43da44938268c4819296221bb2b90312086a708f13ced47d05e33b830712e679

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
view.html
Size 136KB
Sample261030-ryblpacy9x
SHA256 43da44938268c4819296221bb2b90312086a708f13ced47d05e33b830712e679
MD5 e76c9be6a91bfc9834a0f470ab88711d
SHA1 160b8381d41fba2eaa13d3017bf51a5251f233ba
SHA512 b9e0594f5af9701a955f22d1128c027ab808f165168f562f51bd935c06d274b9c5f0a3ba7821334011dead346267a0832b8027138402591d40f37b2ab1b21265
SSDEEP 1536:NE+V5zk7zdAH3xbzSVyY5/qP6QRv5UUKJkQRv5UUKJ7BDba8Dmb9QfH:Mm5BXa82Q/
TLSH
T18DD3976202119CFDEEB7845360891D5A3E6C0137B3925037F3DD9FB92B925EB062836E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com
18	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1800	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
2656	chrome.exe
2656	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3684	4416	chrome.exe	89
PID 4416 wrote to memory of 1800	4416	chrome.exe	90
PID 4416 wrote to memory of 1772	4416	chrome.exe	91
PID 4416 wrote to memory of 1772	4416	chrome.exe	91
PID 4416 wrote to memory of 2964	4416	chrome.exe	92
PID 4416 wrote to memory of 2964	4416	chrome.exe	92
PID 4416 wrote to memory of 2608	4416	chrome.exe	94
PID 4416 wrote to memory of 2608	4416	chrome.exe	94
PID 4416 wrote to memory of 5532	4416	chrome.exe	95
PID 4416 wrote to memory of 5532	4416	chrome.exe	95
PID 4416 wrote to memory of 5764	4416	chrome.exe	96
PID 4416 wrote to memory of 5764	4416	chrome.exe	96
PID 4416 wrote to memory of 2388	4416	chrome.exe	97
PID 4416 wrote to memory of 4760	4416	chrome.exe	99
PID 4416 wrote to memory of 4760	4416	chrome.exe	99
PID 4416 wrote to memory of 2744	4416	chrome.exe	100
PID 4416 wrote to memory of 2744	4416	chrome.exe	100
PID 4416 wrote to memory of 1264	4416	chrome.exe	103
PID 4416 wrote to memory of 1264	4416	chrome.exe	103
PID 4416 wrote to memory of 4912	4416	chrome.exe	104
PID 4416 wrote to memory of 4912	4416	chrome.exe	104
PID 4416 wrote to memory of 4428	4416	chrome.exe	105
PID 4416 wrote to memory of 4428	4416	chrome.exe	105
PID 4416 wrote to memory of 3592	4416	chrome.exe	106
PID 4416 wrote to memory of 3592	4416	chrome.exe	106
PID 4416 wrote to memory of 6044	4416	chrome.exe	107
PID 4416 wrote to memory of 6044	4416	chrome.exe	107
PID 4416 wrote to memory of 1868	4416	chrome.exe	108
PID 4416 wrote to memory of 1868	4416	chrome.exe	108
PID 4416 wrote to memory of 5556	4416	chrome.exe	110
PID 4416 wrote to memory of 5740	4416	chrome.exe	111
PID 4416 wrote to memory of 5160	4416	chrome.exe	112
PID 4416 wrote to memory of 2656	4416	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd8728c728,0x7ffd8728c734,0x7ffd8728c740
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,14863474181407493742,4426400755462572204,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,14846307645566059125,12429440393758572168,262144 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,6319645439687979366,17263228982176450606,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,11644659061897376669,10702631259456062836,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,4432627205765410877,16403159717772437424,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,17675899356124862231,17171700238252373529,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,8457359011596837300,9821439048004538744,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5868,i,1627391328101635