hxxps://onlinemarketingb2b[.]com/?Y3wzMzE2NTB8d19ldGl5MDJEfHx8DQp8fGRtY2NsdXJlQGFldGhvbmVuZXJneS5jb20=

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://onlinemarketingb2b.com/?Y3wzMzE2NTB8d19ldGl5MDJEfHx8DQp8fGRtY2NsdXJlQGFldGhvbmVuZXJneS5jb20=
Sample261026-2sca5scb62

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	11	[email protected]	3000	chrome.exe	1
Email address	11	[email protected]	3000	chrome.exe	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
4976	chrome.exe
4976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe
Token: SeShutdownPrivilege	3916	chrome.exe
Token: SeCreatePagefilePrivilege	3916	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3408	3916	chrome.exe	90
PID 3916 wrote to memory of 2976	3916	chrome.exe	91
PID 3916 wrote to memory of 3000	3916	chrome.exe	92
PID 3916 wrote to memory of 2976	3916	chrome.exe	91
PID 3916 wrote to memory of 5868	3916	chrome.exe	93
PID 3916 wrote to memory of 5868	3916	chrome.exe	93
PID 3916 wrote to memory of 6096	3916	chrome.exe	94
PID 3916 wrote to memory of 6096	3916	chrome.exe	94
PID 3916 wrote to memory of 4516	3916	chrome.exe	95
PID 3916 wrote to memory of 4516	3916	chrome.exe	95
PID 3916 wrote to memory of 3736	3916	chrome.exe	96
PID 3916 wrote to memory of 3736	3916	chrome.exe	96
PID 3916 wrote to memory of 1496	3916	chrome.exe	97
PID 3916 wrote to memory of 5832	3916	chrome.exe	100
PID 3916 wrote to memory of 1936	3916	chrome.exe	99
PID 3916 wrote to memory of 5832	3916	chrome.exe	100
PID 3916 wrote to memory of 1936	3916	chrome.exe	99
PID 3916 wrote to memory of 3772	3916	chrome.exe	103
PID 3916 wrote to memory of 4344	3916	chrome.exe	104
PID 3916 wrote to memory of 3772	3916	chrome.exe	103
PID 3916 wrote to memory of 4344	3916	chrome.exe	104
PID 3916 wrote to memory of 4624	3916	chrome.exe	105
PID 3916 wrote to memory of 4624	3916	chrome.exe	105
PID 3916 wrote to memory of 4852	3916	chrome.exe	106
PID 3916 wrote to memory of 4852	3916	chrome.exe	106
PID 3916 wrote to memory of 4668	3916	chrome.exe	107
PID 3916 wrote to memory of 4668	3916	chrome.exe	107
PID 3916 wrote to memory of 2832	3916	chrome.exe	108
PID 3916 wrote to memory of 2832	3916	chrome.exe	108
PID 3916 wrote to memory of 3892	3916	chrome.exe	110
PID 3916 wrote to memory of 4300	3916	chrome.exe	111
PID 3916 wrote to memory of 4452	3916	chrome.exe	112
PID 3916 wrote to memory of 4976	3916	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinemarketingb2b.com/?Y3wzMzE2NTB8d19ldGl5MDJEfHx8DQp8fGRtY2NsdXJlQGFldGhvbmVuZXJneS5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd51b4c728,0x7ffd51b4c734,0x7ffd51b4c740
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,2899148876090227220,11830824356683036461,262144 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,16583039661229830897,3166164490974834208,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,1783289994328457429,16109224168755169251,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,13302509602148373515,13857687299593108946,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1819465912951249348,11485354979224524842,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,12935350088438458655,18185978724177170586,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,1903280710295402057,5710346913483319830,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5552,i,3444923907795268196,10629243319667691422,