42ba9ea52d3f591482f997b14bdb2095b5d94aff917858d600d4848da6300e70

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
free-claude-code-t41n9.html
Size 77KB
Sample261102-s6br4avvfv
SHA256 42ba9ea52d3f591482f997b14bdb2095b5d94aff917858d600d4848da6300e70
MD5 725de71eb8b645700e31361b7fba82cb
SHA1 f54a09fa0324004b11e0641777a46602844c7c77
SHA512 0439fdde975aaa4d7fbf9350f190a5c0bca763bce4c2e4cc0b336c4910000b6a8cd3b2c98ca6533d69a8a05d32977ee3c9a1481afc79c624b3fc99761ee6793d
SSDEEP 768:UiHojuX2+MDeblFdj2G5Epke0h3+3xSpnRMF0QTp1H90iy/rh/2smbzdWOIMk:oklmpk8xSpneGQTjd5yDl0zHI1
TLSH
T1C873E912A305293E70374AE5F65A73BE203A4143E90A0158DE7E53B41EDFD9DF93B988
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2308	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
5536	chrome.exe
5536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2504	4140	chrome.exe	88
PID 4140 wrote to memory of 2308	4140	chrome.exe	90
PID 4140 wrote to memory of 5628	4140	chrome.exe	92
PID 4140 wrote to memory of 5628	4140	chrome.exe	92
PID 4140 wrote to memory of 3316	4140	chrome.exe	91
PID 4140 wrote to memory of 3316	4140	chrome.exe	91
PID 4140 wrote to memory of 5184	4140	chrome.exe	94
PID 4140 wrote to memory of 5184	4140	chrome.exe	94
PID 4140 wrote to memory of 4116	4140	chrome.exe	95
PID 4140 wrote to memory of 4116	4140	chrome.exe	95
PID 4140 wrote to memory of 4596	4140	chrome.exe	96
PID 4140 wrote to memory of 3776	4140	chrome.exe	98
PID 4140 wrote to memory of 3776	4140	chrome.exe	98
PID 4140 wrote to memory of 2020	4140	chrome.exe	99
PID 4140 wrote to memory of 2020	4140	chrome.exe	99
PID 4140 wrote to memory of 6132	4140	chrome.exe	102
PID 4140 wrote to memory of 4172	4140	chrome.exe	103
PID 4140 wrote to memory of 6132	4140	chrome.exe	102
PID 4140 wrote to memory of 4172	4140	chrome.exe	103
PID 4140 wrote to memory of 5776	4140	chrome.exe	104
PID 4140 wrote to memory of 4740	4140	chrome.exe	105
PID 4140 wrote to memory of 5776	4140	chrome.exe	104
PID 4140 wrote to memory of 4740	4140	chrome.exe	105
PID 4140 wrote to memory of 2264	4140	chrome.exe	106
PID 4140 wrote to memory of 3500	4140	chrome.exe	107
PID 4140 wrote to memory of 2264	4140	chrome.exe	106
PID 4140 wrote to memory of 3500	4140	chrome.exe	107
PID 4140 wrote to memory of 2948	4140	chrome.exe	109
PID 4140 wrote to memory of 2764	4140	chrome.exe	110
PID 4140 wrote to memory of 2844	4140	chrome.exe	111
PID 4140 wrote to memory of 5536	4140	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\free-claude-code-t41n9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9b9a3c728,0x7ff9b9a3c734,0x7ff9b9a3c740
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1276,i,10841899242568237629,2326554281787709059,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,4418585701646271542,13375898292220575029,262144 