hxxp://google[.]com[.]br

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
835s
max time network
823s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com.br
Sample260701-m91bzaev7w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6072	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273780373958195"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
4388	chrome.exe
4388	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 5220	2012	chrome.exe	88
PID 2012 wrote to memory of 4956	2012	chrome.exe	89
PID 2012 wrote to memory of 4956	2012	chrome.exe	89
PID 2012 wrote to memory of 6072	2012	chrome.exe	90
PID 2012 wrote to memory of 2632	2012	chrome.exe	92
PID 2012 wrote to memory of 2632	2012	chrome.exe	92
PID 2012 wrote to memory of 2628	2012	chrome.exe	93
PID 2012 wrote to memory of 1648	2012	chrome.exe	94
PID 2012 wrote to memory of 2628	2012	chrome.exe	93
PID 2012 wrote to memory of 1648	2012	chrome.exe	94
PID 2012 wrote to memory of 2552	2012	chrome.exe	95
PID 2012 wrote to memory of 2552	2012	chrome.exe	95
PID 2012 wrote to memory of 676	2012	chrome.exe	96
PID 2012 wrote to memory of 5708	2012	chrome.exe	98
PID 2012 wrote to memory of 5708	2012	chrome.exe	98
PID 2012 wrote to memory of 1320	2012	chrome.exe	99
PID 2012 wrote to memory of 1320	2012	chrome.exe	99
PID 2012 wrote to memory of 4416	2012	chrome.exe	103
PID 2012 wrote to memory of 4792	2012	chrome.exe	102
PID 2012 wrote to memory of 4416	2012	chrome.exe	103
PID 2012 wrote to memory of 4792	2012	chrome.exe	102
PID 2012 wrote to memory of 1732	2012	chrome.exe	104
PID 2012 wrote to memory of 1732	2012	chrome.exe	104
PID 2012 wrote to memory of 4012	2012	chrome.exe	105
PID 2012 wrote to memory of 4012	2012	chrome.exe	105
PID 2012 wrote to memory of 1640	2012	chrome.exe	106
PID 2012 wrote to memory of 2476	2012	chrome.exe	107
PID 2012 wrote to memory of 1640	2012	chrome.exe	106
PID 2012 wrote to memory of 2476	2012	chrome.exe	107
PID 2012 wrote to memory of 1060	2012	chrome.exe	109
PID 2012 wrote to memory of 4016	2012	chrome.exe	110
PID 2012 wrote to memory of 5696	2012	chrome.exe	111
PID 2012 wrote to memory of 4388	2012	chrome.exe	112
PID 2012 wrote to memory of 4480	2012	chrome.exe	113
PID 2012 wrote to memory of 4480	2012	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com.br
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd3abfc728,0x7ffd3abfc734,0x7ffd3abfc740
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,12968584787705811255,10601353799915922853,262144 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,7337859407246573517,13423013232785708142,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,13780781313294101428,6608574939123332100,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,17306851585841259751,4990701497881875726,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,5923605699123445651,14749056571147036095,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,8120251641518469421,12626265732309193141,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,1287496531601026566,4473060624