hxxps://holcim-emea[.]com/supplier

Analysis

max time kernel
899s
max time network
874s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://holcim-emea.com/supplier
Sample260709-ea3daads2z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2972	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280423287161531"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4148	1728	chrome.exe	88
PID 1728 wrote to memory of 2972	1728	chrome.exe	89
PID 1728 wrote to memory of 3468	1728	chrome.exe	90
PID 1728 wrote to memory of 3468	1728	chrome.exe	90
PID 1728 wrote to memory of 1684	1728	chrome.exe	91
PID 1728 wrote to memory of 1684	1728	chrome.exe	91
PID 1728 wrote to memory of 2388	1728	chrome.exe	93
PID 1728 wrote to memory of 2388	1728	chrome.exe	93
PID 1728 wrote to memory of 1748	1728	chrome.exe	94
PID 1728 wrote to memory of 1748	1728	chrome.exe	94
PID 1728 wrote to memory of 3808	1728	chrome.exe	95
PID 1728 wrote to memory of 3808	1728	chrome.exe	95
PID 1728 wrote to memory of 5736	1728	chrome.exe	96
PID 1728 wrote to memory of 5288	1728	chrome.exe	98
PID 1728 wrote to memory of 5288	1728	chrome.exe	98
PID 1728 wrote to memory of 3020	1728	chrome.exe	99
PID 1728 wrote to memory of 3020	1728	chrome.exe	99
PID 1728 wrote to memory of 3764	1728	chrome.exe	102
PID 1728 wrote to memory of 3764	1728	chrome.exe	102
PID 1728 wrote to memory of 5292	1728	chrome.exe	103
PID 1728 wrote to memory of 5292	1728	chrome.exe	103
PID 1728 wrote to memory of 5976	1728	chrome.exe	104
PID 1728 wrote to memory of 5588	1728	chrome.exe	105
PID 1728 wrote to memory of 5976	1728	chrome.exe	104
PID 1728 wrote to memory of 5588	1728	chrome.exe	105
PID 1728 wrote to memory of 5152	1728	chrome.exe	106
PID 1728 wrote to memory of 5152	1728	chrome.exe	106
PID 1728 wrote to memory of 5960	1728	chrome.exe	107
PID 1728 wrote to memory of 5960	1728	chrome.exe	107
PID 1728 wrote to memory of 6000	1728	chrome.exe	109
PID 1728 wrote to memory of 484	1728	chrome.exe	110
PID 1728 wrote to memory of 4900	1728	chrome.exe	111
PID 1728 wrote to memory of 5040	1728	chrome.exe	112
PID 1728 wrote to memory of 3712	1728	chrome.exe	113
PID 1728 wrote to memory of 3712	1728	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://holcim-emea.com/supplier
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeefefc728,0x7ffeefefc734,0x7ffeefefc740
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,5100324920471814799,7518331999758791275,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,7626639772463465129,8342897319565957009,262144 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,5287492526980221232,82856171312401118,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,799114283354353844,3846794873593720092,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,9528335385525447411,9037877366241363489,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,11395438823602429952,10600387657165994680,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,6982315404000211809,