bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
149s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260707-efkenaev2m
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2824	chrome.exe
2824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3500	2000	chrome.exe	86
PID 2000 wrote to memory of 2792	2000	chrome.exe	88
PID 2000 wrote to memory of 3688	2000	chrome.exe	87
PID 2000 wrote to memory of 3688	2000	chrome.exe	87
PID 2000 wrote to memory of 1820	2000	chrome.exe	89
PID 2000 wrote to memory of 1820	2000	chrome.exe	89
PID 2000 wrote to memory of 6104	2000	chrome.exe	91
PID 2000 wrote to memory of 6104	2000	chrome.exe	91
PID 2000 wrote to memory of 5892	2000	chrome.exe	92
PID 2000 wrote to memory of 5892	2000	chrome.exe	92
PID 2000 wrote to memory of 1476	2000	chrome.exe	93
PID 2000 wrote to memory of 5936	2000	chrome.exe	96
PID 2000 wrote to memory of 4904	2000	chrome.exe	95
PID 2000 wrote to memory of 5936	2000	chrome.exe	96
PID 2000 wrote to memory of 4904	2000	chrome.exe	95
PID 2000 wrote to memory of 2112	2000	chrome.exe	99
PID 2000 wrote to memory of 2160	2000	chrome.exe	100
PID 2000 wrote to memory of 2160	2000	chrome.exe	100
PID 2000 wrote to memory of 2112	2000	chrome.exe	99
PID 2000 wrote to memory of 2832	2000	chrome.exe	101
PID 2000 wrote to memory of 2832	2000	chrome.exe	101
PID 2000 wrote to memory of 2968	2000	chrome.exe	102
PID 2000 wrote to memory of 2968	2000	chrome.exe	102
PID 2000 wrote to memory of 992	2000	chrome.exe	104
PID 2000 wrote to memory of 3564	2000	chrome.exe	103
PID 2000 wrote to memory of 992	2000	chrome.exe	104
PID 2000 wrote to memory of 3564	2000	chrome.exe	103
PID 2000 wrote to memory of 2412	2000	chrome.exe	105
PID 2000 wrote to memory of 1320	2000	chrome.exe	106
PID 2000 wrote to memory of 5428	2000	chrome.exe	107
PID 2000 wrote to memory of 2824	2000	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffae977c728,0x7ffae977c734,0x7ffae977c740
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,18110038893992547036,5689502206353828002,262144 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1308,i,4560781001893355798,12643875761426217035,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,1392954888563491273,14615894166586398782,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,7265294756132113407,2353976194850373103,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,15742325698719617747,8339771190290003811,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,16042749968550834145,9175013974470727346,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5268,i,3928211790998471821,14084914120816921908,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5292,i,17539882578877153908,14590479731659935251,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5720,i,8803420567046906359,12207412285799334018,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5340,i,17599097215441720799,1185505731444800603,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5284,i,8638680193269166137,6177999053537522930,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5900,i,10726561664826530406,4346081628903790289,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5628,i,10985844721818034143,14249051957044544154,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5724,i,2304956027705319126,5905111309634258198,2097152 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,5057507737346079994,7930101372552481732,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,6884790813939577981,17616287063867815736,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,10227351073400520466,17943989190664631100,524288 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5876,i,3150151371986896874,14020105337058259642,262144 --field-trial-handle=1904,i,3763285165469978671,8545893763592074968,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 638b2205cce52163ec9064b1cb0380134014881bc7e00b5d67c6083c46e64e98
