6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6

Analysis

max time kernel
900s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fML5YnUq.html
Size 3KB
Sample261026-tp7nwabd96
SHA256 6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6
MD5 bee2ecad568cca3bbba7dcb9f3ced48b
SHA1 927852d4fc04ce2952187f54179d0f651be57179
SHA512 b759f1f046960c2c9bc20b1f874fadaf76ec9caa7321fcb0bcaf5ffe7b7a7828a84ca4b7d3a0030c08aa20966fe2394fc071b5b1b5de0ae938043b8a2b96ca1b
TLSH
T1656142038840C8279165A3347AD2F508CA68D183D35DADA9B29E119E5AC7FA1C7F72F5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3404	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4920	1276	chrome.exe	88
PID 1276 wrote to memory of 3404	1276	chrome.exe	90
PID 1276 wrote to memory of 3136	1276	chrome.exe	91
PID 1276 wrote to memory of 3136	1276	chrome.exe	91
PID 1276 wrote to memory of 4404	1276	chrome.exe	92
PID 1276 wrote to memory of 4404	1276	chrome.exe	92
PID 1276 wrote to memory of 1008	1276	chrome.exe	95
PID 1276 wrote to memory of 2280	1276	chrome.exe	94
PID 1276 wrote to memory of 2280	1276	chrome.exe	94
PID 1276 wrote to memory of 1008	1276	chrome.exe	95
PID 1276 wrote to memory of 4980	1276	chrome.exe	96
PID 1276 wrote to memory of 3992	1276	chrome.exe	97
PID 1276 wrote to memory of 3992	1276	chrome.exe	97
PID 1276 wrote to memory of 1264	1276	chrome.exe	98
PID 1276 wrote to memory of 1264	1276	chrome.exe	98
PID 1276 wrote to memory of 3180	1276	chrome.exe	100
PID 1276 wrote to memory of 3180	1276	chrome.exe	100
PID 1276 wrote to memory of 5460	1276	chrome.exe	101
PID 1276 wrote to memory of 5460	1276	chrome.exe	101
PID 1276 wrote to memory of 2788	1276	chrome.exe	102
PID 1276 wrote to memory of 2788	1276	chrome.exe	102
PID 1276 wrote to memory of 5276	1276	chrome.exe	104
PID 1276 wrote to memory of 5276	1276	chrome.exe	104
PID 1276 wrote to memory of 2368	1276	chrome.exe	106
PID 1276 wrote to memory of 2368	1276	chrome.exe	106
PID 1276 wrote to memory of 2748	1276	chrome.exe	107
PID 1276 wrote to memory of 2748	1276	chrome.exe	107
PID 1276 wrote to memory of 5592	1276	chrome.exe	109
PID 1276 wrote to memory of 1940	1276	chrome.exe	110
PID 1276 wrote to memory of 2016	1276	chrome.exe	111
PID 1276 wrote to memory of 1148	1276	chrome.exe	112
PID 1276 wrote to memory of 3520	1276	chrome.exe	113
PID 1276 wrote to memory of 3520	1276	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fML5YnUq.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff136ac728,0x7fff136ac734,0x7fff136ac740
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1296,i,17874548886333298180,5634657968889064034,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,14727260111920589948,16172533734444646618,262144 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,18197901023158577901,2921185812093593434,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,11607828248643253771,7605964003144803147,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,18025522697738436137,15927150362728543075,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,2576853366392408819,9396745616015323154,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5332,i,17301956743488597272,12668360040624362775,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5344,i,634305037160454707,568706779753764591,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5656,i,18183275900084603819,8717435030076053453,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5796,i,7450839273199371587,15624195959158014586,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5408,i,17067629839690542747,17094141378578774367,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5616,i,16105657622274843864,1380693939060084260,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6324,i,3312885903736575517,7979059317879544129,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6476,i,7827629179981193547,11611394169038476738,2097152 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,12733202111152387538,3208092156620267093,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,4024336327176756107,2814168003681945169,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,1289386223032497347,3403585260772660731,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4800,i,748369366564369828,18309075672639072038,262144 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,6910120381978336319,9720535938749228017,524288 --field-trial-handle=2060,i,3814927053041917123,608270643651767815,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:3520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1280