620757688,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5272,i,16314917532587521295,12479630145912235589,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5300,i,10597776479797711217,10220049724802842557,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5620,i,15914050657697223952,11362648563977301779,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5292,i,11441693907152169093,6633207164908042919,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5900,i,1275117035030673417,6425210934878587967,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5240,i,2962980252831374166,4597105397020158338,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5544,i,11152617072079917527,7233104775430227983,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5540,i,4661752062180993855,6870827507291367813,2097152 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,8705104672605016119,14742840222631920664,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,9904172488460589527,17159799620503050267,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,10926649417516431531,1979502607994426761,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,6305734954221099829,7586230271269640429,262144 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2988,i,512655287809708696,12221835622471381095,524288 --field-trial-handle=1916,i,3504418610466118853,12081842339504168330,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:4480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1336

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9658c878-8376-46ba-a442-363dad7a278a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9658c878-8376-46ba-a442-363dad7a278a.tmp
Size 11KB
SHA256 fb8c8df3f2d06761286c81fcb3bffecf84f025fef4edaddd87a2edb13afb43f7
MD5 a36867db2985e3705e5b51191dd964a2
SHA1 b1d831bd84989107a01e928f72380fb5cb8fef92
SHA512 b6c39e4f06d190baaaab380dce4849cc52d7bedc4197b7626bb86fabe9b8fe336464583af75762e80a478ac793ba4855ea9f5050cd2debbdc5ddb1e8fd87169e
SSDEEP 192:ep+4K6h97KxkXqK4I40pUZNCgVLHrKHfFKslERL1XzKD/qd+ErUkKN9sMayzjPZj:U+jS97KxkXqKf/pUZNCgVLH2HfgslI1i
TLSH
T1B7320927A48D8A3F4FD8D50DCC176F8B6DB5019222684C2457FF9D0403A9B8E225E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 1dd10a3305064685a59c6fc006be10fd1d8c3db94e9485aaa0ecb479bdb917e4
MD5 0318a552b03e3f1159e3807cad12e2a0
SHA1 20656680387c506a4c7d462e585a90b73783cd37
SHA512 9e67517c98bb4be3bd3d3aa125582ab030b96828b887ff1fb1bbfc5513b7c82cae443b541b0204dc4d836070ca9cb7729c18aa4c2f88b7db570076e7ca5718a6
TLSH
T176D0A7A015784A36CB4013FD74830CDD7336B7A440C2579508C9C8F01B0256199B3102
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7e0be9f1981b6e41c070f334ced2188f73c078a46c7fa2898d53d0b3040ff844
MD5 75566f85516617eaa6f7cdaec319c77c
SHA1 3fd2546ebc5c961db93c1143fc8f5b10371e8c64
SHA512 2202e031cf59db3e220c99649319ce9a44a95f1de19adfdf74706dddb04107c2ffac411ddf39cb69645c973356a239e42e7c319d26cdb4e60dfe6146b021d20b
SSDEEP 96:DMLfXHuBZ4lrgUAoTJaVJsJgVJvJ7JY1JuJnJ/JW:DMLfXuD4lrgUAoNa/Cg/xVYfkJhW
TLSH