5355103135705982642,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5540,i,2754987820225366381,15262472817886719725,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5568,i,4580249755244445048,2113986147852058633,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5620,i,13883724625714412869,3423744591941786307,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5976,i,1239719068920642650,1367021858560415864,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5592,i,16571331680659538113,15763924687928716378,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5988,i,1233338144469644395,1107468546950537073,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5604,i,8485036938093207052,13928915329073885276,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5560,i,5034444616592400119,1042068780311203529,2097152 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,4121457960075805880,5801494410486621123,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,7840173662483918500,9546750036440177551,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,3403226749893244835,1965552064075541049,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3472,i,14360697310533706417,12293281363302274588,262144 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3088,i,7360784924737762949,15043073644097754017,524288 --field-trial-handle=1992,i,2359026524817505146,16210535300221243746,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:3712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4716

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 522ebdbeda5aacbdef9483825d8d83df364bc94b86959c85c8a8668b1f5e3e55
MD5 e48647b1b7d15261f59eb708353b0605
SHA1 7518a68b5a82f53321b8fcfd64d189dc04c9e79f
SHA512 2db492033f0ca3733bf907f1af178f1bc085aa8606665cf9b6b07cdf1d0b6602c24dedbf11b61456d56de940ac2ff09114b37aadf8aea5cfc99317c9aed57274
TLSH
T1B01185C789E96C71DF5B89B25864CC8DAC0F0E013D916BBB74C0B4ED84832C6A006637
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4f94d373883b628251b42ceb5a367bb54643c64d2b3240786c1265366c20cb1a
MD5 69f87ab3ffd34238ef8a947140390082
SHA1 a19d11ffe932f386162c90c005ee02f751e93077
SHA512 8173ad8cfd397978b2a019eb570606d087b213e264113ac2c22c362a688e568aaab7a68a25a3d1874f83eff6ccdc7b6887273557d9edf3f087dcdbe7c122df02
TLSH
T13D51BBF7C3E4962D8D1156F4AB166E1FCE2A0A14532C3C6AC8D4AF1B93E2871E25074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a09d7f67f5eaac0bafbaaccd58d520c588303c68e18d3519ec47bb290493297a
MD5 8d01865c4179ed7e3aa3f3a59ec7f8e9
SHA1 b3384f9ef2b1c22d175276bc31b5b763dbac8cc9
SHA512 df3c3637b46078156327309cc9422197b2e1ec97b35bb6a7bdfbc0e487a7895aac96ce2372063b6f87448ba367f31cb78241da173240f307bea98c672eb3c4db
TLSH
T1FB51BFF7C3E4963D891152F8AB162E1FCE2A0A14532C3C26C8D4AF1B93E2871E25064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5470c3d4c33b3ad301b83ed218764a66855ee282efc63cdd57b16faeb5eb30cf
MD5 27f93655ca0ea12fc7ae50defa26db7f
SHA1 b019fda83de49e391d1f2c44f7b88bf050ce422b