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5520,i,4281560612274417199,15161755826285792969,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5720,i,12567345516388674171,8806426384763258811,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5872,i,13896328306235970266,11125105800688114787,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5572,i,6142413816566156202,7280143024680374002,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,4526697166824661870,17215370475436456443,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5816,i,7598849705703840290,10588632266609591636,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5060,i,9036503749947439159,17099800145495335510,2097152 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,12765463926248214499,115812292788711821,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,11010218221788357108,17700308114088911367,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,6534263396505307911,3423332541551118347,524288 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3440,i,4574385547192644787,16734104765406739052,262144 --field-trial-handle=1912,i,7712777155685802764,4439574921567999075,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d82b3ed-8207-4fe8-83d2-c9867ef099dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0d82b3ed-8207-4fe8-83d2-c9867ef099dd.tmp
Size 5KB
SHA256 15a506156798c667ac7dd96f6ac21487ff6e82e65047c5dd5fc7ac76dea4ccb6
MD5 f538f60394594f721233dfd5a7081471
SHA1 d88e3eeb73602c6e921240d4b94e5c5d3859239d
SHA512 47b36afe6732fbf73ce87eba8b24687b5b403b14b4a21870bc86aff0b78d9a72cad2f254738daf3f7268b67a97cfa2196e51751ab1c7cc667d6887b14a771fad
SSDEEP 96:YMbJ0d+TWqN/K890wxi+9M7fX3urjUqdf9XSl8h4otop5dpVDTB6uGyvteer5AuH:lt0oWqNVVxi+9oPCiU2XdNqtMTWtwdRz
TLSH
T1CAC12A30B86DA87789F7D595B0023D53CEB5A06B56259FA8EEFA0F1C01E319D1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38fcdbbb-a9ed-405f-b4a3-e4585f606cb7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\38fcdbbb-a9ed-405f-b4a3-e4585f606cb7.tmp
Size 4KB
SHA256 73c919b20ab3df65cf2566849d82683982dc7b3432d65cd24e454762384bc2be
MD5 07bfdec15f3a4681f5b7342ea91a86f1
SHA1 71dba29c06d28abd721227ceca52e28400a5ddbb
SHA512 9e2afd9e15c36b00f3e84061711d112af607146d8d10280ef6d1e9de539d6d50b189499ef8c259205d460a7d3a993a4f76f1e2c628ff955161907e12bd094227
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5dp0cDTB6vGyvtBWG0cR3bOv4a:CC0oWqNVVxi+9oP8DUDX0KNDeW9cR3bQ
TLSH
T162A13A31A879997789F6D485B1462E53CFB970ABA521DFC4E8EE1D1C20B30DC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

705283bb-49cd-4e8f-9ff5-3cb7eb36b220.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\705283bb-49cd-4e8f-9ff5-3cb7eb36b220.tmp
Size 40KB
SHA256 be9de47b0b5731d0bee0d603e0aafdf35ec1450239bddfb280a226d8d92bc02c
MD5 6f4aed7208c594696e23c43fabf2b5db
SHA1 aea24fbf33377824aafc0bde908b4a755d3cf920
SHA512 9f08e3aaa26752f9cc1e828794c7787471d3344b6fb3a3583dd4a9b006e60b5b0b54b8320b5bae752aa78382196fbec66821b7947bc1b8192daa2a4c9706611a
SSDEEP 768:z0rg3i8PaifkUWC1wBzuKKFuMoebaWCwhuQu9bkdI3+R44CGhKp:gGiXiNxwB6VoM1uWCwhuQu9bN3tWwp
TLSH
T18A13F231F49EDD6B85E4B4E3E00F3C27CDB924139AA0FE68BDDAAD29145554B0107A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82bbfe93-ab66-4314-a70c-85f9a71022ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\82bbfe93-ab66-4314-a70c-85f9a71022ff.tmp
Size 5KB
SHA256 0c873cb7636f348efc4baa30ed0128e1d43513eab3e02b0c6c5cb167cf090454
