hxxps://somero[.]com[.]mx/dashboard

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://somero.com.mx/dashboard
Sample261027-3ht9msht4n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe
Token: SeShutdownPrivilege	5516	chrome.exe
Token: SeCreatePagefilePrivilege	5516	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe
5516	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 4580	5516	chrome.exe	87
PID 5516 wrote to memory of 4720	5516	chrome.exe	90
PID 5516 wrote to memory of 120	5516	chrome.exe	91
PID 5516 wrote to memory of 120	5516	chrome.exe	91
PID 5516 wrote to memory of 4532	5516	chrome.exe	92
PID 5516 wrote to memory of 4532	5516	chrome.exe	92
PID 5516 wrote to memory of 2084	5516	chrome.exe	93
PID 5516 wrote to memory of 3980	5516	chrome.exe	94
PID 5516 wrote to memory of 2084	5516	chrome.exe	93
PID 5516 wrote to memory of 3980	5516	chrome.exe	94
PID 5516 wrote to memory of 5656	5516	chrome.exe	95
PID 5516 wrote to memory of 5656	5516	chrome.exe	95
PID 5516 wrote to memory of 2228	5516	chrome.exe	96
PID 5516 wrote to memory of 1428	5516	chrome.exe	98
PID 5516 wrote to memory of 1428	5516	chrome.exe	98
PID 5516 wrote to memory of 5024	5516	chrome.exe	99
PID 5516 wrote to memory of 5024	5516	chrome.exe	99
PID 5516 wrote to memory of 5148	5516	chrome.exe	102
PID 5516 wrote to memory of 5148	5516	chrome.exe	102
PID 5516 wrote to memory of 3380	5516	chrome.exe	103
PID 5516 wrote to memory of 3380	5516	chrome.exe	103
PID 5516 wrote to memory of 5500	5516	chrome.exe	104
PID 5516 wrote to memory of 5500	5516	chrome.exe	104
PID 5516 wrote to memory of 2888	5516	chrome.exe	105
PID 5516 wrote to memory of 2888	5516	chrome.exe	105
PID 5516 wrote to memory of 4928	5516	chrome.exe	106
PID 5516 wrote to memory of 4604	5516	chrome.exe	107
PID 5516 wrote to memory of 4928	5516	chrome.exe	106
PID 5516 wrote to memory of 4604	5516	chrome.exe	107
PID 5516 wrote to memory of 5096	5516	chrome.exe	109
PID 5516 wrote to memory of 2964	5516	chrome.exe	110
PID 5516 wrote to memory of 6112	5516	chrome.exe	111
PID 5516 wrote to memory of 2324	5516	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://somero.com.mx/dashboard
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb5d5ac728,0x7ffb5d5ac734,0x7ffb5d5ac740
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,4035329729012205810,436309769252752809,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,15877494922908341053,4889570711181927179,262144 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,13946372691374682631,4478873599340053179,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,3722203564671513352,3950446278842578972,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,1693117605843740824,10777045773418752921,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,9128603497786294147,11473472827382940219,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,15654736013912554935,14807452413778347311,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5500,i,14635441545636243420,7507770213024977190,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,3212011076506611061,5694277733056112972,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,6541287272000339103,14956264984795795957,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5840,i,226077204776299549,3158986888735012313,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5588,i,3926834540971513827,13058692296880106646,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4832,i,14192212925727877196,6919374901462910294,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5496,i,1573086319107239181,5046165974325325540,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5832,i,7192905934874755908,214195896567335044,2097152 