hxxp://superbukster[.]xyz

Analysis

max time kernel
899s
max time network
864s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://superbukster.xyz
Sample260629-smepmsgv3v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe
Token: SeShutdownPrivilege	6248	chrome.exe
Token: SeCreatePagefilePrivilege	6248	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe
6248	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 6248 wrote to memory of 2288	6248	chrome.exe	88
PID 6248 wrote to memory of 4756	6248	chrome.exe	89
PID 6248 wrote to memory of 4756	6248	chrome.exe	89
PID 6248 wrote to memory of 4740	6248	chrome.exe	91
PID 6248 wrote to memory of 4532	6248	chrome.exe	92
PID 6248 wrote to memory of 2336	6248	chrome.exe	93
PID 6248 wrote to memory of 4532	6248	chrome.exe	92
PID 6248 wrote to memory of 2336	6248	chrome.exe	93
PID 6248 wrote to memory of 4084	6248	chrome.exe	94
PID 6248 wrote to memory of 4084	6248	chrome.exe	94
PID 6248 wrote to memory of 5244	6248	chrome.exe	95
PID 6248 wrote to memory of 5244	6248	chrome.exe	95
PID 6248 wrote to memory of 6692	6248	chrome.exe	96
PID 6248 wrote to memory of 6648	6248	chrome.exe	98
PID 6248 wrote to memory of 6648	6248	chrome.exe	98
PID 6248 wrote to memory of 6724	6248	chrome.exe	99
PID 6248 wrote to memory of 6724	6248	chrome.exe	99
PID 6248 wrote to memory of 1396	6248	chrome.exe	100
PID 6248 wrote to memory of 1396	6248	chrome.exe	100
PID 6248 wrote to memory of 6336	6248	chrome.exe	101
PID 6248 wrote to memory of 6336	6248	chrome.exe	101
PID 6248 wrote to memory of 3268	6248	chrome.exe	104
PID 6248 wrote to memory of 2796	6248	chrome.exe	105
PID 6248 wrote to memory of 3268	6248	chrome.exe	104
PID 6248 wrote to memory of 2796	6248	chrome.exe	105
PID 6248 wrote to memory of 1108	6248	chrome.exe	106
PID 6248 wrote to memory of 1108	6248	chrome.exe	106
PID 6248 wrote to memory of 2768	6248	chrome.exe	107
PID 6248 wrote to memory of 2768	6248	chrome.exe	107
PID 6248 wrote to memory of 604	6248	chrome.exe	108
PID 6248 wrote to memory of 6912	6248	chrome.exe	109
PID 6248 wrote to memory of 6872	6248	chrome.exe	110
PID 6248 wrote to memory of 6108	6248	chrome.exe	111
PID 6248 wrote to memory of 6040	6248	chrome.exe	112
PID 6248 wrote to memory of 6040	6248	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://superbukster.xyz
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd9c03c728,0x7ffd9c03c734,0x7ffd9c03c740
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7717456887603164228,5851093756575257744,262144 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,6086141633754752686,9614883776899001093,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,11096704349275295391,12781462636901861836,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,2920656883273212392,8207491171324534965,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,1086813418107902093,6315595131045289500,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,2672298312770178345,4972342926619569766,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,13251843337144773523,17173840777745517359,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:6692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,3500958296181811121,10088977352585072266,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5316,i,7319911357738435914,4627905210014142650,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5572,i,7370120926591448132,6988244215275112560,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5752,i,6648026770130904155,17325637948178286279,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,14074955726966812591,6132442137744286953,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,7255150866369197481,15554551919106943015,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5704,i,3510275643347096720,6113588806224535420,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5836,i,11892562998042754872,8273637797707077885,2097152 