hxxps://robloxaccountmanager[.]com[.]de

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://robloxaccountmanager.com.de
Sample260718-b851aact7n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3388	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288130143245759"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
856	chrome.exe
856	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3716	3912	chrome.exe	88
PID 3912 wrote to memory of 3388	3912	chrome.exe	89
PID 3912 wrote to memory of 5300	3912	chrome.exe	90
PID 3912 wrote to memory of 5300	3912	chrome.exe	90
PID 3912 wrote to memory of 5376	3912	chrome.exe	91
PID 3912 wrote to memory of 5376	3912	chrome.exe	91
PID 3912 wrote to memory of 2748	3912	chrome.exe	93
PID 3912 wrote to memory of 2748	3912	chrome.exe	93
PID 3912 wrote to memory of 3460	3912	chrome.exe	94
PID 3912 wrote to memory of 3460	3912	chrome.exe	94
PID 3912 wrote to memory of 2268	3912	chrome.exe	95
PID 3912 wrote to memory of 1820	3912	chrome.exe	96
PID 3912 wrote to memory of 1820	3912	chrome.exe	96
PID 3912 wrote to memory of 1920	3912	chrome.exe	97
PID 3912 wrote to memory of 1920	3912	chrome.exe	97
PID 3912 wrote to memory of 3564	3912	chrome.exe	101
PID 3912 wrote to memory of 3564	3912	chrome.exe	101
PID 3912 wrote to memory of 5208	3912	chrome.exe	102
PID 3912 wrote to memory of 5208	3912	chrome.exe	102
PID 3912 wrote to memory of 6076	3912	chrome.exe	103
PID 3912 wrote to memory of 4320	3912	chrome.exe	104
PID 3912 wrote to memory of 6076	3912	chrome.exe	103
PID 3912 wrote to memory of 4320	3912	chrome.exe	104
PID 3912 wrote to memory of 4132	3912	chrome.exe	105
PID 3912 wrote to memory of 4312	3912	chrome.exe	106
PID 3912 wrote to memory of 4132	3912	chrome.exe	105
PID 3912 wrote to memory of 4312	3912	chrome.exe	106
PID 3912 wrote to memory of 3332	3912	chrome.exe	108
PID 3912 wrote to memory of 4268	3912	chrome.exe	109
PID 3912 wrote to memory of 4084	3912	chrome.exe	110
PID 3912 wrote to memory of 856	3912	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://robloxaccountmanager.com.de
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffc194cc728,0x7ffc194cc734,0x7ffc194cc740
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14877555004328208588,11672394013966849636,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,3796118356912885342,17823117253438664122,262144 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,9999253569939506474,7797934190788341804,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,450706527783650197,10070294914903742578,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,9047557126492559928,15181420336019631101,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,7429669123593682891,5412758814161814424,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5580,i,3376603594258890948,8570427409486364229,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5616,i,16901971812015665701,1106487829064231750,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5872,i,5625015948894882735,1005149641839728840,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5124,i,17663290948629135337,2161164960111373349,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5776,i,18190838552051360829,5051767403982307723,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5620,i,13395114116822358122,15219884491472654700,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4852,i,1282418153714883106,9314984104896253667,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6020,i,13305916974569653323,1214154011457770948,2097152 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,10275416192090858068,2541101756858831172,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,5263472927529434188,12164033054315318979,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,11388012002529338123,4795329288590208314,524288 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5428,i,4415840927220340335,6950265528443728278,262144 --field-trial-handle=2044,i,1671935676504575948,10407406674903834787,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 94a427e776291bc1df37fa465d6b2f199b870aafbeb98856b104877079df98d9