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,958183222059467201,9982469055785235688,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3136,i,17254028383965746882,16868387426164779090,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3880,i,2206405442566482184,8658222664425394492,524288 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=792,i,15949524261427439973,12037484171215170421,262144 --field-trial-handle=1984,i,10443301361511201820,10787313334780345566,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18198ea8-24ea-4a32-9a0c-d6e7af6ec706.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\18198ea8-24ea-4a32-9a0c-d6e7af6ec706.tmp
Size 4KB
SHA256 906e9d06a3648a785a435d0ffa6772dba56afcca1cf0ba4a3cf4d4932fbe8469
MD5 31021043044488d55062202f3076bb63
SHA1 b03272c0d28d633107cbe0139e3a79a98ae5d656
SHA512 c1d6094239818a0639b02af899d661aea5b5c4c058e63cd074739add6687f4b1100369fbf43a043c4bbb377efd73e6c11457e6916270d6018dbab1a8044114ec
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5S8DhB6vGyvQH4SYV0bblDV4a:qC0xJPz8/CkqDUDVXfr4SYV0bbX
TLSH
T126A1F931A8695DB794B6D585B2432E03CF64B197F621AFC0B5DD1E1C14F70E81751A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57729f6a-4703-4589-bb7f-588077282c6a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57729f6a-4703-4589-bb7f-588077282c6a.tmp
Size 5KB
SHA256 9aeb37d2d440ad6c13745036daf798b5d8373c2e4eeb5f64eb1ca483cc7abc13
MD5 1eb0e3716009c97dd00bb7bb04832c4d
SHA1 27db6170dd32224461a143dcef6450901f814d1d
SHA512 6c01ec049c3016ae98994d0e81e61c147ab3cc4be1fe3307bf44d518609881e072a71bf06156c992eca92ecaa321ae56f722411f4f4594896406c2dfbb87ad4d
SSDEEP 96:BC0d+qJw6eq8Em6eifKcIz5yNRSl8h4otop5SdDhB6hGyvQH4Q8TkZrQ1mJVd0j0:BC0xJPz8/Ck4iU2yX5r4Q8GGmJVdUa
TLSH
T1E9C1FC70AC6C6DB758F2D5A571472903CFA471D7F514AE90EADA0F1C04EB1EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b93437-72a5-4e26-b399-03f673e01637.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\87b93437-72a5-4e26-b399-03f673e01637.tmp
Size 5KB
SHA256 ba132c2a371cc2f817e1a54c8e1982452bfe810af8c4aba4e6ab0c640662622d
MD5 7209785c6b7295441b535c12cfc34188
SHA1 65e11447f0a40e8d9a80e21934f04aaeccbe5e56
SHA512 a1f0a93fa62b17ad1a5e5dcca06d1866b3bd3cf341a7d2c7714dba47ac67c0699ffba664d40acc8bb9980da14633c98232c4adf6533d228b32789b27684c7264
SSDEEP 96:BbJ0d+qJw6eq8Em6eifKcIz5yNRSl8h4otop5SdDhB6hGyvQH4QNeJV0RNC39ISZ:Bt0xJPz8/Ck4iU2yX5r4QNeJV0uCmB
TLSH
T10FC1EA74AC5D9DBB48F2F49572032D03CEA9619BB924BE54F9EE0E1C00E74EC5382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0be68946-192c-4958-8d35-18cba88384d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0be68946-192c-4958-8d35-18cba88384d3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

83a7756f-f52f-4fc5-aaf6-fd084d5b3d9a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\83a7756f-f52f-4fc5-aaf6-fd084d5b3d9a.tmp
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6e10195274c6d2e95087b975670036c819149deda8e8f688d38928481b6cf7bd
MD5 f2852a47b0d90a2371a86be7caa3abdd
SHA1 b3c3f48fa263e62a318a0524dba9fd4184373eda
SHA512 ef4e9ddc4ebc20dc7575359ff9dc1662a4e0f3bfc51c9f87bc3a46f8903130371c86b49e711870005e49c022ac03403e653d603060de0c8b92d7b944137920e7
TLSH
T1AE61B7A88EE42D51DFCCA8F045EA6DEA79300E5A36B70F5B62B4DC70E87F7C56440405
