c2116c0931648bd195b2f43c66d4d8216065fa7708a5f39e287bf2dadaab11cb

Analysis

max time kernel
899s
max time network
896s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotX-main/.github/Pic/Shields/SpotX_for_Mac&Linux.svg
Size 3KB
Sample260715-chjvsshv9p
SHA256 c2116c0931648bd195b2f43c66d4d8216065fa7708a5f39e287bf2dadaab11cb
MD5 102b1884743b92d1654606657836dfc1
SHA1 82572ca14adcb5f275549810d3c184ba89d88fae
SHA512 7610729050f876397239ade273f01584c1c07436a76b9663cfbfd99da8aa77aa82c9caa9f0f557f3949fe0ccb13ebbd56db654bba40ffb28fdd9a0a268bcfd23
TLSH
T1D0812E63520860B9996C2E9FE763668D523EF1D698D7078DBC5C2F08DC2CB663C0A75C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5988	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285547434791623"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
3380	chrome.exe
3380	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4908	4752	chrome.exe	87
PID 4752 wrote to memory of 4116	4752	chrome.exe	88
PID 4752 wrote to memory of 4116	4752	chrome.exe	88
PID 4752 wrote to memory of 5988	4752	chrome.exe	89
PID 4752 wrote to memory of 4332	4752	chrome.exe	90
PID 4752 wrote to memory of 4332	4752	chrome.exe	90
PID 4752 wrote to memory of 5964	4752	chrome.exe	92
PID 4752 wrote to memory of 5964	4752	chrome.exe	92
PID 4752 wrote to memory of 248	4752	chrome.exe	93
PID 4752 wrote to memory of 248	4752	chrome.exe	93
PID 4752 wrote to memory of 4796	4752	chrome.exe	94
PID 4752 wrote to memory of 1188	4752	chrome.exe	95
PID 4752 wrote to memory of 1188	4752	chrome.exe	95
PID 4752 wrote to memory of 3692	4752	chrome.exe	96
PID 4752 wrote to memory of 3692	4752	chrome.exe	96
PID 4752 wrote to memory of 1060	4752	chrome.exe	99
PID 4752 wrote to memory of 1060	4752	chrome.exe	99
PID 4752 wrote to memory of 3772	4752	chrome.exe	101
PID 4752 wrote to memory of 3772	4752	chrome.exe	101
PID 4752 wrote to memory of 2948	4752	chrome.exe	103
PID 4752 wrote to memory of 4376	4752	chrome.exe	102
PID 4752 wrote to memory of 2948	4752	chrome.exe	103
PID 4752 wrote to memory of 4376	4752	chrome.exe	102
PID 4752 wrote to memory of 3496	4752	chrome.exe	104
PID 4752 wrote to memory of 3496	4752	chrome.exe	104
PID 4752 wrote to memory of 5000	4752	chrome.exe	105
PID 4752 wrote to memory of 5000	4752	chrome.exe	105
PID 4752 wrote to memory of 3080	4752	chrome.exe	107
PID 4752 wrote to memory of 4412	4752	chrome.exe	108
PID 4752 wrote to memory of 5652	4752	chrome.exe	109
PID 4752 wrote to memory of 3380	4752	chrome.exe	110
PID 4752 wrote to memory of 1004	4752	chrome.exe	111
PID 4752 wrote to memory of 1004	4752	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SpotX-main\.github\Pic\Shields\SpotX_for_Mac&Linux.svg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb8,0x134,0x7ff8cf46c728,0x7ff8cf46c734,0x7ff8cf46c740
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,9882206516261594948,6723905173833302748,262144 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,3013196383867176270,5804540671654630986,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,11333248746389322685,9665318146383363726,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,14311046041278671281,3341061735490633248,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,14310260117849835435,13591054207035193182,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,4308047689301697949,10593527454705981422,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