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,8186093545485496842,9206778307104381773,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14408321324602591208,18100084425118759021,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,14517869813889064776,12933419789610250111,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,10673105297538802284,14749138017265171522,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5328,i,9661774385414139849,6911779625520392426,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5340,i,7928341744591615456,9949989582012907392,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5320,i,614248917527476633,5354139395331579336,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5332,i,13159070248860698870,7478576867541581541,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5336,i,10156456198186003120,6147817787129944065,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5520,i,9984976033061074766,18212276610444282750,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5620,i,15016275572671210058,8385736912942158440,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5344,i,12839255617845359716,9722722122868983137,2097152 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,6844988001274453278,5852642271118407280,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,16330831694546868886,12424877236015507242,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,13546956483408830978,5624893958627231002,524288 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,11966591164337092255,12631387172321199879,262144 --field-trial-handle=2040,i,13126003949641901173,14535401897017029094,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2197ac39-886f-4b72-b855-94d0cc62fccd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2197ac39-886f-4b72-b855-94d0cc62fccd.tmp
Size 5KB
SHA256 e4b6815b14f49c01b82708c71fb2c5414d7c57209f7a8576ba1548bb945c0e2e
MD5 3c88b7b4f24308d424c330b7d5e1ae4c
SHA1 2dfcabb9c5883dc29e64335bfeb453aef0030aeb
SHA512 706fa8530c58b18bed90fc0874322515d805a75365781b248416c23d0691fffab47628a59ac345a1f8f323ed2073bf4c1872e80d57b8e6650f67f8b4ffc54316
SSDEEP 96:VbJ0d+OBIsu/Fl3fIUKsI8UIhSl8h4otop57bDAB6AGyvELc6w2W6dRT00j9I+R0:Vt0pB+fTbnxiU2Tk4/cFYdRT0Upi
TLSH
T1BDC12A71B46C6CB718F29485B9473E53CEB462AB5910AE64DFDA4F0C01DB5FC2382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b901f50-3c6f-418d-8003-674c19578c85.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5b901f50-3c6f-418d-8003-674c19578c85.tmp
Size 4KB
SHA256 d16f510e152938a01bfcfc261c240a5e1096dc1e8dda73aaf34db26a8264066c
MD5 f343ca5c7006052fd7ad19b74f060e70
SHA1 001f892d8d114e812cde95db174799dde2c100d1
SHA512 3d57e47fc0d8f7d122c0c94828e6d2a0407fe9aae212c008d2e0af4ac62669083c80b6cbc186650e2a4713cb6583fbbb64d3521c36c5d7b9a64b5c24e754d83d
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok57iDAB6m8dGyvELkzATrbuj1v4a:kC0pB+fTbnvDUDgk4w/gATrbu1
TLSH
T139A12B71E4B89CB755B5C1C4B5863E43CFB462ABA8109E80D9DE1E0C11B71F82381A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81a0e936-7963-4492-9290-9955f5df0533.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\81a0e936-7963-4492-9290-9955f5df0533.tmp
Size 5KB
SHA256 0676d671951b2cf5b6b7e06a8a25ac560c00e0f795d6f12225b18ab46565c048
MD5 197539a0e32c96a58a7710200e458ff6
SHA1 b103b222dc8fcb3a82a22bfb0e65daee337672de
SHA512 33e5e3bcba86c8339cf6f7467c41053cb4090f67de279da6cb03e83cd067924e82cf55ee97c5190b643afc85b0b4ba7ca1bb82ba5a4e67f177644d6b29e83657
SSDEEP 96:VbJ0d+OBIsu/Fl3fIUKsI8UIhSl8h4otop57bDAB6AGyvELcP6XRTJRNC39ISyVq:Vt0pB+fTbnxiU2Tk4/ciXRTJuCq
TLSH
