875111,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5396,i,12285564563930271479,11787836641152814772,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,11294587278042344262,559733247016784179,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5712,i,15956670039157227993,12874236178689899919,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6252,i,15648878676605232501,14151133812619320026,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6396,i,8832335164805318166,6496147942720719492,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6516,i,16816765139321556950,14979245664702679909,2097152 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,12027476112169016909,16378839840938293931,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,8440990104155832257,5607735791574707695,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,11110662190317098833,5522553755155641352,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3276,i,6385091634039524868,13559176702963327367,262144 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,4296396753250831045,1903389718661023548,524288 --field-trial-handle=1900,i,4471586743122617671,2467503309194683810,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
  2⤵
  PID:3096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4928

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2cfe16e0-d0f5-4c27-9bdc-6830208544d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2cfe16e0-d0f5-4c27-9bdc-6830208544d8.tmp
Size 5KB
SHA256 552bdbf2e3ba6a48cc94c107fcbf46fe85d2dcf22e7f3dee0dca1411a851e0be
MD5 2f2f9df8848bdce3ebd3932f4080d44f
SHA1 29e2bf3bf3c2907a536fcf78d9be7eb05147830e
SHA512 0eaa18b77ff5854ba5234c4ad86ac6b57ec32673362769ff1ceca8192dab482586ac5e0c90e9d86c6f8b6969df67b369d3c0db6f794a4c6808ec3eda5f87c9a9
SSDEEP 96:YbJod+qw+CWJKhPPf36v8RtySl8h4otop5xvYDsB6bGyvr7jYcK0CRNC39ISyVNL:Ytoh2WJii86iU2dugLqjYcK0CuCV/
TLSH
T1D1C1E7B1946C6C7B8DB6E945B0032D47CDB512AF79247E54E9ED1E0801E75EC2383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

509234fb-206b-4e94-ad3f-8da42bb712c2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\509234fb-206b-4e94-ad3f-8da42bb712c2.tmp
Size 5KB
SHA256 ea5f3f795ce56f179b48d13de27cb3b55bba5d60b3594abb05134240f630411b
MD5 15e3e0249b3c23b4402b7ef3e5f72b76
SHA1 b4c0ac940f9f3f2e9be5b4c0808e0853e1f9374d
SHA512 e0c9e79eb47bee4675df9c9019a05b4f7bba70f9e12bb8db85e6c41d054de6a87f6e4240aee49fd4bbc40c4c2a55480e1d8f1b649322c6b690e30fe59de98b2c
SSDEEP 96:YbJ0d+qw+CWJKhPPf36v8RtySl8h4otop5xvYDsB6bGyvr7jAixwzFWUD2K0gr0/:Yt0h2WJii86iU2dugLqj9x7a2K0grUt
TLSH
T1DBC11B71A46C6C774AF7D641F9032943CEB522EFA6146F54DAED1F1801E71EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a40d30a-4b4b-4583-9053-88a67696887a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a40d30a-4b4b-4583-9053-88a67696887a.tmp
Size 4KB
SHA256 da3440aeb7cc2fecdefc2d94f6d6cb4905d7eee4a309d20fe495af332dda1493
MD5 9022444d3d45ae87204db59c10a5cf8e
SHA1 c0861df1917cd70ed2b86e68f145a1bc97b47ecd
SHA512 ede078e0f93b9b7936ca739db65c20b0d3320cbd7bdc6fbdbfedeebacf85107b7f9895b6fa3bd5adbad8936ba890a0754248e129b30f0c3ff36f8ab9c3fccb69
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5xvsDsB6WGyvr7w70sbm3v4a:9C0h2WJiiniDUDd6gaqw70sbC
TLSH
T149A1F971946D5C7B89BBC585B9432A07CFB422ABA521BF40D9DC1E0C11F71EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cb4b098-c719-4d88-816c-6ab896390f9e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7cb4b098-c719-4d88-816c-6ab896390f9e.tmp
Size 5KB
SHA256 75770f296eece9f95cef4d0f9c744b40fa654852428b49ce17735e1a7ae91027
MD5 3c8676cfecfcbfd2f0c727ee6b5476aa
SHA1 c591d37e6a9727fe38006b16de6dcaa8fae8886f
SHA512 2c1873dcc3cba0b40f65d03589a1355688538703c62e8f070a1908ff452c0861748b0598cf7587af1622688296d531f11b24b2e3d153520cb39d8f83f22d79ea
SSDEEP 96:YC0d+qw+CWJKhPPf36v8RtySl8h4otop5xvYDsB6bGyvr7jAixwzFWUD2K0gr0jb:YC0h2WJii86iU2dugLqj9x7a2K0grUt
TLSH
T103C11A71A46C6C774AF7D641B9032A43CEB522EFA6146F54DAEE1F1801E71EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88f7820d-bf60-4ce7-9910-8026d190a7cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\88f7820d-bf60-4ce7-9910-8026d190a7cc.tmp
Size 5KB
SHA256 eb64944f1f6860fc72f1845444865a5307e17365bbff92c72d7e95f68983855f
MD5 c3797f7fd42f4762a97efda4f79e3223
SHA1 d34f8a9e52b5210f0564f49f59a84a4b85e6dc54
SHA512 2d442a412244077e22aadebe4c3faef3665c75ba8e4ac848aba0ffcc2ef635c06bbda66f13122fd57e23189a8079f56d116685c74c56f52b34c3907c96531f9b
SSDEEP 96:YbJ0d+qw+CWJKhPPf36v8RtySl8h4otop5xvYDsB6bGyvr7jYcK0CRNC39ISyVNL:Yt0h2WJii86iU2dugLqjYcK0CuCV/
TLSH
T143C1E6B1A46C6C6B8DF6E945B0032D43CDB512AF79247E54EAEC0E0801E75EC6383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1853bcec-397d-4162-8833-d1ee5820d977.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1853bcec-397d-4162-8833-d1ee5820d977.tmp
Size 12KB
SHA256 2fe0cc81e4ec1ef73a88bcabeeedb2320d3656a6823c2c8fa6887ba9ece42c27
MD5 edf0509613949336b16b73f85a07d69d
SHA1 e4330f50ba49f43bf83c33e2293a21893365c514
SHA512 393fd26b697e0831bb771ec6a85058aa5250bf389920267140eb64bbd21047db314e46c3b7fc5444804ddb8e9127adbd5c1b270d5658681821a0894df5f3f1c6
SSDEEP 192:xBRJAOyAdzv7dv+PRp4eTlozF9JHsb+WNnT5U6jjQyX/aoMLmfVyIsnAUgE:xBRJMmLpIXGHwNUCQ2aBCE
TLSH
T17842B51EA950793BACDFC219F951B753E6F6206135D02F84E6FC892C22E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