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

144cf0d0-dca6-4d7c-9bee-301613884879.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\144cf0d0-dca6-4d7c-9bee-301613884879.tmp
Size 5KB
SHA256 3c07420b291c929fcf9a2ebfda9e0b0906a5e91f0be5a802742e8e15e49385f5
MD5 911de84f80ca0e2ca16200d1f6eabdf5
SHA1 a8d0cfdd57d711a7540697234d6e388fcb902da6
SHA512 7bcec94251a25327ed274a6b605783603a564b492b1262b0ca54d06c78c6d6de60389bf3cb883624083be7d8a1becb9aeb4ea9a0e0504e3cc248b6c7051da7ba
SSDEEP 96:D/XEJgaIaEdQN8ZuNUvyi1Ml6medPtzNkiUFHiO:D/XEJgaIaEdQN8ZuNZi1Ml6medPtzNkL
TLSH
T1C6B166F783B8C62DCA1295F4AA10AE1FCF681120835C787684F4BD1AE7B3571E101B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d38c709b-e703-4914-8bdc-a9fffd85b987.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d38c709b-e703-4914-8bdc-a9fffd85b987.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fad62016-4d1c-4f64-8526-610216623a3c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fad62016-4d1c-4f64-8526-610216623a3c.tmp
Size 12KB
SHA256 edd37dd667b4d3cb93fc7228769b0bb0468590ca19ec74286e67684f1738938c
MD5 caa9fa8858d1fc0c09e0e9b0566de4d0
SHA1 5c222baf9684da00e87e554f8fb064a26c2fa37e
SHA512 22c488b129c3d798bcc917fe94564962498a097e35270658f4015089090bf14ffd98c27d6145ec7ab5a55715a5fe466a8669364070f6cce127736bb4806940a5
SSDEEP 192:vR08ZAeJKv7DvoPRpHbJ9bHsb+WNn9Czu22R8e0MaPCMVyIsnAUgE:vR08ZdG/yXdBw8j2jaPCoE
TLSH
T10E42B42AEE10793B9CDAC329FA757B97D6F5102261902E84E7FC892C25E76CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe0c0428-5293-46f3-8143-62923967cbd9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe0c0428-5293-46f3-8143-62923967cbd9.tmp
Size 11KB
SHA256 50db41829656289351030f48662e39f3682969cf95331e758403825c1bcd59eb
MD5 95db66c85d51daf4d2db2531ef57ae86
SHA1 cb6f961b2c4f4c9622a0489eeec0e99f03a473ae
SHA512 8fefd0da991bc8997ff3156293ad409e67002bfbbf77b690f84ca7da728480b264eade01a9a77b8765f70455b6f0d61c857c56b9c751681730277365f6fe1cf2
SSDEEP 192:vR08ZAeJKv7DvAPRp2bJ9bHsb+WNn9Czu22Q8e0MaRCMVyIsnAUgR:vR08ZdG/6XEBw8j2aaRCoR
TLSH
T1E132A32AEE10793B9CDAC329EA757797D6F5002261D42E84E7FC892C21E76CC7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc354d8d-2374-401c-b07f-7375100cc1f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc354d8d-2374-401c-b07f-7375100cc1f8.tmp
Size 5KB
SHA256 7f8b785ba2302708149ec52a646e7f6498047b5fadf7c7e95090ca25ae9d00c6
MD5 fa825c0ee785daae8b4901a854b6d6c7
SHA1 490a93fbcd1fabb867b8f4b425c57e8112e3e1b6
SHA512 b737bc4c5b5d7ca6a9b818727b533271cdf0fedee1f6ef4617d1801a2b2e729673bdeae2eababbe7d160467a78fd732e761284fb1424bf4f6dd01664a9908237
SSDEEP 96:hC0d+qJw6eq8Em6eifKcIz5yNRSl8h4otop5SdDhB6hGyvQH4Q8TkZrQMxJVd0j0:hC0xJPz8/Ck4iU2yX5r4Q8GVxJVdUa
TLSH
T160C1FC706C6C6DB758F2D5A5B1473903CEA471D7F524AE90EADA0F1C04E71EC1342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e05539e4-9184-4425-a8b3-9acdd0475469.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e05539e4-9184-4425-a8b3-9acdd0475469.tmp
Size 5KB
SHA256 887f8cfb487c81a9c409d48eff6439e7a8d3d0787784c250c9fd5d78abd93d30
MD5 50038e53f01e19027bc400acc5b076d9
SHA1 ae47e23b09de31dba2bf65c4c255f4dddeaddfee
SHA512 aa562d95811676ba30c6f6558258c8ce9fe6fe0d435ab7208ae81dd96c76d9f24c74f791bc9d491e78ca19978d61d0e1a9efc42820c582b029051d4bfa639448
SSDEEP 96:BbJ0d+qJw6eq8Em6eifKcIz5yNRSl8h4otop5SdDhB6hGyvQH4Q8TkZrQ1mJVd04:Bt0xJPz8/Ck4iU2yX5r4Q8GGmJVdUa
TLSH
T19EC1EB70AC6C6DB758F2E5A5B1472903CEA471D7F524AE90EADA0F1C04EB5EC1742623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download