T122C18EF7C3D8C56D880155F4AB15AF1FCE290A18932C3D26C8D8AF5B93E2872E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7f66d540ad93d0814c5855f8b246403203f7d9b1cc35b10dbf186ae67307089c
MD5 3d0cfdc1de414e558a192d4531c048e6
SHA1 8773a56fe6a7764c71143dade9be00627d8b1a60
SHA512 a200428d7fce21dfe1a1e9418848bf4d57ae7e6d58b046d8ae34045dd9cb71daab9582d808b8ebe31759e8e6c1967252b31889b87c0c6af1324ab21b3c7fa3c9
SSDEEP 48:YALlh2hYhfhXhA3zwW3LWhh1syRsgXLsJfoKsXfsJos4Ks9JucsIJqgqmNOosvJa:D0itxmDZSlrgUAoTJusJtqmNO/JXK
TLSH
T179A1ADF7C3E8C52D890156F4E715AF1FCE290A28432C3C66C9D4AE5B93E2872E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3104616b4841826f623e3d47659e289f07c9e49199857e1dc791461a26b6da41
MD5 ce175a19da9e5dbc9aa37bc3b6ff132e
SHA1 99d00ac70280beeb8430a61d86372ce426282b55
SHA512 efcac740de4d6cc8a2bf1db680477907aeec8de95b4a1f92afd93ba8a6d199d19cc5efd6bfb8d384f5437b9454383ab49b34da803c551809a27d5dab227485c6
SSDEEP 96:DMLfXHuBZLrgUAoTJaVJsJgVJvJ7JxT5XW:DMLfXuDLrgUAoNa/Cg/xVxT5XW
TLSH
T1AFB19FF7C3D8C62D880156F4AB15AF1FCE2D0A18932C3D26C9D4AF5B93E2872D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1da687f49c29d4c7e9123c1869cc9a048633f22f5d9c3942a6085d0d394d0571
MD5 0a21e498da0227648ad32e6c5365bb3b
SHA1 ca2264c0c96118837dbd4c9aa542c104c01cc0b2
SHA512 b88242027433230bc5013fa1f52dbb7be4023c98907d998bc1460e7fedd9da0691f35fd6e993341a81c36f29650d213893f34a93b14581e2a322ec7647983cf3
SSDEEP 96:DMLfXHdrgUAoIJUJNJaVJsJgVJvJ7JwJK:DMLfXdrgUAomqXa/Cg/xVuK
TLSH
T1E0A1BFF7C3D8C56D890155F4AB11AF1FCE2D0A18932C3C26C8D4AF5B93E2872E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 fe0a07210f9e022526204745cf519ba66ba24df37a9595fa31c2cd82d8bdbc71
MD5 3317b96bc231004424b59e3e3848415c
SHA1 f167fa943ac4c9dbe2e220b2357c9e2161ed0c87
SHA512 af900927c7ce8a24fb5df98647a642950c3e79a9c6ca59e06a14d16dc9164f9473e8615c24e55c2895157a074f77f6eecf6a59b07ca28fa304ec980824ec1a02
TLSH
T127F059E7E639742B10BC85BF0D85FC06ADB5A835035169F8CF9A826CA0921F31B07853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2f0ecb28338d80f93fef8e531c769116193d1d70236a21bd2a45b5899ea717df
MD5 944d082eaf6980543bb9dbdee1d08afe
SHA1 8df4c645499a9f3c4e31ce33adbfcc0e410c010b
SHA512 1c09713b407c1afea5d322a16859071ec6797d3515ad6cd5f697d3ffa7fac63629a6b87f41592fed8e0bb8f1e00af9ee5b9649a5d7c149614393b35fc63e9abe
SSDEEP 192:KRVC6MY7Q7qkYcpXv7AvAPRp2/VqVo98Hsb+WNnV9hZVFo2KObdae6HVyIsnAUge:KRsnBRE6XO+wBO2ke
TLSH
T10D32A82FAE20653B5CCBC259FA65BB67D7F6102162D42E44DAFC892C12E75CC312B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e3791a755554b9add2be6a4bf64aaa341474eacc83160d7f89349ee96ddd1ac5
MD5 8ed06afc477a3345b6504d1b800689c5
SHA1 cc58ada194deadae2a35b1e3aea9b6670da9fc39
SHA512 99c78ac1f8c0943c2707991d80f5c627fb6b29ff708fffaea316fde9873a50cd53696ae399bfb2f47baf13b2e85f05126191dddb568add2993610a4ff33c1db8
SSDEEP 192:KRVC6MY7Q7qkYcpXv7Avv9PRpWs/VqVo98Hsb+WNnV9hZVFo2KBbdaeZHVyIsnAI:KRsnBREFX1+wBO2+E
TLSH
T1D042A71BB920653B5DC7D259FA66BB67E7F6102162D02E44EAFCCA2C12E75CC212B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4db3947884f69022ec506e1921a72bb2dd7848a25408a8aa2613df11f782f629
