89e32ef57b857cb33bf03397e9e9061af3a0a4c8e323e79a4f92f39c9116ff33

Analysis

max time kernel
900s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6892625-discord-logo-icon-editorial-vector.htm
Size 590KB
Sample260712-2vbgmabw91
SHA256 89e32ef57b857cb33bf03397e9e9061af3a0a4c8e323e79a4f92f39c9116ff33
MD5 e73000412d887c29ef915c0c7d38778e
SHA1 1d934755a2a0e2119ae462655fa6cfcccd73657c
SHA512 c2c9c6cd756131310190d2df7a2af7644b17d31f7bc011adb0e288a8dec95f95be2455178f05cc0d2893a97ec13c83b7b6471e2951c1a23f66444099c584dac7
SSDEEP 12288:TYqIb0L0JZwa1unzW8C06ybPxHY/tdFqSJztHQX:ib0Ijwa1unzW8C06ybPxHY/tdFqSJzte
TLSH
T16FD44E72B1D4053E542B82AEF6D1BA0D6628E003D25A06E9F8FCC5BC8FC7DD19677609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6100	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283704364027693"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
5188	chrome.exe
5188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4728	4396	chrome.exe	87
PID 4396 wrote to memory of 6100	4396	chrome.exe	88
PID 4396 wrote to memory of 4176	4396	chrome.exe	89
PID 4396 wrote to memory of 4176	4396	chrome.exe	89
PID 4396 wrote to memory of 5064	4396	chrome.exe	90
PID 4396 wrote to memory of 5064	4396	chrome.exe	90
PID 4396 wrote to memory of 6020	4396	chrome.exe	92
PID 4396 wrote to memory of 4088	4396	chrome.exe	93
PID 4396 wrote to memory of 6020	4396	chrome.exe	92
PID 4396 wrote to memory of 4088	4396	chrome.exe	93
PID 4396 wrote to memory of 3800	4396	chrome.exe	94
PID 4396 wrote to memory of 1680	4396	chrome.exe	96
PID 4396 wrote to memory of 1680	4396	chrome.exe	96
PID 4396 wrote to memory of 1380	4396	chrome.exe	97
PID 4396 wrote to memory of 1380	4396	chrome.exe	97
PID 4396 wrote to memory of 3828	4396	chrome.exe	100
PID 4396 wrote to memory of 3828	4396	chrome.exe	100
PID 4396 wrote to memory of 4408	4396	chrome.exe	101
PID 4396 wrote to memory of 4408	4396	chrome.exe	101
PID 4396 wrote to memory of 564	4396	chrome.exe	102
PID 4396 wrote to memory of 564	4396	chrome.exe	102
PID 4396 wrote to memory of 2008	4396	chrome.exe	103
PID 4396 wrote to memory of 2008	4396	chrome.exe	103
PID 4396 wrote to memory of 2400	4396	chrome.exe	104
PID 4396 wrote to memory of 5620	4396	chrome.exe	105
PID 4396 wrote to memory of 2400	4396	chrome.exe	104
PID 4396 wrote to memory of 5620	4396	chrome.exe	105
PID 4396 wrote to memory of 5224	4396	chrome.exe	107
PID 4396 wrote to memory of 5352	4396	chrome.exe	108
PID 4396 wrote to memory of 5356	4396	chrome.exe	109
PID 4396 wrote to memory of 5188	4396	chrome.exe	110
PID 4396 wrote to memory of 5044	4396	chrome.exe	111
PID 4396 wrote to memory of 5044	4396	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\6892625-discord-logo-icon-editorial-vector.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb19ddc728,0x7ffb19ddc734,0x7ffb19ddc740
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,524811237489444751,14768637040467838462,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1008798403613055211,2783242894299065811,262144 