888,13466082079449842827,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5928,i,10155918639855999811,10453000510401983696,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6232,i,5682311952012636567,11834846257299773502,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5096,i,15823179786016771051,14288792659768138619,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6388,i,3933051415832908468,9035799331812834793,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6352,i,6028496534303491438,10060953268061251079,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,10771661644590441704,5674591363974819821,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5912,i,4490252818241612635,15441267666018590375,2097152 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,212346875060260784,18430417071317763121,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,3039976736417887018,10271484394041869992,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,2871937569349306734,3044344949406024789,524288 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5176,i,9064405699200738135,13986961388446396887,262144 --field-trial-handle=1908,i,9661159084030635146,5783215123294023783,262144 --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

189c9a7f-6cea-42e0-8331-47d2efc7f981.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\189c9a7f-6cea-42e0-8331-47d2efc7f981.tmp
Size 5KB
SHA256 6ed36f56027874d00e819cb5c891f75624a081d08a16e18652fdf5c330bec602
MD5 ff31556669352e7cca693e6b0b384533
SHA1 79afe552eb3ac09d869f5531d0f638e3b2bf3194
SHA512 14ba8cbc8c736e14dac7ad3f6c693145bfce332df95203400c1cca0ab2abd551e459e47fbe8e8d45e28be701148eecfb3cd8ce36fb9280c69158bd6168a58368
SSDEEP 96:OC0d+OBIsu/Fl3fIUKsI8+I3Sl8h4otop5IbDVB6DGyvELc6w2N6+Rvyv0j9Iu70:OC0pB+fTbnFiU20rD/cFz+RvyvUw
TLSH
T1BBC10B30B86C5CB709F69584B5433D43CEB962BB5910AE50DFEA5F0D029B5F82342E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44f6472d-7f46-4928-8061-eb3d0c5d96ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\44f6472d-7f46-4928-8061-eb3d0c5d96ef.tmp
Size 5KB
SHA256 c0685ab04c987a7b086c2568ca5f58be809cb5f0500d849fd41664448d6aa8ca
MD5 eca0f33f14a9108d8b2f8bf26a730d60
SHA1 4d4fe228d8fe01da57de5ae0e6e4ca8649a2920e
SHA512 dbc373a429935d17828502ab372eaa679fc20240fb9e47621498fab78da95c6961fb4109a3f87dc98c8514e7cccaaec4164baf3b4d5ae8cfcd13dc0528a379f5
SSDEEP 96:sbJ0d+OBIsu/Fl3fIUKsI8+I3Sl8h4otop5IbDVB6DGyvELcb6XRvjRNC39ISyVd:st0pB+fTbnFiU20rD/cmXRvjuCbx
TLSH
T187C10970A86C5C7B0DF6A584B1033D43CDB921ABA8107E54EEEE5E0D01975FD2383A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

661f34de-06e9-48da-bd3b-c6866b7c53d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\661f34de-06e9-48da-bd3b-c6866b7c53d2.tmp
Size 4KB
SHA256 d1b3f39107af310c016889314f7e496730d37068cb0c44ca1973bf09ceaa0656
MD5 d86b64bf2816777abe3ab49448373b10
SHA1 827510dfb82c49b1d228bb62a0a4feecd6d66bf1
SHA512 3d9d54b21560ebc9a42250a28fdef44373652b78044ab06c990271cc1ae5fae09b7b025f030170e4e5258a69a8d30b25130398e96f48449d3ff0e440e82a2cf5
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5IiDVB6m8dGyvELkzAvrbuj1v4a:kC0pB+fTbnvDUDLr4w/gAvrbu1
TLSH
T1E5A12C30A8788CB759B5C5C4B5563E43CFB462EBA810AE80D9DD5E0D11A75F82381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b843a3c-9e97-43d9-82f1-0b1591c94202.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5b843a3c-9e97-43d9-82f1-0b1591c94202.tmp