5512,i,6268585127742348149,12795656081116510656,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5560,i,9920825200143349354,12607394681772550843,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5864,i,12302384434169635997,11796973177402767674,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6148,i,8808360306735157506,12886543273423974788,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4892,i,14559533193598505984,9589578260773857047,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6156,i,2722303876468531566,940647342144105837,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6016,i,16839677078711968807,9108285644272336143,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5524,i,5855054382472594564,8286712806740903227,2097152 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,9869808385847354599,17697013280236328263,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,1244545617781816076,16964754717504186555,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,15738906777501918436,6868545506725573966,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4964,i,10462548585382898166,1824081460491346977,262144 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,5141463128075727490,8773514790816343311,524288 --field-trial-handle=1916,i,8133288750356075847,9451540333925432430,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3508

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

9ad2db2b-8225-47af-8cfc-15e2532c9e8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9ad2db2b-8225-47af-8cfc-15e2532c9e8f.tmp
Size 523B
SHA256 d6efc7c59dee78498f1f0db165ce9f7bb0c7577130b2b8e75311cf9fe940fd86
MD5 9995cd875788f76419eba2138e399cd8
SHA1 8c974f944be6caf127b2bc1560c59e6ce743610f
SHA512 31ab32324b2658b19ea2d1d390d1214c27f7bcbebe45cc53ba88a6b5c8d8f15a5fd230c84a616e832bccc48a1e3ded71efb1539f441c3e5de6ab6350a99c8902
TLSH
T10BF050E7B66F7457007945BE9D0AB80AACB5A835058168E4CE9742BDE0415F71B12443
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fb61b6bb2d760d527ddf6ce15db53afc0f1e129229963ab591d5dcb282b11e8
MD5 15dcf9333ef6d9f25b3ce593ddd2ddf4
SHA1 48b993169324a1a0c7e317fddf5cecf2a7401c5b
SHA512 ce4054eec56ab9c257ceca7812c239b584b6fc84dd46afd498078686b9325f4d9baf509d1e6a264a5c0e9f05f819e681a694d8daa18f1296f56aadbb99ce11dc
TLSH
T1C2419BF3C3D8957E890152F4AB156F1BCE2A0E18432C3C26C8D4AE5B67E2871D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 651133139c2cc0bc41457e6199edd86a671dae03e024c496882a596c319afc0c
MD5 6133c94d4a9af79f41277e4b2e942327
SHA1 269e5eb70052a2627848a06ac710ba2425204311
SHA512 e43f629f43aa5b2d8b17bdeeadffefb68f80ee8e42eb7ba5e619d6b1a5b514780d75afc3341c1ccd9694c72663b4c23eb7913c5a52b7c159dd10b7f3805c5a86
TLSH
T1DE419CF7C7D8957E890456F4A7156F1BCE2A0E18432C3C66C8D4AE2FA7E2871D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c81eff1a2081c2e3363a58a1f071923b4e69a8aa297119d14b5ce26d52a15dc8
MD5 aa0af035fc485fdd23162a4510f76a54
SHA1 676f1de0277684a68e59813c624692dc57f1a521
SHA512 d3853ce40196cca42553b6408139d5568f2790b67d19b0de17ab685dfabdbe4b6d0310222eb054871ab9bbba3f8ec6046f7d226b0d23fe936ee3b69fac38ce11
TLSH
T1ED419BF3C7D8957E890156F4AB157F1BCE2A0A18432C3C26C8D4AE5B67E2871D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 a0df701cf0940c701686debb5d3abecea4771f862c948a6e284b16686b9c9831
MD5 1104cecef4edc9700c8375ea4b6b52a8
SHA1 5b36419fe4b6e3013b8437809f5c5db82725ab5e
