Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://vimm.net/vau...

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 18:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://vimm.net/vault/70713
  • Sample261023-w2tc5add52
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vimm.net/vault/70713
    1⤵
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff7660c728,0x7fff7660c734,0x7fff7660c740
      2⤵
        PID:4248
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,4877855592781254740,6317374203000419646,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
        2⤵
        • System Time Discovery
        PID:3344
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,16249128961570295216,17461100482003927321,262144 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
        2⤵
          PID:4580
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,11384277723882447326,3293133266390820802,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
          2⤵
            PID:2756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,16404707332461890803,6763090678338868501,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:4552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13803019174264571964,12418208980625418968,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
              2⤵
                PID:3464
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,16501961172251051428,2496957082665050603,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
                2⤵
                  PID:996
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3900,i,11937793076358445010,1331767744229849147,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
                  2⤵
                    PID:4328
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3324,i,313055167786925076,10346524406227154302,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
                    2⤵
                      PID:1932
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,1183326090074897592,7458844867770458784,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
                      2⤵
                        PID:4256
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5888,i,1203002600165381221,18376908472806801864,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
                        2⤵
                          PID:1640
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4560,i,17956996523966503060,2563247332859365460,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
                          2⤵
                            PID:4624
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6416,i,7728672186534629716,18007982230023704739,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
                            2⤵
                              PID:3224
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6256,i,8478453613589031796,3063986897173783307,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
                              2⤵
                                PID:3340
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5856,i,7077976272855059434,1179365167579758205,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
                                2⤵
                                  PID:5468
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6480,i,14418489536922295775,9921452210680924834,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
                                  2⤵
                                    PID:1112
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5920,i,11124306166375231102,3511431002089656518,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
                                    2⤵
                                      PID:1592
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6004,i,8882709794128911367,8256185317839729305,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
                                      2⤵
                                        PID:4576
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5692,i,10441302197466184174,12829214203830219925,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
                                        2⤵
                                          PID:3008
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,6970500094899406031,5586730420606909741,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                          2⤵
                                            PID:5580
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,1527307768798938086,14894665132403338059,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
                                            2⤵
                                              PID:4332
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3896,i,6177269818309776486,1200332327060895649,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
                                              2⤵
                                                PID:5776
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6020,i,15050474801403662088,16246303678431325926,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
                                                2⤵
                                                  PID:3496
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5892,i,11534496079538545544,6098519622646834525,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
                                                  2⤵
                                                    PID:248
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4808,i,16940853937468004247,213477488686627660,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
                                                    2⤵
                                                      PID:3288
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6452,i,13370301825695559578,2280987553072961004,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
                                                      2⤵
                                                        PID:5140
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6052,i,8005240205771678459,11841583847110700438,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
                                                        2⤵
                                                          PID:4128
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6532,i,12180982180736765020,18150644744949898526,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
                                                          2⤵
                                                            PID:2712
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5732,i,17830136593682712249,8418393309265114811,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
                                                            2⤵
                                                              PID:4872
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5896,i,11859106994108218173,11902529526132760633,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
                                                              2⤵
                                                                PID:1120
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6556,i,3090278211373983990,8964024630983936640,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
                                                                2⤵
                                                                  PID:5732
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6840,i,15921106157972050915,9583974498385462979,2097152 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
                                                                  2⤵
                                                                    PID:1820
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6660,i,15978205985277879316,16363131867582432845,262144 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:10
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1000
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,9896323949397908883,17323289231162609666,524288 --field-trial-handle=2424,i,9337588583008132290,9462044440353475685,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
                                                                    2⤵
                                                                      PID:5956
                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                    1⤵
                                                                      PID:4912
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                      1⤵
                                                                        PID:5216
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                        1⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:5848
                                                                      • C:\Windows\system32\sihost.exe
                                                                        sihost.exe
                                                                        1⤵
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5520
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe /LOADSAVEDWINDOWS
                                                                          2⤵
                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                          • Enumerates connected drives
                                                                          • Checks SCSI registry key(s)
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2768
                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                        1⤵
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2464
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3768