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,1588606973553574065,1441618113339163344,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,17377099260496665757,4944295934065771364,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,7454970630140008827,14600239939658466801,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6128,i,17413053346137526270,4555074619115054671,262144 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3048,i,15992918393164060892,12510541144831007630,524288 --field-trial-handle=1912,i,17726068222574964278,3110715626108254886,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
  2⤵
  PID:6040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5568

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 21e94bda57663ef2877b5cefdefc28b6fca8fad099e22610c163467169537ce4
MD5 7d4b3a00711d1041282deafe52b10d4d
SHA1 52f2e17399be4afed34bf5b6fcdcfcecd0109504
SHA512 1a22be92b148b86c8d56ca698524e09f7f58b749c1a4bc72f03d1d2a15fd5243c16c32c42041c20a6870a9fa8073af8dc0e993636ab25224d9e243ffdb060f76
TLSH
T140616BB7C3E88A6D891152F5AB256F1BCE6E0D18532C3C16C8D4AF1F57E2871D20124E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9e9ee7fb08bb9906e5b5713eabd8f650c37b30a01012ac78eedb6ab8d3712b53
MD5 459b6fa2f1d1ef493b1f8187a44cd075
SHA1 d1aa2883e6df45ee94bccafc3b7faa34645ba9c6
SHA512 dc9126ab9d266f7688522b7b122f4893ba316a7c876cb9990fcaf29298b6d1e233e9e4dd3d7802e2aa0cc6a5d7890f71e7a0f0c68b63e5ef7f9e39db71c6fb9a
TLSH
T15F517CF7C3E8867D891152F4AB256E1BCE6E0D18532C3C16C8D4AF1F57E28B2D20165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 beadcece02fb55670452e1a3625240b55c4b6cbf6a7239c56f71561fda379069
MD5 56b4b82dab3ed969d9cbc691612cca4c
SHA1 f085e411927ea922c2ccc3f59fa4b4abeb311c75
SHA512 1f2b69e3b39d31613de1a35dbbfd671a20b5ce3e98106f13f3b10ab5656dc780747009e11143f837c52d0724a806020e66b5e5ef03cc62926ab1e07a08106121
TLSH
T1B5516BF7C3E8867D890151F4AB256E1BCE6E0D18572C3C16C8D4AF2F57E28B2D20165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 687B
SHA256 8de4dae39b169faf225b7179eb8ccaf3755ba06ad9ac4a9d3b3f015f7f3dc7df
MD5 da2f9ff9d636a63711e4946476660f02
SHA1 db46a033527e308b088f9c0c1b509efc528cdd64
SHA512 a15d2a9569a0de4252ff20d38c8aba3d06439cd5a5cf2ef7e9d66610cf7a0a9d0d357d1ba7f22fe0029fbe5cbe81f52ed050a62c2bbdfffa024e3aa81a2c6e34
TLSH
T16F012BD7A17AB06B6079A97B1E047C066E75A432024168F4CEBB412CF1C35F31F264B7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4248a398c96255fbaf629bd049bf2f5311bbd7217d5f69171f19b1582ec86ab9
MD5 e335773a391bd0638c12710254d60439
SHA1 3386e2c1ac98cd69c2657adc8d7cdceeb1aed3d1
SHA512 bc13db681a7e1d99d85f1651be69ee89fc38e6b170172ac620d52b258a10a35b6e4d0074b5119b22a711b6725a4769b22d956012837ee94669ed37f697e1665f
SSDEEP 192:uRR2xb9Bdv7Sv/APRp6bg490Hsb+WNnTjbm12u2KVyIsnAUgE:uRR2xPdmniX6B+wH02ME
TLSH
T11E32856FAA10A97B5CCBD269FA25B793D3F5102165D02E44EAFC8A2C16E79CC2117037
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 1f848aa688155e2ab615738bc843daf6b8f14bbe671c3a4a784680704b5380e7
MD5 10ccaaf62ee6d4ec29f4177d6665def8
SHA1 82deee07efabfd40c9390d449016ca562478ffb8