MD5 5ce787d1ec2a034bc0ecf8b5b043045c
SHA1 a976bc9bc842394c8a80d3e5775fac8e9e343175
SHA512 0ba6cc52d8e1f929b62d9ef688ac5e423b6e018a72bbd5f8dba8e66d3af19953a1aec2bd3285f2a4609b411683e4a235d8aa83fa2ff5d0b717d177538494e107
TLSH
T15241ACF3C3E8997D894116F4AB156F1BCD2A0A18031D3C26C8D5AE1F93E2976E20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 a194961e221bf1f8a14c969f5aa5e8f3481fba66bcf99b7b5605f511e649612d
MD5 d15fda88c8b15e09b370d6b3b2826705
SHA1 79f04bda508d7b7e6f30762d869785409d073058
SHA512 cde4467f32a87c8b019ac8186b13202feae16061183f8bfe1f0039e602df7a02c877630ac4c5d24dfa3105c50ae28135a67c3943e91ff199cc030a7737dbb609
SSDEEP 192:VRTgNip1uv7svAPRp2d69SHsb+WNn482OQcVyIsnAUge:VRoi/KQ6XjYwr2j4e
TLSH
T11022962EAD54A53B5CDBC31AF925B753E3F5102132A52E84EAFCCA2C25DBACC6117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cc3ddb1f84684fc544131000e76a2e50a4fbb4cc4c084f87fb6428ca37ffb3ea
MD5 0ffddd6e9d809e078e62b030ffe3433b
SHA1 be0e83053e2561f0512978f8d2ac3a0394156d3d
SHA512 b55ab98560bac094b28d045192e87a4cf60d3e5cd4c6e6bc1fed65b4cd0ab7323689c9c6153b5311fca977f2e91924e777d9aa655b79705dd4f3c0ccb79a2210
SSDEEP 192:VRTgNip1uv7svnPRp0d69SHsb+WNn482cdcVyIsnAUgE:VRoi/KQHX9Ywr2i4E
TLSH
T1DF32B72EA914657B5CDBD319F925BB53E3F5102132A52E84EAFCCA2C16DBACC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 35ac1d7bde34106b20ae5dbc9d995113909828279fa40337c49bf96b16877092
MD5 ce0d528cbe8d37ad7a9d0c11a5256af9
SHA1 12c2c85e2e39453d5f7d7d735fa2998254591606
SHA512 fbf75219df63af73e9bc262a17401416adee4bdb2d4a25357be9f55c54438393924cfd7751551ae328b45c7a4350e06bbe6aec272e0550a782001dcb5083bc9f
SSDEEP 192:ebgOCg24K68O7KxkXqK4I40pUZNCgVLHrKHfFKslE1DgOCg/XzKD/MgOCgP+ErUt:2Mj/O7KxkXqKf/pUZNCgVLH2Hfgslole
TLSH
T15032C927A48D9A3F0FD8D51DDC176F4BBCB5025263780D24A2FB9D0403A978E115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 afaebc5da2aaa72f564b3d1a149b8eaf7f0df6e61d8326fb26745803423fc3a4
MD5 9c0cbe8a7b5d07e154b2454e3d43937e
SHA1 346b2027aff64fe270312e41ccf757bdfd9f0b80
SHA512 4a1b80403bb8e90d7f8983fbfc2cfdffd8ee60a845f55222ea59fb2795cac3d4e7b4949bfcbc85a936099b1e4e10f86d4d34e506e6f5999f221765ce67d4ffa8
SSDEEP 192:EVtPzsMNLxsGr6biU2HDfwW/QknkXuHEGe:EVtPIYLxV6bW4kXkXukGe
TLSH
T1E3C11932A86D9CB74CF3E588B1023D43DD64606F6665BE98E9ED4E0C01E78ED4347123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c2383b1606af0ff45baa615f988660a2c239e26a6dd742754acf69d4ca3d7eb9
MD5 d4ef7f526f57d34897c10fbaea343683
SHA1 f88801daf854ddb34c58dedaa8d3484ec053929c
SHA512 5cacd116aaad8372529e76dd2be1efa13cb7809c2b386ecd2326480d3bdc60f2887283822a0de28500b0541b08672078b67bb0e04fd3c41a3084953b1dfae7d5
SSDEEP 96:EVbJ6Yzd+nTANLxvf8xUrbOuLwSl8h4otop5R5DdB6DGyvkQwFB2zbD0/QankX0I:EVtPzsMNLxsGr6biU2HDfwwFB2Y/Qani
TLSH
T109C11972B87DACB358F3E685B5022643DE7460AF55656F98CAE90F0C11EB1AC1307637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7ae485af41a281355bc2bdf6e14764d97c82723b1b58e9b079ec5f105b9d01b5
MD5 a6bcf02f0e654ad97e7fb8b99300c96c
SHA1 d304b1d29c36a7679352fbfa7e1431c5462a5d6a
SHA512 d3f2c05b9c197a53f30d10e464431ced83301f56efdf971bf0f26ef8d829adb9af82b88c52fe5ce35777c7261f5204c315236c963be024560f79734368ab9537
SSDEEP 96:ElC6Yzd+nTANLxvf8xUrbOuLWRDotok5R9DdB6DGyvkhGkYPEgxCv4a:ElCPzsMNLxsGr65DUD3DfBGkYs1
TLSH
T123A14B32B47D9CB368B7D28CB9427E43EE64606B6161AFC8C5DC5F0C15B74E80306523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7f71efb2224bde713aed1bf2d323449412a154d1bc1cc8d59981496a191cdba3
MD5 356eef1ce8aa168327c208cf6ef0409a
SHA1 4169419e80f705e8144159279a535cfe30abfaee
SHA512 2ee45d45d3604441e5d163943413faeb861b0c13f39462d170982397d0f1a44e9979b1b06dddefd20fdace6d45feb97f9818d070ad2a725c62d68ff9fa387857
SSDEEP 96:EVC6Yzd+nTANLxvf8xUrbOuLwSl8h4otop5R5DdB6DGyvkQwFB2zbD0/QankX0jc:EVCPzsMNLxsGr6biU2HDfwwFB2Y/Qani
TLSH
T159C11972B87DACB358F3E685B5022643DE7460AF65656FD8CAE90F0C11EB0AC1307627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download