MD5 92886a2b07ad112bac9d20b59aa75b73
SHA1 0957eb4c9877de1b07ccb45accd7f39378981780
SHA512 b928dd334b6c9f267294640e23cfc5ab26ab3ebaad888c4394c00ad098108fa4f12966370fed882b6c0a22b60b12b63e266a57b8fb901e8393fefa22e281cb24
SSDEEP 96:YMC0d+TWqN/K890wxi+9M7fX3urjUqdf9XSl8h4otop5dpVDTB6uGyvteer5AuR0:lC0oWqNVVxi+9oPCiU2XdNqtMRGWtwd9
TLSH
T186C12A31B86DA87789F7D595B0023E53CEB5A0AB56219FA8EEFA0F1C01E31DD1342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e541912-33a8-4637-b2e3-7de863098235.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e541912-33a8-4637-b2e3-7de863098235.tmp
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e5841c-1c1b-4409-af7b-ff3944f3a944.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97e5841c-1c1b-4409-af7b-ff3944f3a944.tmp
Size 12KB
SHA256 5da4bec9767026e3f8653bca6dcf8ca305cda92bd48d3dba51615035c5cc06c0
MD5 7e184bb203fc8e43cb0f81e80371adff
SHA1 db071bb19c6b592ee3da438956c76f3f4ed91d0e
SHA512 c06cc4b7506df7fc26792ae98d3eb0fb84176543028662075cb1e156083c582be700682bcbf2a37e25c7df112bdc7f0d68c6a23158951a3284c810c8e560513d
SSDEEP 192:gRoANjv7cvYPRp6+NXsb+WNn4EYW22Bro2GkEkw5OmiyIsnAUgE:gRoANbACXbXwx82O2GkEZwE
TLSH
T17742B52DED10B53B9CDBD219FE267B53E6F5103220901E84EAFD892C25E79CE621750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 504B
SHA256 60c43e11b1d64cc8e57e8519393318011f6ea4261948b91dcf79039351b1621a
MD5 7b767b5f5fcf3f1d91e920ab995f6b0c
SHA1 24a9740dbd10f2f464f99a51d8391d9b69958df9
SHA512 5ab3013db994491b2cba1ffa28eda81ae5d10e2b614d1d8a07704a29917ad26333b8a0b5f8290ce90c312fdec259daf051250f87cf0c666adf31275a65cacde9
TLSH
T1FFF0DFE191D0121CCB92813148F88D453832C97F6EC74F635466C7BA5B0379C40513A2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5df57ab0-08eb-428a-a6f7-745c3208abc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5df57ab0-08eb-428a-a6f7-745c3208abc2.tmp
Size 4KB
SHA256 ab567c405102bff7d079ace61250b4aac8d086fb3d5143e01604926ebc9c1004
MD5 6ac053cc000cd3ac994a499720609461
SHA1 427ca83a8ae3003802d5b955b15cd5a0295c5d49
SHA512 f80a046f5e48257ecec6596643a54ab7cd3829c3c9716a250c0031b166207c3ee9db9aaaa30ed5680769fec4af2a531c9fc225d2c833c6f6d968a809b9ff366e
SSDEEP 96:DS+maaEf8N+IesezVduZbaB2an8+VRv1K:DjmaaEf8N+IesezVduZbaBD8+VRv1K
TLSH
T1C691ABF783F4992DCD2152F4AA262E1FCE5D0918531C787BC9D46F1B57E2470E24068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4fd502f-b14e-4f3d-abd2-35d8cd9c10f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a4fd502f-b14e-4f3d-abd2-35d8cd9c10f1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a1e22d46-1166-49e5-9ffc-364ba15cefa3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1e22d46-1166-49e5-9ffc-364ba15cefa3.tmp
Size 11KB
SHA256 53a3d2d4fb02099441dc3d628f5b2cc11acd5c290ba2dfa0427226f009282f1f
MD5 ba622688f26c9d9fffbb3488a1a393ce
SHA1 0a8d9637306565437c5c62011db93f82e11a635a
SHA512 2fb500694b0ab93a52bff54e25ee776df2eecd76d9c2589a17dc160ac79cc05ad814f10137e467003cf2a9df1db6867371a840d5f8f25d521815114b49149e04
SSDEEP 192:gRoANjv7cvAPRp2+NXsb+WNn4EYW22/o2GkEkw5OViyIsnAUgR:gRoANbA6XPXwx82w2GkEZJR
TLSH
T13432A42DED20B53B9CDBD22AFE227B53E6F5002124901E84E6FD892C25E7DCD621750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad7c27f1-ebbf-430b-9fe1-4c284a6abeeb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ad7c27f1-ebbf-430b-9fe1-4c284a6abeeb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download