SHA512 a942c1cc06b07bd6a3f9a57152b2ae54f6f9949e07a8a389bda3c5b9ee9301cc978115ccf5c17702b35e3a34d1f1c76bde6ab5f39757dedb781e5d7bfd428490
TLSH
T1DC61AFF7C3E8962DCC1156F4AB162E1FCE2A0A14532C3C67C8D5AF1B93E2871E25065E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 f2a0b07269644a6c48362046044603ea649554c3e8f5425a590e6823c07fb4e9
MD5 6447ac0848cfe826ec485e6775d4cd2e
SHA1 eeebdb56e33cb1d76695b4963575fece0b85c080
SHA512 86e9cbdb30ae05f21afc4d36bbaf4750fe60c7bc9df364386ec426e333fd91185b829376d64273ecfb602a2ca906251412abb2d46e6d0a561b30026b8eaf7798
TLSH
T11A216EB79A7FB46B207D146F0E44BC05697AB831024568E4DB6A822DE0A44F71F16077
MD5 SHA1 SHA512 TLSH

Submit Download

a34b7557-858a-4bc5-9cdc-92d71ecb4e8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a34b7557-858a-4bc5-9cdc-92d71ecb4e8b.tmp
Size 2KB
SHA256 0404869df860dbb328f7cdb0670317970ecb6bcafc1cae8bf18ab1e4a4a6c07d
MD5 67fe52c21de81774ecdf9fff4c05c1ac
SHA1 d786119df66bb459bb6bdb8bd236c4c32592adb2
SHA512 9e119c4d4b4814419c8f915a8f3b99255d3fd85ebd2c62e0224d0bb33fa4b0c44442a29831edfa32321022d179fec73e987e42832f090f91c8e79d73e04e9da5
TLSH
T1A8519BF7C3E4962D8D1156F4AB166E2FCE2A0A14532C3C66C8D4AF1B93E2871E25065F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 de1f37a9e2076069a15c0539bba7ed46ad7d2d65a734bb0c312a05ad6236b3ab
MD5 da11a57b7e2c9a6e397abcc54d6750aa
SHA1 58576284b24c0c316658084cc00e99e38a8b8442
SHA512 e84fefde17c1353607d42d24d02588f72b74a651f51e29b663b20bc428320942b3e93a95436ea98434c57cc0357fbd6f97749f19c0a3ce0a10d87d38b2299e0a
SSDEEP 192:RBR4BZn05v78vlPRpBs39vHsb+WNn5xeu292T5ieYQJVyIsnAUgE:7RyZ0ZgFXs5wf62ThvE
TLSH
T1AF42C82EBD15A57B5CD7D61AFE227B53E7F2106122902E84E6FCCA2C11EB6CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f3f057451794cad9bd36a00756f62f91fc6d5f8b6b65d92c9db8e3bb2d677555
MD5 dec14a0f749522dd88ce697e20a62336
SHA1 8647c3ad700a388da4696c1a414a76653626af3d
SHA512 df729673b51f630edaad86626f11c0c8121cafea3e779f64de8b0e80beac0cee427ea1f0dc64f5f04ef50b0daa7d864fa31537b2732e07fd347fec6310517e0d
SSDEEP 192:eNq4K6Hv7KxkXqK4I40pUZNCgVLHrKHfFKslEf17XzKD/cz+ErUkKN9qV2DcUSrE:IqjUv7KxkXqKf/pUZNCgVLH2Hfgslg7S
TLSH
T12632E827A48DAA7F4FDCD509CC536F4F6CB5029762780D2456FBAD0803A978A114B2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca11ff95-c78b-4d4f-a0cd-6ba25b173952.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ca11ff95-c78b-4d4f-a0cd-6ba25b173952.tmp
Size 10KB
SHA256 ae6d4051aa4fc20d7bad4c7c75255ad10507312fe0269677cb08871dba1b5ee9
MD5 704e6539335f3619dece1c8cbdb2012b
SHA1 035f9509c97d0e10e9e755acee2612111abdbd02
SHA512 2d506b575643cdba8d04a2fc95ff0ce8e52b2ade546eb75da3ecec7d97b3ad56f4f0da6a3390765a077c51c1f6d64775a56a4f6d4e505bc78ce450e49f28472a
SSDEEP 192:RBR4BZn05v78vAPRp2s39vHsb+WNn5xeu292Die0QJVyIsnAUgR:7RyZ0Zg6Xz5wf62PvR
TLSH
T18232972ABD15653B5CDBD61AFE327753E7F6106122D02E84E6FC8A2C11E76CC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4abc20d3e7652579faa3dd3da19bcacf515a0685163d016cc57c63086e364374
MD5 d5faacdb9f660e71bf39a0b1d121ef94
SHA1 993f59e090ab5161177b30b3918c50078d66a513
