ebe4d1f7ac4af209e9408befa1ca9a4d68ea33d0123eb6820d1b9735b5ae20cb

Analysis

geolocation tags

asiadelhiinindia
max time kernel
150s
max time network
171s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ai-aimassist-source/example_win32_directx11/misc/opencv2/etc/licenses/ippicv-readme.htm
Size 6KB
Sample260710-rf3mfsay7l
SHA256 ebe4d1f7ac4af209e9408befa1ca9a4d68ea33d0123eb6820d1b9735b5ae20cb
MD5 41f4dd43440bb98fe463a307b30eac46
SHA1 4cd54571a26c3eeb55af97bf6497b3c6ce688a58
SHA512 5f11f7e3a8b50ac97a5fce197d5ac929c51e7e313d1a3169686fa3576759a89ea619084f8585aefdd5fb7cfaa137d33f1645f3007038c056d1cf9be1c6b40f3c
SSDEEP 96:2KJZzAtdBa/bALAoAUH/y2qVpbZu9Gk9W9FdDhRkCLlbfArvCaK:nKQ/cLAoIZeB9TCLlbYzCaK
TLSH
T111E16399EB08191EA32B5465BFF28F62BE0A09E0694FA17674E4B10FF19D5603727334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2352	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
2568	chrome.exe
2568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe
Token: SeShutdownPrivilege	3532	chrome.exe
Token: SeCreatePagefilePrivilege	3532	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4708	3532	chrome.exe	85
PID 3532 wrote to memory of 3112	3532	chrome.exe	86
PID 3532 wrote to memory of 2352	3532	chrome.exe	87
PID 3532 wrote to memory of 3112	3532	chrome.exe	86
PID 3532 wrote to memory of 2772	3532	chrome.exe	89
PID 3532 wrote to memory of 2772	3532	chrome.exe	89
PID 3532 wrote to memory of 3404	3532	chrome.exe	90
PID 3532 wrote to memory of 3404	3532	chrome.exe	90
PID 3532 wrote to memory of 2984	3532	chrome.exe	91
PID 3532 wrote to memory of 2984	3532	chrome.exe	91
PID 3532 wrote to memory of 5792	3532	chrome.exe	92
PID 3532 wrote to memory of 832	3532	chrome.exe	94
PID 3532 wrote to memory of 1052	3532	chrome.exe	95
PID 3532 wrote to memory of 832	3532	chrome.exe	94
PID 3532 wrote to memory of 1052	3532	chrome.exe	95
PID 3532 wrote to memory of 5716	3532	chrome.exe	98
PID 3532 wrote to memory of 5716	3532	chrome.exe	98
PID 3532 wrote to memory of 2052	3532	chrome.exe	99
PID 3532 wrote to memory of 2052	3532	chrome.exe	99
PID 3532 wrote to memory of 5088	3532	chrome.exe	100
PID 3532 wrote to memory of 5088	3532	chrome.exe	100
PID 3532 wrote to memory of 1720	3532	chrome.exe	102
PID 3532 wrote to memory of 4172	3532	chrome.exe	101
PID 3532 wrote to memory of 1720	3532	chrome.exe	102
PID 3532 wrote to memory of 4172	3532	chrome.exe	101
PID 3532 wrote to memory of 4820	3532	chrome.exe	103
PID 3532 wrote to memory of 4820	3532	chrome.exe	103
PID 3532 wrote to memory of 5904	3532	chrome.exe	104
PID 3532 wrote to memory of 200	3532	chrome.exe	105
PID 3532 wrote to memory of 2312	3532	chrome.exe	106
PID 3532 wrote to memory of 2568	3532	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ai-aimassist-source\example_win32_directx11\misc\opencv2\etc\licenses\ippicv-readme.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffd1a24c728,0x7ffd1a24c734,0x7ffd1a24c740
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15820728714421598601,4478504459013938965,262144 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,10914941000885523331,11567635151172006277,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,9578586476852854262,15583672562299413308,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,3990255987890318714,13808163640831316837,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,5985179278657259983,1395031936986478410,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,8432663531358047410,5984156511615842962,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5564,i,8916613851150440960,13303157622002269414,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5580,i,549328928048917553,5537956561024813202,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5956,i,935856066028717509,4218285945984384363,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6008,i,15420298360966728791,294989306987957100,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5028,i,17688963178564558704,13926042400332578362,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5036,i,18007536896591149906,2286724533780195188,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4972,i,8666899778707270227,5192389711558590503,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4992,i,6390410983015291891,16705977526070124278,2097152 