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            4b3c6bb7-137a-4556-ae82-e777c5ddb1f8.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4b3c6bb7-137a-4556-ae82-e777c5ddb1f8.tmp
                                                                            • Size 4KB
                                                                            • SHA256 a55667b379093bb6eb97be0e6cabc64770eab3b651bef84110a7e12433b8c935
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            68f5c6e5-bb4a-4ae3-98a4-77c68bd66cdf.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\68f5c6e5-bb4a-4ae3-98a4-77c68bd66cdf.tmp
                                                                            • Size 5KB
                                                                            • SHA256 98e4c1c0962a87906b406372a0852c7517ccd817fdc2814bd60f89c5fee2bdbd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            72195170-f910-49ce-909d-f7f54d5bcd4f.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\72195170-f910-49ce-909d-f7f54d5bcd4f.tmp
                                                                            • Size 5KB
                                                                            • SHA256 9dd7bda437ef952239a58989484790bf4c07ff8e5553121ef84c95e5a2f90e15
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            886e12df-dfc6-445d-8481-f4c0a74f931b.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\886e12df-dfc6-445d-8481-f4c0a74f931b.tmp
                                                                            • Size 5KB
                                                                            • SHA256 0d02af2df1722b96f6938117352a66e9f89e45fd02581b2087dc1a0137937307
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            13dc21a3-47df-4db8-a4a4-876ba3610862.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\13dc21a3-47df-4db8-a4a4-876ba3610862.tmp
                                                                            • Size 12KB
                                                                            • SHA256 c572a5a857eaa1060bcec2e7a266754e4a883b484fea236d3275d6c200fc3f74
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            369013e8-d39e-4cdc-8bd8-482dde424773.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\369013e8-d39e-4cdc-8bd8-482dde424773.tmp
                                                                            • Size 11KB
                                                                            • SHA256 a0b2abcde11929c1ec002bf16aadf440f79632a2da7950c3f0eeec69e9d8c8e7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            696255c3-30c3-4d78-a97d-c697b135fae9.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\696255c3-30c3-4d78-a97d-c697b135fae9.tmp
                                                                            • Size 12KB
                                                                            • SHA256 9a39babb237d11956d4ea4bbd27041a50ca769720aa0c94d676c021632551aad
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            7ea625f6-048f-4b1f-ac62-f44b619fcf5a.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7ea625f6-048f-4b1f-ac62-f44b619fcf5a.tmp
                                                                            • Size 12KB
                                                                            • SHA256 e00a4dd6c8860556956b23b9c2deb1df5c6b86a980a7950083e04d16ddb4a757
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            9e72276c-fa5c-4741-b7e1-a70286506250.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e72276c-fa5c-4741-b7e1-a70286506250.tmp
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            f_000008
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                            • Size 29KB
                                                                            • SHA256 fcfd4fa99334ab9466a3989200efa9083c8970500f943a80bb5383e31067b155
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_00000a
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
                                                                            • Size 55KB
                                                                            • SHA256 5c3cd9d3a1edfa48aecc6e499b4e5491feb29495c5392cbe330019d6183fcb22
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000012
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
                                                                            • Size 22KB
                                                                            • SHA256 063db433e1a9b5f2cb2349ad748778e1c9e8cb4958413b805963127fd7ddb071
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000015
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
                                                                            • Size 77KB
                                                                            • SHA256 98aa414e8254138362c6f87c642f736c2de75bfc9bab4af2a1e12b31de4d204e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            temp-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                            • Size 1008B
                                                                            • SHA256 216b3f9f8e654e0da016d0042512cf84223aa581c78ca8bac8f842b48925594e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 1KB
                                                                            • SHA256 8e134b1aaf0474f5c998ea94b52febe1dce664061d8865c15545251ebb97e841
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            MANIFEST-000001
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
                                                                            • Size 41B
                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            1988b1d5-5c25-4078-b5d7-d9e829247fef.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1988b1d5-5c25-4078-b5d7-d9e829247fef.tmp
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            23e1e37b-5347-4230-aa1d-7fe8adc19f1f.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\23e1e37b-5347-4230-aa1d-7fe8adc19f1f.tmp
                                                                            • Size 12KB
                                                                            • SHA256 f3278aac707fde3f2c7055433abf238a291b1849a1053882f610a9af8729a5ec
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            4808c484-0bd8-47f1-bf94-380e0efe38eb.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4808c484-0bd8-47f1-bf94-380e0efe38eb.tmp
                                                                            • Size 16KB
                                                                            • SHA256 29b183c458378aa6b507c2b310230a95bae8add0e75725fd20e829abef51b065
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            7716278c-4b9f-4c1c-92f7-39ed9f578201.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7716278c-4b9f-4c1c-92f7-39ed9f578201.tmp
                                                                            • Size 1KB
                                                                            • SHA256 b4472b7c20eabcb4a36d8c8d4b25d79badd2defa9d9be6318928746d4a63ee85
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            b54d4754-0060-4f53-ab23-2f0ff4b0cc40.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b54d4754-0060-4f53-ab23-2f0ff4b0cc40.tmp
                                                                            • Size 15KB
                                                                            • SHA256 57fad0b3cbf055d6976fe9f08e2c8bbe6fc1a9fcdbb9be23a0b4be759479acb1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 11KB
                                                                            • SHA256 14862879cb1707d82e2f53b2873c2eac636460dbc4d464db12b902689aba6e9d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 0189c52776ed73f1e98ffb4807ddf215d890ab6b83d3f0d2752295014f703f49
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            temp-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
                                                                            • Size 72B
                                                                            • SHA256 a657327a256ba21885a42093f72ec0cd3330705cc7bc222bc179012c49a6385f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CURRENT
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
                                                                            • Size 16B
                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            a69d226a-ba27-4516-a917-2b0381f84eea.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a69d226a-ba27-4516-a917-2b0381f84eea.tmp
                                                                            • Size 12KB
                                                                            • SHA256 11ac8416606577b9a5e1435f83bd42f4a44fc798f98236f9edde5ece1bdfa662
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            bb488ca3-26e4-405e-93bb-4480891973ea.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bb488ca3-26e4-405e-93bb-4480891973ea.tmp
                                                                            • Size 5KB
                                                                            • SHA256 b24d7d031c99e74b5e82e8cf2d70373a7e45bb7a3348f2117249db5d0f7a990e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                            • Size 607B
                                                                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                            • Size 595B
                                                                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            memory/2464-650-0x00000209941D0000-0x00000209941F0000-memory.dmp
                                                                            Download

                                                                            memory/2464-630-0x0000020982C90000-0x0000020982CB0000-memory.dmp
                                                                            Download

                                                                            memory/2464-617-0x00000209801E0000-0x00000209802E0000-memory.dmp
                                                                            Download

                                                                            memory/2464-626-0x0000020982E90000-0x0000020982F90000-memory.dmp
                                                                            Download

                                                                            memory/2464-625-0x0000020982A50000-0x0000020982A70000-memory.dmp
                                                                            Download

                                                                            memory/2464-616-0x00000209801E0000-0x00000209802E0000-memory.dmp
                                                                            Download

                                                                            memory/3768-775-0x000001BF58BE0000-0x000001BF58CDF000-memory.dmp
                                                                            Download