MD5 16100e73d25ad2676ba9b8e19c3545d5
SHA1 fefc9a9db531e0e1fa1cac072e8bc84fd7cc5196
SHA512 333f079eb5b73952d382810a78edc669f264ed8dbbd61a69a2532b21c987ed882e01bf0aa77d6633b11e9dba8bb818e0a92b8bd6019ac7fd170c9432b590fe9b
TLSH
T13AA0022022C64D79C84526F2528D0196729AFD18325ACB07AFDF4468AD97599690A046
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 9c0bf1758f29c2a2d81a6dddf4a57dd514b1a0683ac7aa67079db1bd81ec3720
MD5 e2f0215f99267c45fc1650b3fe588fcd
SHA1 bda0a7b93e4116e4e6a502abe5c5b2b6772599e8
SHA512 fbec4020aea6f33efc8138d2f372cd3137aa16c454a99b7c5a19911077f0d10cd3869bfe6b21ca6369138f904af45b28b943bb27fa50a66d3d47368656bdcf47
SSDEEP 768:8Y4CqiovKP9fUeKrnSS0ETfFL4dS8Bp1mkW2T/L6kg991B3zaMGXRo9CDvkGk:CCOKP9sSS00tkk8BLJS9L3zbEo9Ink
TLSH
T16513F130411E696F14E8B55CF5930E83DBB65B0F59603F4CEAF9EA1908F79DCA6A2007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 e1e0788074f44d66b3b3d063722b24f7e0b5ab2293617511486327f5997546d6
MD5 7e4a029279ae3f79637461882c282d28
SHA1 3f14ea259c65075a0fc42fea52fefc89316a7718
SHA512 3f4aa5198c2418f4bd2e7cebbea9e7eb02504ba428570497adc8ed81b182aa18824f0149f64022e06d8350419c64a6e44f27f3649e4c2f9e62dcf396a8f7b53b
SSDEEP 192:atPg4Cd1Og2XLa7iU2V5V8ECWKWAjWiD2uCg2:atY4Cd1OgYklRWLq2uCg2
TLSH
T1C9D11971B46D9DBB19F6B884B1032D03CDB4A09BAA147E68EDE91F0C01E75EC1393617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3584a0870db9a34f1f40a914b3144e190bff0b99529025f1b04d91fa1d61bce4
MD5 f0bfe25a8affdfb14a4e7ccc39bdbaee
SHA1 a689f05e1a9e8dd9b8a5044efb1702904a1a9c4e
SHA512 713b115df7dd0de76a1978fabbbcf139b9fd03493f3a913e2c662537e0488b7420a07afbbcb331e048f3be82f47fc8384dbf60851a8d4c5a68cf29e4c0bb19b3
SSDEEP 96:abJ6Md+pp4Cd1B3fkg2XLaB24Sl8h4otop5V9XDVIB6hC3GyvhrWgFI1QzbWl8tj:atPg4Cd1Og2XLa7iU2V5V8ECWKWgFJkC
TLSH
T116C11A31746DADB315F6E994B5033A03CFB1A0AFA7106F64DAE94F1C12DB6A82347513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ce38754a5a6797d17b3164e6411739b90f8b55bed34c6053df7887e3f61ae0aa
MD5 5df180a766aadf9334b5ce0e99b8539f
SHA1 35b778c26df30a15211d876200d13a75676096ca
SHA512 658a60f358e49547182461e8dbb31a780881452bbdbabfdc89e3e9b0ecf02a8d457344d1fc60a97a918d6744ba3924bedd9b0563df774627e68011c617a78b21
SSDEEP 96:aC6Md+pp4Cd1B3fkg2XLaB24Sl8h4otop5V9XDVIB6hC3GyvhrWgFI1QzbWl8tWg:aCPg4Cd1Og2XLa7iU2V5V8ECWKWgFJkC
TLSH
T14AC11A31746DADB315F6A994B5033A43CFB1A0AFA7106F64DEE90F1C12D76A82347513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfa753f0-1e1e-4325-a8ec-60074f24893b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cfa753f0-1e1e-4325-a8ec-60074f24893b.tmp
Size 4KB
SHA256 acea7b33c1d32ddb208a2e04a0e7f09865336d2352613a192efd5402bf078001
MD5 54891af480f7e1bdd95231fe562d2562
SHA1 12b5ea5b31bd6d1f11305048d83b4e92ffd3be98
SHA512 25b289454a8e508563438b717a10f2836bb1d762be3d1c1c4eb0d63470d4e7eeb4bce269e2d6bd2f54f2d4e7c292fabd6f66a44c62ebcc1abc47ed413d8c4097
SSDEEP 96:4C6Md+pp4Cd1B3fkg2Xf2iRDotok5V9RDVIB6KzGyvhrL3iDybLHAv4a:4CPg4Cd1Og2X7DUDV7V8zaKL3iDybLK
TLSH
T13BA12A32647D9AB715B9E888BA073A03DF71A09BE6116FA4D8EC1F1C21F71E81352617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download