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,6626143493587789159,9930120336683698939,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12287286919934187701,5987001967366441906,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2107370309398928371,5701735403768140240,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,5125716842171263276,17120222505373366778,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5284,i,1309894102265269487,2523449876967174875,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5324,i,8172990394157355303,2318716612848123515,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5276,i,4389129564679831564,10118256616993030958,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5576,i,15107698732541852090,14693155232667157922,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5912,i,13104717943340726130,12390253762598192952,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5328,i,13812726767285371563,10599144023265787838,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5824,i,12713147609688777376,14823644169041824826,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,8767510299432537856,14446782415066498964,2097152 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,5129246997064683856,1014602573172447055,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,13968139064389524933,9282257847252382550,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,4319060379758081691,8486033418711563876,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5252,i,16375698469626958611,16433363928545290445,262144 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,10795448412425738223,4972303653974869272,524288 --field-trial-handle=2004,i,5528106159528857418,17836202454991585707,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:14
  2⤵
  PID:5044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4968

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 42d789d04a23117eb0b543c8c028cc369de35e9aaaa1d8af439b78f1302761bc
MD5 ff5d9927396163e1b0cedd403ea570bd
SHA1 61cdb381ae7bacd3a282ac597095de70723e6192
SHA512 cba6da7927f98fc45bba4bc75b9513f4bc9b26462058737d774b233e1243d52e4bba5f55f563ac517172080ca8ad48af58ed8d80dc8dc7ed29adc12715398aa7
SSDEEP 96:DQuqolAU2D0gJ5tNZBZl3SKZZAzNOh8Z3ZmSJOK:DQuqolAU2D0gJ5tNZBZl3SKZZAzNOh85
TLSH
T1DEC179FB83E4477E891152F09B25AE1ACD6D151A432C3C668DF4AE1B63F29B1D10139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 47984ae64db1fae89a9f866461125863ead499f6ec990d1961208702f78e5eb1
MD5 cc726200ed6bcc38f21ee579cd4aa24a
SHA1 fd5f7960a531e5f287feb6eb9432b785cd3b98a1
SHA512 680ef3f4292e61801028d0e1fc2ca75025613134273b276b17a5850b251a2e378e0e84610d43efddea5e2b50b1591c5c1b69904b9f7e781180bc4e83223ebb8e
SSDEEP 192:DzVuMZtKVD0gJ5tNZBZl3SuZZ/XN348Z3rjaJ/K:DzVuMZtKd0gJ5tNZBZl3SuZZ/XN348ZL
TLSH
T1C6E199BBC7D8877E881152F49B257A1ACD2D155A422C3C6689E4AF1F33F28B1D20129F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 adb05267865f0e0baba84b24e87fb7c307bfdf9a90fc0d4f16bf3b37e8233c17
MD5 fcec4d59a3dadfd5ab13a5efcd11f724
SHA1 f5f066036fb239cf60f9dd58417b79b4e3af013f
SHA512 cd83e8bc1ab7649568ebcfc865e9ac8261d65b291a0ac5b7b4928738bf3d8073a1edf17b12c4956e8f50426642f852ed066d9b85d383e8bfb995967db28026a4
SSDEEP 96:DQuqolAUOD0gJ5tNZBZl3SKZZAzNOh8Z3rmSJiK:DQuqolAUOD0gJ5tNZBZl3SKZZAzNOh8z
TLSH
T133C179FB83E4477E891152F09B256E1ACD2D151A432C3C668DF4AE1B63F29B1D20139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 7d65dfeebe57433fa609a66bc92c2b2d7e53e0679ee4f6f242a6725869fe4009
MD5 fee164ddea56d4c329483d6e87d09de2
SHA1 96a0df760ca1d4bcf4f48ecb60e68c4f95ae2d60
SHA512 60de022b29cb763c66a84f63d6d0b755c472d537c480564dbcc88c3d072303d58858cb7ab9dd914bcd9e9303b4a6cb2a65d226138fd7aa9ea021bfca8ec859e6
TLSH
T17321BEA7AA7FB55B107CC47F5D04B8066DBAF4311181A8F8CEA7426CF0865FB1B02497
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 05df478f1edfa1cfe4a496d31a45f20761be67110bfd6852eb18781034058130
