a1f7c5df280814721dce27a68d8c3d9b032e109a0ced0365655d58717167a482

Analysis

max time kernel
899s
max time network
876s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotX-main/.github/Pic/Shields/SpotX_Channel.svg
Size 2KB
Sample260715-chjvsshv9p
SHA256 a1f7c5df280814721dce27a68d8c3d9b032e109a0ced0365655d58717167a482
MD5 d165957c98e25d944c144491c5f7c2a4
SHA1 c265767368236668088164d4914ed47575828979
SHA512 10aa72b6a83fc85496723c3e66482b018fd0bee88f82a3b2094e5e79a586ea115687f8bbed948cfc4f17da73aa3e37f489a00e1e1f416463a974112c969fb537
TLSH
T1AB4173B2E34C6577C6285A2DE3ACB09E222F36C6C4408255F2943B4ED4B15D31D9938C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3752	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285547449002473"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
2340	chrome.exe
2340	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4564	4636	chrome.exe	87
PID 4636 wrote to memory of 3432	4636	chrome.exe	88
PID 4636 wrote to memory of 3752	4636	chrome.exe	90
PID 4636 wrote to memory of 3432	4636	chrome.exe	88
PID 4636 wrote to memory of 4440	4636	chrome.exe	91
PID 4636 wrote to memory of 4440	4636	chrome.exe	91
PID 4636 wrote to memory of 2404	4636	chrome.exe	92
PID 4636 wrote to memory of 2344	4636	chrome.exe	93
PID 4636 wrote to memory of 2404	4636	chrome.exe	92
PID 4636 wrote to memory of 2344	4636	chrome.exe	93
PID 4636 wrote to memory of 1392	4636	chrome.exe	94
PID 4636 wrote to memory of 5104	4636	chrome.exe	97
PID 4636 wrote to memory of 2136	4636	chrome.exe	96
PID 4636 wrote to memory of 2136	4636	chrome.exe	96
PID 4636 wrote to memory of 5104	4636	chrome.exe	97
PID 4636 wrote to memory of 3584	4636	chrome.exe	98
PID 4636 wrote to memory of 3584	4636	chrome.exe	98
PID 4636 wrote to memory of 3328	4636	chrome.exe	100
PID 4636 wrote to memory of 3328	4636	chrome.exe	100
PID 4636 wrote to memory of 5700	4636	chrome.exe	102
PID 4636 wrote to memory of 5700	4636	chrome.exe	102
PID 4636 wrote to memory of 3784	4636	chrome.exe	103
PID 4636 wrote to memory of 3784	4636	chrome.exe	103
PID 4636 wrote to memory of 4556	4636	chrome.exe	104
PID 4636 wrote to memory of 4556	4636	chrome.exe	104
PID 4636 wrote to memory of 2916	4636	chrome.exe	105
PID 4636 wrote to memory of 2916	4636	chrome.exe	105
PID 4636 wrote to memory of 4488	4636	chrome.exe	107
PID 4636 wrote to memory of 4872	4636	chrome.exe	108
PID 4636 wrote to memory of 4852	4636	chrome.exe	109
PID 4636 wrote to memory of 2340	4636	chrome.exe	110
PID 4636 wrote to memory of 4968	4636	chrome.exe	111
PID 4636 wrote to memory of 4968	4636	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SpotX-main\.github\Pic\Shields\SpotX_Channel.svg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80c3cc728,0x7ff80c3cc734,0x7ff80c3cc740