SHA512 d7d15217553280ae4cc42a37da5d8b9a1d779a6be6da32510905f76add65979f9d4b9b113b750573ea78644577a0e364d4d39fcdaaf3c905194e3a81d9502966
SSDEEP 192:7RdvfBlXv7KvAPRp2+q9NLHsb+WNnO8P5+ezVyIsnAUge:7RdvZl/u6Xi3wVP/e
TLSH
T18C32982EBA10653B6ECBD219F9257793DBF5102521942E84EBFC5A2C14DB5CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8e926ab68ce7dd47f27bc24a4ff9b3124929b8d6cfd9acb8427b84f891d69384
MD5 edb261c49f761a7802572c236d2372ee
SHA1 85acb34fb07e6d1b72621f5562b6de6aa90d134c
SHA512 0b0f0836b84edb4f169b7488d32df39b5ef517d652c27e609d0326bf0b32fe24f1c6107983a8526eac3e54125d9e473156a4603fb5a5d59fff29d6fc30364a70
SSDEEP 192:7RdvfBlXv7KvtPRpa+q9NLHsb+WNnO8Pj+e1VyIsnAUgE:7RdvZl/uNXe3wVPrE
TLSH
T17D32AA1EBA10693B6EDBD619F9257B93E7F5102521D02E84E7FC8A2C15E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0150e62dc19026badd4837ae1c31ec6de530f839d7ad73f3c725d3091886d7dc
MD5 c0a2a9289acc3452286ccd2756e95368
SHA1 8324a686b38a12efc9d282b84b1662593fb16129
SHA512 755954285d1ae43e7ae2825b3f3d0157db9a7d171912d9d0705a8a2e15e718d90ad21e768a3d4d72d037b6049e52a16bd1845547ba1406958152581659445bcd
SSDEEP 96:hbJ6Bd+hDK+UyKovbfaNQYutlSl8h4otop5+6DkB6fGyvUgbKfo6RNC39ISyVN9e:htKqDHUgvIdKiU2HIjsbKfo6uCznVE
TLSH
T1ABC10A71A46D4D775DF2E849B0132D83CDB8606BA960BE58DEEA4F0C01E74DC5393523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b2f151eb7b7b8aa4395a379ef0ee244b02f2048e00d592578b839c5ccc0660e5
MD5 286731f8131f4ea31328840253d2dcca
SHA1 a953fa33d090028c14179d7a92bd559437c4a07a
SHA512 cbb307f362a43bfa549d0d62d3b61193c5cfdc4225063da625a2510ffa434e585b7d641b8950447794eb3535fc508d9d5966347e887af7b8985f8fa9d6685ff6
SSDEEP 96:BC6Bd+hDK+UyKovbfaNQYYeteRDotok5+qDkB6WGyvUU+osbL/Mmv4a:BCKqDHUgvIdaDUDPICI+osbL/N
TLSH
T150A1F932B46D4D776A76D549F9262E83DEB4602BEA21BE88D9DA0F0C11E70EC1352613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 82965fb3289cefdae082ed7f44ac674c85a673ad5f8c356c79374c47641b24dd
MD5 4c188764daade08b64742327903d9f41
SHA1 6918c1253486ab7229fee9c42c164c0c1a4d1f8f
SHA512 e43479c0b4f816cf314eec302a7be9177bec496862bcab37fc8c6cef6cfdb7a5d57bbbdb8e27ec3168c8289cc6c49ac93cdfd69a27cd9afa2397464412061f52
SSDEEP 96:hbJ6Bd+hDK+UyKovbfaNQYutlSl8h4otop5+6DkB6fGyvUgIlG1QzbOQbLEfoIrB:htKqDHUgvIdKiU2HIjsIlTLfEfoIrUX+
TLSH
T136C12972B43D9D732AB2D509F4132E83CEF5A06B9A616E98CADA0F0C01D74DC1743623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 4e818f5d781bb61c4bb9551fa03c4cc42a5402235987cdbf0802948d19a46029
MD5 04700390a45466279e0d5400ac032c1c
SHA1 94b8475734e7f3c4dd55d02bc80a66f713702816
SHA512 fcaed1fa7db51f9ee48676454d9a6d983a18053b46c33f1362330377e0355c4ed280fe5e622683e120bb21d4d6756709717f72366efa058a77224ac3d19c8804
SSDEEP 96:hbJ61d+hDK+UyKovbfaNQYutlSl8h4otop5+6DkB6fGyvUgbKfo6RNC39ISyVN9e:htqqDHUgvIdKiU2HIjsbKfo6uCznVE
TLSH
T1E5D10971A46D4D7B5DF2E849B0132D83DDA8606BA924BE5CDEEA0F0C01E34DC5393523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 43886b452485ee8af99332888d7ad731ed8de9670b2d823657d9c1bce207d48a
MD5 5bd9d56db3d4ca315ffb74ff88dd1bb4
SHA1 4c9cb6f96256c44be611a83f56c1b4fe9fa5b184
SHA512 c1d146b7f0c8c32bfefe345dda2540e065fb0ec8b85e9521de50b33196553c85659d224aec338a16a10a9141b64a809cfb709f3f50801fcbc0daf7a9b02a0303
SSDEEP 96:hC6Bd+hDK+UyKovbfaNQYutlSl8h4otop5+6DkB6fGyvUgIlG1QzbOQbLEfoIr0o:hCKqDHUgvIdKiU2HIjsIlTLfEfoIrUX+
TLSH
T143C12A76B47D9D732AB2D509F4132E83CEF5606B9A616E98CADA0F0C01D74DC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download