Size 11KB
SHA256 985b6fc6ad3faa9ef9b2f210973423e9a11b01c0d9a46f8406889a6552ef36d9
MD5 1488b84dc634f91d40e50ae1d4250af9
SHA1 e5889d84b2e8f5421b673504d44b6ff662a9fc2a
SHA512 df33ba7891b839a1c881a6ef71f48a62a9628d2ccc1c4a83a486cd52d3154619e075aca8b9c93041ec84db6e659c17d4c22e91a5d4772c4f9f8757569737779f
SSDEEP 192:wRBhgoSXc9Evv7H8vAPRp2Xz9OHsb+WNnrcP7Wcmct+VyIsnAUgR:wRH0XgEnb86XckwAP6o2R
TLSH
T14732A529EA24B53B9CDBC329F962B747E6F9102624D42EC4E6FC893C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65c84153-91bd-46cb-848d-e0caa897b97e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65c84153-91bd-46cb-848d-e0caa897b97e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 72f06ecad132eb2ac871c58cf7945329af286c1bf5fd4174b2f3fa4a4ffccda1
MD5 2cbcb5c59e70d9eef66ca7f2d9ea84a0
SHA1 c3eb4d1d13c5dde15bde8efe6857d504792d2fcb
SHA512 13483fd9636b7b85ce0248c0c6a9db06de359aa3045111a5b4242b92818cae73b7fb2c7d88c1c7b2043d8a8a4ee8658323671857871c4d265cb67d24d09f1088
TLSH
T159B0125CE9861E41E7227A713A9000E02130356075F90B7340934A7C59613B08E06501
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

59427dd9-d5b9-46f0-910a-0231cb115e49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\59427dd9-d5b9-46f0-910a-0231cb115e49.tmp
Size 6KB
SHA256 a6d64aa30fb4d61188a6dc94c7280af03755e40bdb85813422e74fa0292874d1
MD5 92126cacf24bad3d972d7760fd73b7b8
SHA1 064873e74f9e6682ed632fe59056e697bb22e02b
SHA512 c0c1c816fa6e996021a39b3361b869f484c9c528772f8efd569c95bb609eba1a1d0ecdbd549c1d6bfb9abbe83180ea0332a41c5eee83a56b62c9de21efcd4907
SSDEEP 192:DeISb2E4T0cCaaEIjwvEKrTdAHCIY66kPTk:DeISb2xT0cCaaEIjwvEKrT+HCIY66kPw
TLSH
T1C0D179B7C7D8877E881256F0AB25AA1ECD2D161A422C3C578CE4AE4F63F1571D20269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a8199c4-1d53-4b68-b85c-a51c4a449b8c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6a8199c4-1d53-4b68-b85c-a51c4a449b8c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dc2bc59c-6620-4e46-af39-6451a7bff8e0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dc2bc59c-6620-4e46-af39-6451a7bff8e0.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2118d8c-1ba2-42ca-8579-f01815917b4b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f2118d8c-1ba2-42ca-8579-f01815917b4b.tmp
Size 12KB
SHA256 a02efb0131dec4cb30dcda14e0650af2dcd775a67dc1f6c7a9553c982a867508
MD5 dbdcaad94cabefe9068d50f5a29f97d5
SHA1 c6943d17255ad9769d06afc8cf391be2959f2c74
SHA512 db56752332ee37889cbbe19cd8b31c01df7574c5ff3374006e5978e944ab33e1ebcd4a0f3b20a79bc1ab327cef3653b6f04d7c008a4968683be925ae7b9e87ff
SSDEEP 192:wRBhgoSXc9Evv7H8vcPRp2Xz9OHsb+WNnrcPfWcmcP+VyIsnAUgE:wRH0XgEnb8mXckwAPuA2E
TLSH
T19542C729ED14B93BACDBC729F962BB57D6F9103620942E84E6FC893C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6fe9677-e5e3-4e87-80f0-0702c99d93ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d6fe9677-e5e3-4e87-80f0-0702c99d93ec.tmp
Size 5KB
SHA256 be90f1b4de699727825d5e21276e0ff6612b776632d5e059af00c6bdaa0bb41a
MD5 6a3260f1bc754c0f56afe1a5d099e784
SHA1 e80c0c23229721080a6ebaae431ac4988e66949b
SHA512 511683bc17d40db3112182e9220d4e243cb624472eceb6b8300c62d7a9fab4d956ea929f1235120d6a4aa248b9c54b2756798bb9987a7d01b371b87c371c32cf
SSDEEP 96:sbJ0d+OBIsu/Fl3fIUKsI8+I3Sl8h4otop5IbDVB6DGyvELc6w2S6dRvyv0j9Iu4:st0pB+fTbnFiU20rD/cFcdRvyvUw
TLSH
T1A9C12B30B86C5CB719F69584B5033943CEB462BB5910AE50DFEA4F0D02DB5FC2342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download