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,4359994697880208016,12150375132944681378,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,4197959812247938906,5378238397644238431,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,1740461963637909978,14519798623580056316,524288 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4844,i,11732455850913278258,14343445300535858588,262144 --field-trial-handle=1996,i,3830550398454548657,17589660462993657932,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 17f658e492680066a0df595e23040719c2d26e4001151f8e7f189b6b9be0b98e
MD5 36bcc5d1ae8f6d44a0bc4483e298ab6c
SHA1 a25acba42972c6367e1eac71bdbde3624506e5a0
SHA512 1e33632d4a15c8b13ef08c5bd8cf65535aa8c7f4b4e21e3b453b69036abed841d140e30ee4bed7c049641168b59561608d7cd963ba136603d42978083dbeeddc
TLSH
T1D4414BF7C3D8897E8A4156F8AB156F1BCE2D0A28532D3C66C8D4AE1B57E2871D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4e9d15d0a88ecf2f38b3b81cb5fe74c125d6729da7266416d6f09481c8c09d08
MD5 f5edcf6a1af08cb5be3b9ed61a171889
SHA1 ae66ca1711b6236ddf269a9121f499c9c423a967
SHA512 83eaaa6e983b390d340a25073c6639164b074ec2c093a0776899c2595269e0ad0621d2d24c89a6385e456d314101ad0d7db5abc05ee068d250d01cf6258a7cf7
SSDEEP 192:5RZpA2kv7JnvAPRp23S99Hsb+WNnfX2MqYrVyIsnAUge:5RZpRAd6X1vw/2n2e
TLSH
T10D22A51EA914653B9DDBC219FA22B7A3F3F6102571E42E44EBFC9A2C15E79CC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7707703290d129a328b08d4932849e11ac28d2b8414fa6edd0c0a7ae9fd4e2cd
MD5 5d7a656f6b9b7b603ff6e824449ed73f
SHA1 785129c10d4921598febb25b82155c51c00b77df
SHA512 9c938cd9076db7f9fd036111a51ca85da00b75be76828aafda08380a85b3e6f33b6653a780111a3dc18db92d0cbf829a885b6ac36cbe475aa1b19b1bad3d4783
SSDEEP 192:5RZpA2kv7JnvBPRpZ3S99Hsb+WNnfX2MfhVyIsnAUgE:5RZpRAdhXkvw/2gE
TLSH
T17732A61EB910653BADDAD219F922BBA3F3F5102571E42E44EBFC8A2C15E79CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 37KB
SHA256 2a1c961b23eb4ba5977ac036c28358f6de3a454dd883f2d8bfc902fe8d2247ae
MD5 01da18220bd8d72e640704aafe7b9b1a
SHA1 22d81e9736112bf842040da2e2e0afe3394128e3
SHA512 3d76954d0b17017a4b934a473d647f018dfb37fa23345f128ef9ce1f4c3d756868e7f5235b2b09218a52feb26a120bc9a856daf672013da699ae9ebf99c6d1ae
SSDEEP 768:v+gbyS+6FhdyJQvhNpyDqoLlEuPMB0OcGmfVOD9r2Jvr:2egWkq0DfO2tODZ2j
TLSH
T10B03E162E42C55F2CC7BE86623136D47DEED7172DA183688EAD79F4A02E669C1347032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f858d46da757b37f64a504cfd91b0a0e325211e99a1d626c2349dbf84b09b901
MD5 16942e21217f4e09599a3fe069e572cb
SHA1 e3dd0cbc3d5bc1318f7a5c021d418f2199be02ca
SHA512 5b836b1de935f92b4056305996169526aebbca003c2808f048346f084a49564c363e753281cdaeca66e684385e7efc59048f27c5e5045b9b31718bac9d65366b
SSDEEP 96:5bJ66Cd+CgjAe56y7nKZwpOfsobabSl8h4otop5RIDaFB6vGyvk5EMZH1Qzb/ZDO:5tzCNgjf5ZKSNtiU2sa77Wc2PJWl5WUN
TLSH
T15FC119B5A47D5D7358F6C189B0033B83DDF510ABA561EF94EAE94F0D01E74AD2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 73559e08447990798480e910b9545093cb6411897d411725c4d95c2e27cdf450
MD5 deedae800837d788589fd3d920b33276
SHA1 6049940c3606c0bb9bce361953c4c7a8869ede35
SHA512 cb6a12bfb38a153b7ebdf467c07fe2f0f6e0480ed241752966a5493dfdc76a1561a0889597cffc59ab519e11050a2ef0a0d1e353d50fbf8611d616b792a36e92
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsobajcRDotok5R4DaFB6vGyvk54E5TboRYv4a:5CzCNgjf5ZKSNqDUDQa77qE5Tbog
TLSH
T166A109B1A4690EB394B6C58DB1537B43DEE421A7A571EF84E9EC5F0C40FB4E91342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c9e1765b49495553418cf41c712c96c3ee4241677d7e22fe5183e2c05e4cda41
MD5 7301dabf93047535f1620ad4b9a493bf
SHA1 c36b3d8da009e34a516c2f760175bdb79270a483
SHA512 16f9bb9db790535bf15e3c480046f549d2dd6e1a8e0b7757e27ee7c6bd815a8373017f544e568cbd07ba87b2d2cf1cf623be8c23db0887db1b5ed136b6ff2516
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsobabSl8h4otop5RIDaFB6vGyvk5EMZH1Qzb/ZDW3:5CzCNgjf5ZKSNtiU2sa77Wc2PJWl5WUN
TLSH
T19FC119B5A47D5D7358F6C189B0032B83DDF510ABA561EF94EAE94F0D01E74AD2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download