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,2897595118705507341,4934663176034547537,262144 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,17663301175040298131,14245623012683662034,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,7253758566114009050,13052460516428330447,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3977064489096571229,7394482556689692608,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,11021548199161899223,7691337869683823860,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,2593731938206020644,17065367223661712948,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5632,i,14843044099699931139,8263359385661562812,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5576,i,16928049188328338075,16296211321509042310,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5904,i,13894849726554745139,11510465532872159274,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6180,i,11429858675454096201,13616513962367967452,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6356,i,10873009250167027738,6634065919739977798,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6288,i,17863367824753541775,14325207727220236867,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6276,i,6515632475470868320,10983868826349115026,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5156,i,10056901929949224256,8194980833449697507,2097152 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,13011495982559900400,17141138204998396539,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,5444465175190494653,12207793752957003998,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,2039931416899531872,16925906118064021257,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6292,i,1537916533224093816,3300897730078035410,262144 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,11011271710087559485,12746777521984254783,524288 --field-trial-handle=2144,i,6325278756122126260,6470458518598379192,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1632

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ebccd77-0399-4df6-bc91-e507c199236e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ebccd77-0399-4df6-bc91-e507c199236e.tmp
Size 5KB
SHA256 53b56d6d4fda002953a8c8c8f3d41f22fd740ea706e3f5b291733dba4d4adfb8
MD5 a0ed54df8c1e1b5674bdad8b3c0e3e6c
SHA1 ebbc69e95076d351553d2fa9215ac1100c95f1bc
SHA512 5dbfeb168e00a450dc963710684cbc1cc1b2bfa575991f00e85acbae70ce5873e2b741e9b0595e9672ac3589ff1e2c31823b8e0febcba983109eaa254df6fdf2
SSDEEP 96:RC61d+r2io+TJ/E0f6m934kMLbSl8h4otop5QicDPB6dI0dGyvn0SvQxwzQLhjmW:RC2ITo+TQ0IDpiU2K5uwPSIxXhjm+9fp
TLSH
T1C9C14B72A42C4C7715A7E546F0233A93CEB4206BDA51AF74EAD60F0D01EB0EC2392523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dfa6f5fb0b1bc116922f72be0e271f7b4a2f433deb13df9ccf9239136e5e5eee
MD5 d8075a1a7224a3217df3157cc753c593
SHA1 f8af9ba1045d03bd7c5e0909f4852d499621241d
SHA512 90fba940d6498441718bb14f05c58270d421149b72af43a58c0efc8b3c86f98b8e846436254973b689bce9775b52cc0395080eb69eb6257685b3439804319322
TLSH
T1EB419BF3C3D8893D890156F8EB157E1BCE290A18432D3D26C8D4AF5F57E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1b1cc75e74a9def15520cdfbc09d07f0a74873215df55a618f00ade848bc59ec
MD5 e349ed7944043b6e5976cee5ac95e992
SHA1 bf52088ce92679b09d3f2643f6c4dd5f563ce99d
SHA512 2dd5551481afa874e6f85c42d01068b9d3ea3438d3f5e0b6c44e1677654fedb9fd23c23b9e16b6d93323f9a3b5a69ec7a70f525f22a7d841f5810e00634b1836
TLSH
T11A418BF7C3D8993D890056F8E7156E1BCE290E18432D3D26C8D4AE1F97E2876D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 349f4726cfbfeea919b12db8c23d8c353fc734468b877c96abbe5c0c2fef6647
MD5 8b68bcc7fd409cb76fb8d990ca549a6a
SHA1 7198256ffcfd40cccfdd0d19dc656d43d0d904fe