MD5 7231423795d4fdf1a0839c20c7c3f6c0
SHA1 9472eb523c1725ccb67c3e7b96bd7044c3d22053
SHA512 5eccae1b6556afd0f85a0acf4837741097cbe24db14959fda15cf073b1e3ce9cac2481dbd86fefd30e9f1c8decceb83c5dadcb83b527c63f2324e4a21fcc1b35
TLSH
T1C9B012501184414BD240137018953900362089780633491240BD409D44283700451081
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5c68a2e4f418b69c4eb35954351aa32d4df31f0bb24f2303ae4ac87fd9a2472f
MD5 d823a026d6d4b3347b1933f29642149b
SHA1 f2da71d2c93c3477a2f47f344c84004c8d456a2f
SHA512 f92b0a4f42ed5f7e3b9858aa60ef1357664d3ec31a739c75be46f4eafb0e141ccd6f06f278417caf3573a54370aeb62c47863fc3e1fa80daea59120f15804cf8
TLSH
T101718DF7C2E88D6EC80196F5AB257E1ACD5E0D1843683D1AC8E4AF4F57E1971E24098F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6e855b018c86c80e2938d7c24942c3073cbf148c202dface173ae8af3b88757e
MD5 c19e86389d10e44e5df892615d925b53
SHA1 250f4ee342e93b7874fb61417c9fb9c600b3ba5a
SHA512 43a4309682dfc88319d70edfef63ac9c88ab2920d5dea39cef0af1cd693e2a80f38776b8316e4edbd02064cebed463a08d382183be609bee553c2d56ff60afc9
SSDEEP 192:5BREypaRTv7QvAPRp20e9XxHsb+WNnxL60T2tV2Bbeb3VyIsnAUge:5BREKsr86XMfw5d2H2we
TLSH
T11832852EBD14693B6DCBC229FA657793D7F6102671D42E84E7F88A2C11DB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 502e8f11d1fae5071de0b2c9a7987f74480fb131fcd3c09a39d30e48f4c13fe3
MD5 c5d637f1f0ceef66bbc33a302ed80468
SHA1 76746c2a08bbb577a535fbf0c7b5eada7abf4039
SHA512 ee7049c476929eb81a6af9ea0807f1ad4b7e5610d80f347c3d6618ef51147cb28134769a32a2057e734ea46aac5fc9570ff8cd18eb88751d2f29c86b12ccdfdf
SSDEEP 192:5BREypaRTv7QvDPRpX0e9XxHsb+WNnxL60T2MV2BbebAVyIsnAUgE:5BREKsr8TXvfw5d2Y2bE
TLSH
T1F142962EBD10693B6DCBC229FA657B93D7F5102671902E84E7FC8A2C11DB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2fb89db4868b82289b6ac01999080783cb1c9d37811425fe8c13f3c68d9413cf
MD5 84e58252e11735994f09f2d803388497
SHA1 3b20756ba91d79b48fddc25fbc1b9aaece63f76e
SHA512 58c96892ae0f084246f4cdf90739df80f82336d017565964fe061d4a28ca597e8250e7120c592886087d20c662fff7b6cac0bcee1c3a3381907299f4506ed889
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934gMdSl8h4otop59icDFgB6nGyvn0SIhlm+9TqRNC39f:Rt0ITo+TQ0IviU23FETPSIhlm+9TquCG
TLSH
T19BC1F975945C4CB708B6A485B1133987CDB8606BA955BE64FEE90F0D01E74DC5393633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 18aae914d6379f944f4b33783d2bf039e0fb8d2d9301e794db7ea115bf489180
MD5 385ad33c468e01588116fd86addd3aab
SHA1 3a56e40bfb9df6014ad1c0ec8c676fb01eb3041a
SHA512 2a264669591cc4cad4565d581ab297bdf3e5e546d7b505c9bfa65244e809fb0c0e8b8fa4420bc0de1d72dc8022a33ddd5dcf0bef48412784dbc0858632a05b10
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934gMdSl8h4otop59icDFgB6nGyvn0SvQxwzQh3hjm+90:Rt0ITo+TQ0IviU23FETPSIxxhjm+9T9q
TLSH
T1B4C13B72A46D5C7715A7E442F0223A87CDB8606BDA52AF70EBE50F1D01EB4EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 573f042878107f24e39a135761ce8818656aa51cc637524f80baba04cec0fe77
MD5 502ec0cd1f22c36007d6b9f8ba4ecc26
SHA1 12057811c018f990a9d38efe748564a6bcfcaece
SHA512 6aa26abd5f1880ccbc98253697d6985d8c6c0612910c9dc5185d02edb613f4c1394c98c2ec339308b5e76dd3212997664f910292c44457e27292174f62200bad
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok59mDFgB6nGyvn0b4T8TybJv4a:xC0ITo+TQ0InDUDGFEPPb4T8Tybl
TLSH
T19DA10935A0684D774476D486F1626A83CFB9706BE972EF90EAD90F0D15FB0EC1341623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e005f441-3bc6-4e54-af40-d83087736246.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e005f441-3bc6-4e54-af40-d83087736246.tmp
Size 5KB
SHA256 5ec4beed72ff6b97426369e8dcabd1a3b1a580b368d85d6266c3193d8680537c
MD5 8d3f088c0c2a16c6b802900e9872f142
SHA1 7314f2d1f4f6901de7e39c3c641f018743a82ed9
SHA512 4f2625f9e557fcaa664d2c117f6bcefc7e4ea6c7282a63b55701d7cb55792429620b8b9d06ea622bfb109017e254fd33d3bab127db01d305026a6353a07c471c
SSDEEP 96:RC0d+r2io+TJ/E0f6m934gMdSl8h4otop59icDFgB6nGyvn0SvQxwzQh3hjm+9TA:RC0ITo+TQ0IviU23FETPSIxxhjm+9T9q
TLSH
T1F4C12B72A46D5C7715A7E442F1233A87CDB8606BDA52AF70EEE50F1D01EB4EC2352623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download