287b6c44-dd5e-4dd0-b9d2-93a92c44ab7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\287b6c44-dd5e-4dd0-b9d2-93a92c44ab7f.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e2476a7-6bb1-4d3e-95ce-d966c4ae9405.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e2476a7-6bb1-4d3e-95ce-d966c4ae9405.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 c6222c0fb45c8a0f0e86741bdb91f2a4ae4fb24d9c2c49ec7a7845cc5fa57221
MD5 780b3ec6003ea1140c3c1a1cdbf37f44
SHA1 10bc77a0cb9963eeffb4f2816e9ded6807fc1bb5
SHA512 fdbd1a0671e297fe8171b4d495d1c0040b8be6f6d8a8d49c58fa5a48475f01ce2a0650d51d385440b83c62063a2ef7b20272d9abe9cabf97d8005b5be83a145c
TLSH
T162D0A96836A72150DF0FD9B118E09960363C2A899B337E1289A44B706C1FFAD2901BE0
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1d70c474-ddff-42a1-8ad6-f2a383a4ff6d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1d70c474-ddff-42a1-8ad6-f2a383a4ff6d.tmp
Size 3KB
SHA256 f086d64ddc2dc57496a25c561257d44f5249da07678caff4220ea0fa03917a92
MD5 1916e26f8f92d3add86ec56bf3dd428a
SHA1 8989b167f525ddb221f5b15eec700dec3ec5ad02
SHA512 b2110490f3b01f69c5059cc33e647112f5339247136ac94ef22d7c69d38e06a2b5cf5db037e303e42786c11950312819175d72fa592830dceeef2a22b64dd971
TLSH
T153817AF783E4892DC91195F4AB117F1BCE2E0528532D3827C8D4AE9B93F2472E24178E
MD5 SHA1 SHA512 TLSH

Submit Download

30c0c581-1f9d-40ff-bb82-b45ac81bf582.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\30c0c581-1f9d-40ff-bb82-b45ac81bf582.tmp
Size 1KB
SHA256 635e65bfc36a5f9fc7c0a3524b1baa707f46571b82828129b546e4d81c60ca8e
MD5 b423c841059a80f9f03d8da7802229f2
SHA1 b6192079b1ae9a1c00c8f92b0bcc65ace8e6ad99
SHA512 f5a6c038f90d7c3de3a0ea049dc3a900b5e1b057b00db1df53f4630c322c10ed91f5f44e3d4b612c1e70a7eac81182c740ad053e674848f5e0030c491daa44c8
TLSH
T1D0117FE7C67A706711BA4DFB1D05BC4A25BAA8311351A4F0CEA7823CB0C20F34E5189B
MD5 SHA1 SHA512 TLSH

Submit Download

65f27f66-291f-4ae1-86ba-f1f4278d3f77.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\65f27f66-291f-4ae1-86ba-f1f4278d3f77.tmp
Size 3KB
SHA256 5b459170df83b2137b19c1ec4e3b7a537d3715728a1b34548c82d7dd4200cec7
MD5 37d07a1210ad8f4ec8ed9989b5c69156
SHA1 a5b4fd82789ce54a77bddb070585a06c74809f9d
SHA512 9141d649c4ac320a6a79c58ffd32aa82b0977d4dc3057842ba04e7ea2415ac424cd937ebfd88f188f8bb8593c343d2322157c95abc75b4bb2dcdea8c12d4b63d
TLSH
T1AD719AF783A48A2DC90195F4AB116F1FCE2E0528536D3867C8D0AE5B93F2472E24178F
MD5 SHA1 SHA512 TLSH

Submit Download

f4cf4a06-aa38-4fa4-9a70-8e91a74ec4ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f4cf4a06-aa38-4fa4-9a70-8e91a74ec4ab.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

acb4d759-f1be-479b-91fd-60bcf2debf21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\acb4d759-f1be-479b-91fd-60bcf2debf21.tmp
Size 12KB
SHA256 5502290bf669e8aa3c716bb0126e3e9295708111a4c5c3b5dfc5c5e980161a45
MD5 5bff74ca50fad089bc847a2a6515474b
SHA1 b3c93a8e2ceeff809c9e0239e11744e1ba415f30
SHA512 687cf62f3d21dda8988307a39b3c16449a1be32a69892cbf42d510cedb4b0b5dd6f317f04c1e5f8f1a477e4c062b3ebf533e0ed3556b8f8af0f2185ebca5e464
SSDEEP 192:xBRJAOyAdzv7dvAPRp2eTlozF9JHsb+WNnT5U6J92nX/aoMLm6VyIsnAUge:xBRJMmLp6XkHwNUW2PaBje
TLSH
T18E42A329AD64793BACDFC229F961B753D6F6106535D42F84EAFC892C21E35CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download