hxxp://enhypenus[.]shop

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://enhypenus.shop
Sample260719-3sraqsgx8k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3904	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289784463381240"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe
Token: SeShutdownPrivilege	1216	chrome.exe
Token: SeCreatePagefilePrivilege	1216	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe
1216	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 692	1216	chrome.exe	88
PID 1216 wrote to memory of 3904	1216	chrome.exe	90
PID 1216 wrote to memory of 3124	1216	chrome.exe	91
PID 1216 wrote to memory of 3124	1216	chrome.exe	91
PID 1216 wrote to memory of 6124	1216	chrome.exe	92
PID 1216 wrote to memory of 6124	1216	chrome.exe	92
PID 1216 wrote to memory of 4000	1216	chrome.exe	94
PID 1216 wrote to memory of 4884	1216	chrome.exe	95
PID 1216 wrote to memory of 4000	1216	chrome.exe	94
PID 1216 wrote to memory of 4884	1216	chrome.exe	95
PID 1216 wrote to memory of 5876	1216	chrome.exe	96
PID 1216 wrote to memory of 5876	1216	chrome.exe	96
PID 1216 wrote to memory of 5244	1216	chrome.exe	97
PID 1216 wrote to memory of 1348	1216	chrome.exe	99
PID 1216 wrote to memory of 2700	1216	chrome.exe	100
PID 1216 wrote to memory of 1348	1216	chrome.exe	99
PID 1216 wrote to memory of 2700	1216	chrome.exe	100
PID 1216 wrote to memory of 4128	1216	chrome.exe	101
PID 1216 wrote to memory of 4128	1216	chrome.exe	101
PID 1216 wrote to memory of 2276	1216	chrome.exe	103
PID 1216 wrote to memory of 2276	1216	chrome.exe	103
PID 1216 wrote to memory of 1156	1216	chrome.exe	105
PID 1216 wrote to memory of 1156	1216	chrome.exe	105
PID 1216 wrote to memory of 5220	1216	chrome.exe	106
PID 1216 wrote to memory of 5220	1216	chrome.exe	106
PID 1216 wrote to memory of 2988	1216	chrome.exe	107
PID 1216 wrote to memory of 2988	1216	chrome.exe	107
PID 1216 wrote to memory of 904	1216	chrome.exe	108
PID 1216 wrote to memory of 904	1216	chrome.exe	108
PID 1216 wrote to memory of 696	1216	chrome.exe	110
PID 1216 wrote to memory of 1076	1216	chrome.exe	111
PID 1216 wrote to memory of 3652	1216	chrome.exe	112
PID 1216 wrote to memory of 2256	1216	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://enhypenus.shop
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x110,0x7ff920b4c728,0x7ff920b4c734,0x7ff920b4c740
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,3360510455869522081,17509445107836400715,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,392850326229327696,18008051954768131862,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:13
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,14702417916897597407,16132876103977794367,262144 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,2762847257370349564,11401818222492343238,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,14178147196491789393,1026061510752270402,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,11567700633867224856,1609063262726348691,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,11650357649776539816,603332485645729604,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,7590975573591912069,7145722931459739553,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,391952049368148636,16727470880246685699,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5916,i,12172217476318405130,8295116401105585229,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6180,i,15363847763874760905,17966352725226975544,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6360,i,5334727619148779169,675906613679434661,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6352,i,12087112165675268176,357859353110595247,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6600,i,12612046225221667555,13041608900066990197,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6728,i,13903586484247621178,13823597032566816752,2097152 