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c1ba09d-9ff7-4cdc-b251-037fcca76d19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0c1ba09d-9ff7-4cdc-b251-037fcca76d19.tmp
Size 5KB
SHA256 c9ceb1269f6564a8afda84ae0e49ad7f410475f68c0866cc4b5bd5232b482f7b
MD5 92f31e5e90003171e815c5502141a811
SHA1 2ab99718906dc109464556fecc5f27d2e727df5e
SHA512 d36d6b114da167534e7f71a1224695555e6a8d367196345a394dcb6b2b1ecbcdc1acf97473a0641450f0bc2bb045898ed19db4169bffd9fd4a1a858bbec6554d
SSDEEP 96:wC0d+2+07WJ3aJPWyqgfdfQgKSl8h4otop5dsDUB6ydGyvQClg7cOqWenSNJ9N0q:wC0d57WJ3aJ+yh0iU2wYpwlBqmNJ9NUA
TLSH
T149C119B1B87DAC7755E69851F5033E43CDE8A1AB5960BF94CADA0F0D11EB0EC138A123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c41946a-81a3-4f1a-ae4e-dccfd2b0433e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1c41946a-81a3-4f1a-ae4e-dccfd2b0433e.tmp
Size 5KB
SHA256 0865e8296ff4f37cab6cc94d276a8fffcc380b7552dc42784c22af7d3e041d76
MD5 d980379d83808b6ad1fe4a71d79063dd
SHA1 bcaa469600da00ef6bf5c37c49880c55ca441a82
SHA512 f4aa12e17eb649b9f7f47d570ba149d0f9c73a72baa625ff31616d39fee3f2722785bd4a287ec7f72f5937a22447588a2f778cc0f84fc6138483feeab2deab5d
SSDEEP 96:wbJ0d+2+07WJ3aJPWyqgfdfQgKSl8h4otop5dsDUB6ydGyvQClg7cOqWenSNJ9NT:wt0d57WJ3aJ+yh0iU2wYpwlBqmNJ9NUA
TLSH
T1BAC109B1B47D6C7755E6A851F5033E43DDE8A1AF5960BE54CADA0F0D11EB0EC138A123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76558f4e-31fb-47dd-8a93-9b73a84dea7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\76558f4e-31fb-47dd-8a93-9b73a84dea7f.tmp
Size 5KB
SHA256 2ab3465a528873a6643bb59a2f22e091a2fe7b68f3871b96ddb0ed73a80f7526
MD5 8fc611ed70a0d7d26828b2a98f531f27
SHA1 b8663a3bd9bf28a35e153dde632c4ae8d6506fe4
SHA512 57a0f2351b8e7300d9b07ee817f65a8b768cf282d712fdaeace524c546bda059cc1d87d34322181e136b9a652073d1a0db8576eedb521ffe3a6accda5c8eb513
SSDEEP 96:wbJod+2+07WJ3aJPWyqgfdfQgKSl8h4otop5dsDUB6ydGyvQClgRnSXJ9ORNC392:wtod57WJ3aJ+yh0iU2wYpwlQXJ9OuHV4
TLSH
T1EAC1F8B1A47D9C7B59F6A886B1032D07DDE8A16F6D24BE58E9E91E0D10E34EC03C7523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d74945f-1b95-4a1c-8e8d-e0a7fe493901.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9d74945f-1b95-4a1c-8e8d-e0a7fe493901.tmp
Size 5KB
SHA256 b14ddaad3b617873b87ee2405b31391a519a3a2fbfabbbebc5b32881ccf4568c