SHA512 1e9105ed0de0e3bf0d6856a3bbfd1329be6b26c19fc64ce9d83164f723b92e639e7f6b60cde64c774d676ea18eb906edf5b5b2b3b2cff3dbccc63992c0a51f19
TLSH
T1A3F005A796AEB423107E81BF5F047805B871E835094079F4CE57437DE0814E71B02493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 67a79937e6478f341c6354ffea20ddc2cfaea01b6bac472ebcf3bb9d748408e0
MD5 5d88830997a3790e6186410552f51bcd
SHA1 282531208eaa02e7aedfbb867c69e1a7f5b08425
SHA512 92b46c959598397274e95f291b5e47e1e33fc31d73d982553d8463c44bc1f86a6da1a76027643442d108fc6b82b3452e0a619149003971ebaf2a82c0cd1a074e
SSDEEP 192:5BRYAah1v7QvAPRp2W+9XxHsb+WNnsEPMGeeVyIsnAUge:5BRYAEF86XGfwHPFe
TLSH
T1A132762EBE10653B6DCBD229FA657793D7F6102561D42E80E7FC8A2C11DB5CC622740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 db4dcb021a4a41530d4cd32a58e6d1f9a9e8d84c105fa46e79449daffefedbcd
MD5 296fa678102a631fe8a810986d2683d6
SHA1 f74bfff7d860d8c54d447c597e937105efe380bc
SHA512 e2cb262624177927e289c03d755f60a7a522c4791323499df12a149657807604603e211272677f680927cdd8e8ba288744c8ec77c1277ba437efc45137268877
SSDEEP 192:5BRYAah1v7Qv3PRpXW+9XxHsb+WNnsEPqGe+VyIsnAUgE:5BRYAEF83XFfwHPRE
TLSH
T19A32866EBE10693B6DCAD229FA617B93D7F6102561D42E44E7FC8B2C11EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 5a705711bff79a89596ab7c86a3d0a6456eb673da2451fa1cc11b3b83e67fa0c
MD5 5c537a6b5e110c839c87f8f165036ab4
SHA1 713ce3b4c6b0c65ca5a7c9b6c83260b76f907541
SHA512 a67232fc4d0c1fe32bde0dee4ebe6a049e7ed4455feb24daa34d364f7699c8b508fb46c5c1d446fd552a90d19e57bffbdbc4123f82ec42dd863142a08b0e2901
SSDEEP 192:Rt2ITo+TQ0IDpiU2K5uwPSmhlm+9f2uCjD:RtPToS2NdutmTmmf2uCjD
TLSH
T12FC10A71A46C5C7B08F6A485B1133D93CDA4606BAD65BFA8FEE90F0D01E74DC1392623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f4a5ff6d7719ea922aaa6becc0beea570dc27d56687ebf6d844123b095b6b8be
MD5 a053388bac9a8cc528fd0bc23b60c921
SHA1 e077a7892839b006286cc52b7b24e1e3d5fb0983
SHA512 fc8ca3019b2b9725a5c96d21a11670202b03a7d9bd92dcd01a4b87d119346e2141faef7bc44cb4b6e8d4b38fcbe4ce3239f7ba7981fa8c997c402ea101ac2b8a
SSDEEP 96:xC61d+r2io+TJ/E0f6m934zM4RDotok5QmDPB6nGyvn0b4T8fybJv4a:xC2ITo+TQ0InDUDf5PPb4T8fybl
TLSH
T1FFA11A36A0284D775476D449F1622A93CFB47067D9B2AFD4EAD90F0D14F70EC1351627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 99102b0a533cf947cb966087c5356f077e68321eef597142b44bfbc739acbe35
MD5 401fe93b5adee80c4eb5b46a298777a0
SHA1 448e908607368cc13cb5384bec932226a7f02c58
SHA512 eeb713d17e5d64cc0536f4dd1d90e336209bc4057d324c4fcb7f0472c53ea747ee910d08ed24d761abf33d19361fdb65aeb5a69fc2f27a69592d5e9874719012
SSDEEP 192:Rt+ITo+TQ0IDpiU2K5uwPSmhlm+9f2uCjD:RtHToS2NdutmTmmf2uCjD
TLSH
T18ED1F971A06C4C7B58B6A489B1133D93CDA4606BAD55BF68FEE90F0D01E74DC1392627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0145e0228ed72c66562740a30db8643128083e92dcb566cb45f9d3fb296a13ff
MD5 16fb14fecad894e54576dfbf77354c10
SHA1 2d330b2bcc4e6562f7e415e2f5f1f3efbc4e3ddd
SHA512 a7a81352109c34109bfe5da7a2b8c1dccd6f16fcb48ba246fbc07ecdd4a4e22cffb17f01511b402b4c75d56068f3365dd4f6219e9c54e579cfb137385db7c0dc
SSDEEP 96:RbJ61d+r2io+TJ/E0f6m934kMLbSl8h4otop5QicDPB6dI0dGyvn0SvQxwzQLhjZ:Rt2ITo+TQ0IDpiU2K5uwPSIxXhjm+9fp
TLSH
T156C14B72A42C0C7715A7E546F0233A93CDB4606BDA51AF74EBE60F0D01EB4DC2392623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download