MD5 0b9df955292eff03229c1f84548c7b0c
SHA1 b020c29475fbb3c1d01ddc18e722758fc690ec3c
SHA512 471a0030735a26f070ba9aa4d67045d0493bb9ba6ec52b715abcf9048dcbbee009dd6017fe5b97074f04b93b426094edb4585fa4521bf7270ef0c729d3714d2f
SSDEEP 192:dRrpb49FZv7DvAPRp2r1964Hsb+WNnCjPVDe2dVyIsnAUge:dRrR+F5H6XebwuPtre
TLSH
T15C32963EB964657B6DCBC229F9257B93E7F5102221942E84E7FC9A2C10E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b86cfdf453f528bd4ae426b75663507a73a5d932dd2fb37c380361b1d153b09d
MD5 518081b661961a232869392489bbacd3
SHA1 b6d2878e6da50f101bcfe884a49ce3f0d941a849
SHA512 d15a72ce7291b6bdf23a92d3b5fed90750810447df0e2cb3d1b1f4e2a646238bdefcab24076f4d811fc1cb17ed0c1240cf88f1061753568e265a49a26b068742
SSDEEP 192:dRrpb49FZv7DvoPRpQr1964Hsb+WNnCjPlDe3dVyIsnAUgE:dRrR+F5HSXgbwuP2rE
TLSH
T1A432B63EA964697B6CCBD229F9217F93E7F5102221942E84E7FC8A2C11E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0bffebdba41592d7aa78d02f06b70fe8c99d9b95f70e09b1189b4893f707f82b
MD5 91b717bb85191a371db6fbd88437cc61
SHA1 dbb653d1eec61490f2f790355671b9364202a7d5
SHA512 f7f94b3c7ee28f647fb3064df24da267aa894e4d122cdb69202a67bd314efea52ebcc58c916f78ea975cdab8277a1a641c90bb26dcb16e431efd81ab36dc1b48
SSDEEP 96:CbJ6yd+cAOIt5aDVmufj7xcfSl8h4otop53pD5B6mGyv9JbQDXNRNC39ISyVNCF6:CtrLA/TE57wiU2JfO+bQDXNuCMJq
TLSH
T1C2C107B1B46D5EB70DBAA455F1137E83CEA8615B69293E58E9ED4F0C00D35EC1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fe779e3764f6f195fed453ade60201553e82dd9bd3935b3b37e2253dea2e2761
MD5 b017decd44221374c1c98d53f273bb2f
SHA1 173ee6dcc541166101b71c55259c1a2edac26031
SHA512 6e2258c7646097e3178c8982298b508b6deef4d51e1f9c7bac3672b0fbcee4fa1a08dba132c100038f9ca772c6f85eb3c47b9b0795bba84ad38bf8c9fdd91404
SSDEEP 96:CC6yd+cAOIt5aDVmufj7xcfSl8h4otop53pD5B6mGyv9JtFiO0AuSwtSDXy0j9I0:CCrLA/TE57wiU2JfO+tFGSwtSDXyUZv7
TLSH
T19CC14A71B86D6E732DF69554F552BD83CEB4A09BA9216E98CAEC4F0C00D34EC1343913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0a6746d5933ff937d2ab692556cff029f104df4ede23ec7bf4f9dec5277183a5
MD5 8e409d8b669af422bc5012f93239cc63
SHA1 3498d16521f198ec827368c40fe01efa025a0ddd
SHA512 ffdc2cea8ae5006f8f47eea0a68163cce69a769ff656cdbb816ee57d2814d2c70661aa1e966307768ecf5ca3bc937c18830117272cab10b04075bae597a81545
SSDEEP 96:gC6yd+cAOIt5aDVmufj7jcbRDotok53CD5B6/dGyv95SXhbb2Jv4a:gCrLA/TE57cDUD0fUweSXhbKl
TLSH
T12EA10871B4795EB35D79C584F8927E83DF68A153A5226F84D8EC5F0C10E71EC1382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8da53e4d2ed4322a7ab74f9b466f190a8d527d2bd454229988452e9e388f84b8
MD5 efcb7f105c0c1e4b55109df5a6b6e3ba
SHA1 bfd62c1d4c84c7c2bcf72d956d71d1dda61bd03c
SHA512 082fbba76a7245676a5ab912f693b8adce1940f90a171ce420ec7c99728ae222d04a754bd7f8808be32d72e59482486a7347d89a69bd9cfb911f6ef9449e1e5c
SSDEEP 96:CbJ6yd+cAOIt5aDVmufj7xcfSl8h4otop53pD5B6mGyv9JtFiO0AuSwtSDXy0j9B:CtrLA/TE57wiU2JfO+tFGSwtSDXyUZv7
TLSH
T1E6C15A70B86D6E732DFA9554F552BD83CEB4A09BA9216E98CAEC4F0C00D35EC1343A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 e7fb5fb9f76466feb46b35070e97aa12eefd68b5f35522fdedf1a4175f5b3e8c
MD5 00d81c61ab1c3d80b77107160f56ca8f
SHA1 4e6b38cf9f52f888296c6b960f4bd5bc41c27d0c
SHA512 cf0be19e9b85d4351a7da4c9cd5f02b291b6c3eef6e45fc8f587b360179b39f0c43953130d11102953b47f4348e51076370a308de6ab04e593c044d41e027a0e
SSDEEP 96:CbJ6Cd+cAOIt5aDVmufj7xcfSl8h4otop53pD5B6mGyv9JbQDXNRNC39ISyVNCF6:CtTLA/TE57wiU2JfO+bQDXNuCMJq
TLSH
T1D2D117B1A46D5EB75DBAA458F0137E83CEA8615B69293E58EDED4F0C00D34EC0383827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download