MD5 dccd7fbaa9f4436495dc9e4645c63fc4
SHA1 9149075f7b57d7bb23ca0489389b23d28e9c3113
SHA512 7a57d79851244819a33640b9737bdcaf1c4d554a898b5f0c0b71cabe557797b99961ac34f0f7c55ce6ed99082ecb7b3ad5979c392548a4ceb5b5958fff9829b4
SSDEEP 96:wbJ0d+2+07WJ3aJPWyqgfdfQgKSl8h4otop5dsDUB6ydGyvQClgRnSXJ9ORNC392:wt0d57WJ3aJ+yh0iU2wYpwlQXJ9OuHV4
TLSH
T196C1F8B1A47DAC7B49F6A882B1033D07DDE8A16F6D24BE58E9D91E0D10A34EC13C7523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01a2031a-9a1b-463c-960f-dc3426f78480.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01a2031a-9a1b-463c-960f-dc3426f78480.tmp
Size 11KB
SHA256 4da3b5354296f0afc64c86b978dd27f399baec1d5a4574cb903b2f402ea8175f
MD5 de2ae0b7481e3abeed3b2a5ea1885297
SHA1 4859baaeadc4d4b3ef9591735cd4d88df3da0335
SHA512 b98509fcef50b052e82aa6d1fe365f84db5e9f8f0d5d518b43bc0f8a65bf18dbb91e429da315b2d962a21f07b5e0b6d254bca1751a0bda1c603b28f74f983138
SSDEEP 192:/RlYXi9gv7NvAPRp2HfT9zHsb+WNn/+PY+Ea1h/VyIsnAUge:/RlYS98Z6XElwWPWaZe
TLSH
T13842A42DEE14793B5CDBD61AFA21B713D6F5103122D52E84EAFC892C25E75CC221B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fcb49bd-a739-4703-9828-a830d6ddcebe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5fcb49bd-a739-4703-9828-a830d6ddcebe.tmp
Size 12KB
SHA256 9db226ef604b27a6224bf2bb7f1ea49ae63f0efbd67e5e691b574a175b56949e
MD5 993a2af25a61310a6291f7cd59841df8
SHA1 972fc8efed23f9ea9a1cde466617fead75a7fee0
SHA512 eb50c06e26d37c174225922ed4c3cba5d9f007cc78884d0f00455adc55d8564e6c89ab57fdeae02c63db7e989c81c437b77c5d8b1784e6ee02df5778fe36ab74
SSDEEP 192:/RlYXi9gv7NvqPRpxHfT9zHsb+WNn/+Pl+Ea1hiVyIsnAUgE:/RlYS98ZUXxlwWPDaiE
TLSH
T1AA42B52EEA14393B5CDBD61AF921BB53E6F5103122D52E84E7FC892C25E75CC221B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0052db06-454d-40aa-989d-134bb8ffde30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0052db06-454d-40aa-989d-134bb8ffde30.tmp
Size 1KB
SHA256 9dea170d43e13ab3175ac9767d4f584c6e184e8165e27e9f3aed1fda722a229a
MD5 f58559e84a4c1bd0cff515f69271b5bc
SHA1 60dd9d6f447d3a4de47e40daca8d497519035bdc
SHA512 8a5cc63023a9e9be235256a2f27d0214104981d733c8bc6e748df5c359b7af3c3ad812b133a0c32f92863976f6b1676f8cae98d0c6be2b467c8815744cf0a79f
TLSH
T1CA317CF793B4857D8A1092E4EB15AF1FCE690524031C3C7688E46E2B83F2972E11479F
MD5 SHA1 SHA512 TLSH