SHA512 0fe94f579191e4c41cde79e80f283f04d78a9d90e3a829f0b5d9e58e2ed0c653962fdb4b1e7e2bffedbe0b8a20dd139a16817d7e5b40dc5a10b8784e65c38c6f
SSDEEP 96:ceC6dd+BXK7CXon4efaRP69Sl8h4otop5zyDtB6SGyvLtJjaNrxwkYKMywwvwmDH:JCubWXon4XRCiU24zi+jcxof1wvwmDUs
TLSH
T17EC10972B83D687265F3E545B1036657DFB461AB9B00AF94AAE90F0C02E74DC1782613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c2c5834efbf11445f070b909b93fdd983eced1f2e5716ec08774f2b45204aad0
MD5 2c17340678e444415d18842caf2d0f47
SHA1 f0e4b64fdd96d5e9c8e34d7298d51a68512d8b7a
SHA512 6e0e72de420fd1114959f8717c7b367ee7f5cc76b3363602e11dfbb29a598f57d51767d61ed7bebc019573a109e8770a7eac67423d8cd57a9942571b6127c6d2
SSDEEP 96:cMC6dd+BXK7CXon4efaRP69Sl8h4otop5zyDtB6SGyvLtJjaNrxwkYGywLvwmD0S:JCubWXon4XRCiU24zi+jcxoG1LvwmDUs
TLSH
T14FC1F732B83D6C7365F3E945B5036657DFB461ABAF40AF94AAE90F0C02E749C1782612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 702ddc65b29140fdccfb9496231b964cdad2390cfd11069efa881bf4aeec6d17
MD5 bb31812c2177b09cad93a1a373b37762
SHA1 a6c406f7424173689d61347e3b7ffab03945c670
SHA512 740b03d4a52b065498cc509ecfbef3710cb9950eb034068ddc7c1296c27c9e51848e3f1f07b8522bc1dfb63c02bdf1b7f39db7a62b13f654cfa196d74830ed29
SSDEEP 96:cebJ65d+BXK7CXon4efaRP69Sl8h4otop5zyDtB6SGyvLtJOMywyvwBRNC39ISyC:JtGbWXon4XRCiU24zi+j1yvwBuCqT
TLSH
T14CD1E872A42D5C7768F7A449B1032A53DEB4616B6E54BE98EEE90F0C01E74CC1383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b0642547904a7d7f64f55682fd6d189577c380edd007af0d62d757bd110823b3
MD5 e849ceb4b289ec64cd7d8cc1570065db
SHA1 f5caf87275bf06cb99708ced25e82160af1ce70d
SHA512 a6392030e5a0f7c7e398f97a309f1a8ed1dd2b5dd177eb9d0723e14b83b28958351aca4a47a9f6d3beb92985837803176879b923fddabd43fa3a17ccf1ed0ce0
SSDEEP 96:cebJ6dd+BXK7CXon4efaRP69Sl8h4otop5zyDtB6SGyvLtJjaNrxwkYKMywwvwmL:JtubWXon4XRCiU24zi+jcxof1wvwmDUs
TLSH
T180C10972783D6C7365F3E545B1036653DFB461AB9B00AF94AAE90F0C02E74CC1782623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d7c52888be2a602ece555b5dff9e0aacd88a43ef6e6cc7e8574bf0f75ffed7c2
MD5 7929094d59aa9dd8ae33af8d11df5d27
SHA1 d643432fff55f980b0e37c3ea7c2839ee470922e
SHA512 abd75d442ea29ab6772cbb19e60fc3ca70eeb0e2a5769a08067515ffe3006eed4dcb2229fdeded6b947a44c33a53850044f2287cc6a87099ac3ae7364afb2f4a
SSDEEP 96:cMC6dd+BXK7CXon4efaRN6GRDotok5zHDtB6AdGyvLtWy2OwTFn5v4a:JCubWXon4XRBDUDfz7wz1OwTFn1
TLSH
T1BAA10732B8399D7398B6D585B9526713DFB46167AA50AFC8A9EC0F0C02FB49C1342613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 6ce8ad70b7aad0f446ae9a4ae1c1bff36afddb8252083e892921667785a09882
MD5 6c197e7be06505174ddba440894dac4f
SHA1 1dd6176dd5dfadb3b967c80894915cb2311a3962
SHA512 fbaf1d6b4fd91611ffb61169335456815bf216f43278cd688c12e2536741ed4468efe085efe22893393fbe4591059ca3759bc54f83cc334c3319f2f53108095e
SSDEEP 96:cebJ6dd+BXK7CXon4efaRP69Sl8h4otop5zyDtB6SGyvLtJOMywyvwBRNC39ISyC:JtubWXon4XRCiU24zi+j1yvwBuCqT
TLSH
T1C9C1F872A42D9C775CF7A445B1032A53DEB4606B6A54BE98EEE90F0C02E74CC1383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download