SHA512 f0d1e38a67e09212352a7a9741e55de40141832ee866430ee521bb33e60e4adb2bfb8a3c22df3fb9033e82d440dc9916e6d3230fda7a079502c34422a025808d
SSDEEP 192:eUX4K6qs7KxkXqK4I40pUZNCgVLHrKHfFKslEmbQ8OXzKD/h0+ErUkKN9MbjWFCd:lXj5s7KxkXqKf/pUZNCgVLH2HfgslTOd
TLSH
T13B32E827A88DAE7F0FD8D509D8167F4B6CF5429276680C2856FF9D0803A67CE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdf803a9-ed1c-4c39-b7f4-d0ab5413e432.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdf803a9-ed1c-4c39-b7f4-d0ab5413e432.tmp
Size 10KB
SHA256 56dec8100b55f91c093693b8b263fe6bb003f8b02fe4db71d611dfd4e7dd9747
MD5 3d7019abe9af65f82c5add4dafbcd291
SHA1 a5bb89d1ba3b531a4f3dd4ed1cec90cccdc7c014
SHA512 349c8270f45b03e35447ff3fe77de8885ef41172f1e188f38947c6df6e4d9abccd9a7d338657b86cdece16591a04b3df50eb29ab3f3e4166e463e1032ca213c4
SSDEEP 192:uRR2xb9Bdv7SvAPRp2g490Hsb+WNnTjbm12uaAVyIsnAUge:uRR2xPdm6Xo+wH028e
TLSH
T10832A52EAA10B97B5CCBD26AFA257793D3F5102125D02E44EAFC8A2C16E75CC3117437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 2d189d7b35452fd2fe0b297e98a2f064d34c3f72009e10219c357a7c245bd041
MD5 08fe3a8197f4fbf3d60989a569bea320
SHA1 5ac0c85da3b75473b67afaf20d5fa4d52f150a7b
SHA512 7cba63296f126e5d74a28ac3247b71d4d6e570e4533abed413916053f1b9e49849f9c12f69533080d27c7bfc5bcd2558ad832bd7c4631f356187f17dac27cb34
SSDEEP 192:ntFsSoGXxZI86iU2u/WNRzH+KtsuCac8l:nt+SoGXjN6f8RzRtsuCazl
TLSH
T145C1F675A86DAC7749F6B486B1032E438DB821AB69547E58ADED0F0C02E75DC5343233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 8611501688a6ea90a08aa0533b91cf9a121d185d4ac117fe2797b7f20e8e79f8
MD5 08fb6ef94d9fb5cd62153cffe10d011f
SHA1 e77425774dfe21d016e9c063a8b87874ba991080
SHA512 83662b22e853273e394c45ab7cc873fff5633d64c71186d498dfc5cd97a3eb737bd36672fa50faf77f4bb1253cca632b66891bc5bb9dc12b81936714307383c9
SSDEEP 192:ntRsSoGXxZI86iU2u/WNRzH+KtsuCac8l:ntKSoGXjN6f8RzRtsuCazl
TLSH
T1BDD1F675A86DAC7789F6B486B1032E438DB821ABA9547E58EDED1F0C02E75DC5343233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8fd7609b638ab2174d3b8b18807adc0b56215f0c4183bcbb64bee40c65fcc172
MD5 2fb62f9eb806ec1ac31422c5096b3221
SHA1 afdb1cc6fe9c015743f5e8e288e8c38a3686ebc1
SHA512 6b9a8bbf24bc182a18a0703f211842dede5bf6f8c69bc5fcbc2fef5a8d5fbc910bf8e6d2295ac7b4a0b829fc7a61cd0dfa98cd10e7d77a8f03dfe1457b12c1f7
SSDEEP 96:jC6Wd+7S3YGHwmkwufuxZnI8qBmJRDotok589DZB6GGyvMbP7tcfbvpE69v4a:jCFsSoGXxZI8jDUD6/Wn7tcfbRE6h
TLSH
T11EA12A31B869AD3785B5D085B9563F83CE78216BA960AF98DDED1F0C16F71E81302633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a84b05b8249993d05ff7988615f23a47c5167060913217879ffc758f5234543e
MD5 686867a95b10d119cc387173b8f79f37
SHA1 b46e1368851886d9f5a509517d7e9df0f047decb
SHA512 2f8e6602a1eae42f5cfdfc70c825ba9f9484d13b64ae6ded7574adae3198663c92467c7ab58c0041e1c265e76243454c1741726b9bfa9767eaff823db4ceecfb
SSDEEP 96:nC6Wd+7S3YGHwmkwufuxZnI8qBmuSl8h4otop58lDZB6GGyvMbFBB151VaUz9+KR:nCFsSoGXxZI86iU2u/WNfTz9+KtfU3R2
TLSH
T1A5C11A35A95DAC7399F6E146F4032E83CEB421ABA9509F58DED90F0C12E71DC2302633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bbb0868ac579263f3c1085baaf3793b383f9d2c675830ac145856213d9355a82
MD5 91b62d0b4b1a46aa080798b9ac4f3e3e
SHA1 ea234ec16d7222a9b2ae061dad51ce9ad4e43513
SHA512 725a9c6fdb3fa50245ac4ca0e13fc3e35a39bfa74afc9b1ce5e94d1ede952246769909e77248962bcba55a84cb277318db797c3a80a6490fd5a3ad2afa0ddc44
SSDEEP 96:nbJ6Wd+7S3YGHwmkwufuxZnI8qBmuSl8h4otop58lDZB6GGyvMbFBB151VaUz9+C:ntFsSoGXxZI86iU2u/WNfTz9+KtfU3R2
TLSH
T180C10A35A95DAC7399F6E146F5032E83CEB461ABA5509F58DEE90F0C12E71DC2342633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download