Submit Download

1dfab614-5985-4625-8148-89060c67537b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1dfab614-5985-4625-8148-89060c67537b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

28a00044-bb56-450c-8e9f-dedca66b4106.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\28a00044-bb56-450c-8e9f-dedca66b4106.tmp
Size 521B
SHA256 4f5a7feb944a5607d83234fcd16e0d8b3d0cce0478f5c1c975c1cf38654e34d5
MD5 6e4debde36bb133d2c981e420fb519c8
SHA1 47c784b37b7514b6d4612a9d882d2244e817c3b5
SHA512 668309bb427294a960ecd7c81aa010331c02bec476c45207e86d26216fe621caf2d531053d73fb70d15c9e0ac28eb423386391bea84bc31fb499fa99bd989747
TLSH
T126F059A7E67D75A700B955BB1F40BC0A6876B831024098F0CF5E827CE0810EB1B16457
MD5 SHA1 SHA512 TLSH

Submit Download

2e04da3f-d8c1-481e-9a8f-f65849e7dd16.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2e04da3f-d8c1-481e-9a8f-f65849e7dd16.tmp
Size 1KB
SHA256 8a0d33ea0df2a267fa05cc4774ec6dfa38597f4a979a6ae48230ff39c12dbbbe
MD5 b0603be9a6c66d9a29ed7f0086ec73dd
SHA1 50614612d76a4145b307bc523bfa4c409f9dd9ad
SHA512 b4bdde04c26f955cef50606197d37c7d2e68c50f2e6586ca11f651777b499aca137c2ad2e026f34e1f56949acce6dc8b39ceed307feeb76e8fd6e8e0b7819bb0
TLSH
T11E3188F7C3D88A3D891056F8AB152F1ACE290A14532D3D26C9D8AE1F53E28F6D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

4c0176e9-5050-4647-a5b6-08d2fb346746.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4c0176e9-5050-4647-a5b6-08d2fb346746.tmp
Size 1KB
SHA256 43e507fd9a14379cfd31ada29c65cccaa22341f8aa7ed56db97996c98a8d1dd6
MD5 518afada4b2b9d7983d0dcbbf81aebf5
SHA1 ca314c81108c4265c30c731b813c0ff5ad235914
SHA512 6bd60949cd3709dd8f2db44fdb3f4088484cb0a557050b41c8c5c0fa09a084b9e83d08d7a9b37a17d7aaf27b112da9739870a77226b4e4b0434b818e2cacfdca
TLSH
T12C318DF783A4857E8A1192F4EB11AF1FCE790524031C38A688D46E1B83F2972D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

885c4b93-bb96-4553-8905-67708a43575f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\885c4b93-bb96-4553-8905-67708a43575f.tmp
Size 1KB
SHA256 0ad82a04a0bbdb6ccbd69fdaeb9d9f9b0524b842288dc80ae3e38ef5dc4573d0
MD5 022b22f020b0c1f8fc52b02538c45d45
SHA1 da1c78af0bea5cf5cf21ce43e1b11adf49c3dafe
SHA512 90763dee6c854b34a9cb3f188dc5a95219b468d307b3ae8821f124382adf2ddab2b50365a395365c6e88f4203d79127324e5771895da8ba467e0d86449b6baed
TLSH
T160318DF783A4857E8A1192F4EB11AF1FCE790524031C38A688D46E1B83F2972D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

d07604d5-d6cb-49b7-9372-5aa902df532c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d07604d5-d6cb-49b7-9372-5aa902df532c.tmp
Size 11KB
SHA256 e4a6798a5a3ac5bfcdca0be1de7c1ba068de128e43648674a2965116a3931261
MD5 c2e8f234a92abc64bc610b7387f9806c
SHA1 f391f849e102e728082921cd7df078c80707f1ed
SHA512 1c7b51743330bbd656e783f6581c9cb403cd9fe0dbd23cc414c76dfc22d081a5d17455cd1f856f26622876f41f28b2b2204584121c65fd63978ca7f2e5db05fb
SSDEEP 192:e/k4K6dF7KxkXqK4I40pUZNCgVLHrKHfFKslEoHNXzKD/SF+ErUkKN9RK5Fc3DoU:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNS
TLSH
T1A732FA27A44DAA7F4FD8D50DCC136F8B7DF5029262780C28A6FB9C0803E978A51595BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bb2d64-bd54-4355-aab3-74d92e88e6a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5bb2d64-bd54-4355-aab3-74d92e88e6a1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bae9670a-170b-4845-9373-936f0764ef43.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bae9670a-170b-4845-9373-936f0764ef43.tmp
Size 4KB
SHA256 c29def98ac98113a2599549186ccb1596828804c6b63b70d9b300e8270d12be5
MD5 5afe5ae3e07f2bc14561833d0d8c9a13
SHA1 d193ea337ad1252488f81ace13dad8ef88c7bad4
SHA512 c471bf881d689447def343c1522d139751d625ee65fc4178f030999ab4544cb874a21609b43866eed100efe5aa3e6d43297751d216b1b82726cc922754843845
SSDEEP 96:8C0d+2+07WJ3aJPWyqgfdfrgnRDotok5d4DUB6FJGyvQCl47Y9ZPE4/Rv4a:8C0d57WJ3aJ+yhYDUDwYS0rY9ZsM
TLSH
T1F2A10970F47D9D7B55FAC986F9427A07DEE8A15BA960EF84D4D90E0D21E70EC0386123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download