T169C11B71E86C5C771DF2A481B1073D43CDB821ABA810BE54EEDE1E0801975FD6383667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

199fd716-7435-4372-b53d-ff75f315ffdd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\199fd716-7435-4372-b53d-ff75f315ffdd.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7081f29d-8b7f-4b7e-9ee6-4a8192886183.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7081f29d-8b7f-4b7e-9ee6-4a8192886183.tmp
Size 12KB
SHA256 3e21107c32e2ac5ab57fe05fccd6fdc20d8397a5462621cd849c1b22df80212b
MD5 7b5ac53aa926f795332f9c92864a69ca
SHA1 8d0e335a15789a930f0c8bdc96e21cace340da78
SHA512 3e895ea703a612b93e5ef4f452f43e79930018b90d88831b5442dfc091373cea82acebd9a0e4f203693b66ccea445efa078acf8eb3a94864f4e47854910ca8ca
SSDEEP 192:wRE/XcCjv7H8vhPRp9XO9OHsb+WNn1gPYMtDOctawEfVyIsnAUgE:wRE/XNbb8BX4kwKPFtqwahE
TLSH
T12842C72DE914783BACDAC629FA21BB57E6F5102520D42EC4EAFC883C18E79CC1257017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b1e7d0f-eb14-4e6c-92c5-7cd63cce6d9d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b1e7d0f-eb14-4e6c-92c5-7cd63cce6d9d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2d8f7bab-9eab-4b15-85a9-c99ec7664f66.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d8f7bab-9eab-4b15-85a9-c99ec7664f66.tmp
Size 1KB
SHA256 18e4ab2affa37a6a9b93bdfa5f1ba68aa5e7baf30f614ac07b7aeac00b1c3d12
MD5 67968bd1249e9d651753afda4c235e66
SHA1 eed8feb5f0dafcfe1791805c4ece40f194601d0f
SHA512 18e0a916f3aff92abba649135737bfdc7f366eca13d14f278229f33f9a5261e6a3212dd6c77d81dcc709fb978aecb445bf01d465fcc8575a81b20c98f9df48ca
TLSH
T142316BF793A4857E8A1196E4EB15AF2FCE690524031C38A6C8E46E1B93F2972D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

d881d6f9-ac9c-467b-9b11-1d2211d7c9e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d881d6f9-ac9c-467b-9b11-1d2211d7c9e3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d67d25c7-2ebb-419d-90ae-f9785f8b36aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d67d25c7-2ebb-419d-90ae-f9785f8b36aa.tmp
Size 11KB
SHA256 d516a43b1fb5dd79eef4dfc2f4bbc43395499946dcb25b8cfa54fbc736b4ec3a
MD5 da8b47a4e37ba039d0f787d9b876915d
SHA1 3a20017e0980cf2afabca533c93d165786f42a0a
SHA512 1350e4656ee7f0458102a61d414a8b9ef7f1cbf1902da67902411ecc93f8a484112d08731ed35f0908645414c4f11e0af3b5b17e468bd81d986509c10f977f03
SSDEEP 192:wRE/XcCjv7H8vAPRp2XO9OHsb+WNn1gPfMtDOctawEwVyIsnAUgR:wRE/XNbb86XhkwKPUtqwaMR
TLSH
T1ED32962DEA14783BACDAC629FA21B757E6F5102634D42EC4EAFC893C18E79CC1257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d360665d-8f07-436b-a596-062f90478375.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d360665d-8f07-436b-a596-062f90478375.tmp
Size 5KB
SHA256 e03f201a96ab9d678959a4da8bb1f4858f7b34b20ddcd493de164a75e50a7140
MD5 6a28c25219779ca96595fde6a885a3d5
SHA1 c51147f83ebe06fcfbc19ffeb8b86c6612743035
SHA512 aad7e9e19d4de31cc252f492d3ac59be50a14784002761fdc64c11acd5c248d13747480cf6733c05ce2ce18daa6994a18269c053e1428364c4e8e9094f7bf5b3
SSDEEP 96:VC0d+OBIsu/Fl3fIUKsI8UIhSl8h4otop57bDAB6AGyvELc6w2W6dRT00j9I+RLo:VC0pB+fTbnxiU2Tk4/cFYdRT0Upi
TLSH
T14CC11A71F46C6CB718F29485B9473E43CEB462AB5910AE54DFDA0F0C01DB5FC2382926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download