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,14107846582971595117,13165889623125004717,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,6134028694400590294,5642077304505500954,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,7104621598138413939,9155600791207459506,524288 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4968,i,8176486544209541563,1566441991159438370,262144 --field-trial-handle=1892,i,290454182229253373,4796413633772342665,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f77f1883e27383214decf7dbfa0f3404647b47b44a2b3052e1e1da615a4d5385
MD5 29896db608ede0e7c98a900644a96287
SHA1 6dd616b4a45f22b704878f29a14940525c16cebc
SHA512 a30bcea558beb60851403e33520b4b04b97bceb9236efa9ad95506333abe581edeaddfd4baf0eb189ebb96ea06c47f71fe5619740d230686c87ebfe6b2ecc313
TLSH
T131C0124563C1171BFB485DB37E072FC032800F299603229784E0D144BFE6FE5709504A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7db48be971345ef63be78752267aa30e719a65a52514f867e61322a654462910
MD5 f5a0535ea851fc5b42d1be8a5038ca71
SHA1 0d3571c8435cc967cd880590048deff2e442723f
SHA512 04191848442c0efcfe97390886714630fd6c473d3e487ecb61d9129e0056e9802f2af6b3adf81a7a01b1501dde00d47e124872aa32748793b5c91543ce7a8c16
TLSH
T1DF5179F7C3E8897D894156F4A7152E1BCE2D0928422D3C27C8D4AE5FA7F28B5E21064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af38eb7d4787930b229d4e63490cca510d4a421942f0ba4737ae6a506cef40ac
MD5 fbb121e73c25fcc504f21cd244a50778
SHA1 2b40b777aca6540c4cbe5bac3378e7595d60dda9
SHA512 6da0267731823b01c3890a7b9a787dd1f59a165c70ad68a568a447e20784da733eaa3d0962aa48abf4b8ae78ada805714c8cc4e8de3d2b6fe232e62266decbb1
SSDEEP 192:ZR0foCjv7uvAPRp2XHy9UHsb+WNnR41qIf2uTeC2a4S4+VyIsnAUge:ZR0f5bK6XSyGwuoE2g2h2e
TLSH
T10F32956EAE10697B6DCBC22AF9657793D6F5112231D42E84E7FC8B2C20E76CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2eaedec3000d922ff60fac5999dbb085431461e7d7c91619c2a2fa56f9f8cf8
MD5 33d4248198978ff99758d189da137530
SHA1 35811efab96d708a4866a384d9457c3679c8da14
SHA512 e04e9cdbbaf7a0bc6fa23b3e32f9e5312a4fb2815c9807784f91e2d16c854326f0b1746459f584736ce91279f311d213c6a0353a3dd0d8cfc9577e739ef4b5f1
SSDEEP 192:ZR0foCjv7uvCPRpVTXHy9UHsb+WNnR41qIf2V7TeC2a4K4+VyIsnAUgE:ZR0f5bK8XdyGwuoE2B2p2E
TLSH
T11D42966EAD10697B7DCBC21AF9667793D6F5102221D02E84E7FC8B2C21E7ACC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 93785f5a55dd4064becb4f1cff2db93ee5c453069390cd1f175b14efbc7c3712
MD5 3f745d2e721c8e8653083d0942fd1e3b
SHA1 65c5deb319ad77fa2904b9e80a68747d89661424
SHA512 1054802f590f58b87fcf7dd07e0c496be092915ce6b1963537363cc344b69aa858c5224a631afcd5370a01ccfdb24fd88e105054f3077d30b55a845f9d252488
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9mO5a1AfTH:oKj8P7KxkXqKf/pUZNCgVLH2Hfgslxbg
TLSH
T10132EA67948D9E3B4FD8D518CC176B8B6CB4019673780824A6FF9D0403A67CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b287be804389f38b9bcac01ba31496f18b44bdc8f3fa7cc771ed4c57c0280ad0
MD5 144973590ab5f4ac09a34e4c8bda2dc8
SHA1 0d7000ca017c3cd9758b461d59f30eb4a98ba744
SHA512 0b49fa769f0da24d90dd84b886b25b21e698585cf656503f62084cb118addd09056e962ac725e01631449190cff38e2fdde634728219c19f7c50749574a9d362
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphBnIESl8h4otop5CItDAQB6DGyvODcQTa13RNC39Ij:Ct0AJr7fbyVlOIiU29pbFcQTa13uCOY
TLSH
T1F3C1F8B1A46E9C3B5DF3A445B1032E43CEB4626B7955BE28EADA0F0C00E79DC0383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ec88e58c6ceab5fbe137fa7fb144e8bc0c5dee5db9c0f4ec26f1dfbd98352cee
MD5 97de0d9d6cb9895a967a42a05894a356
SHA1 02bdf973e07d6cc4b9f962e01d1dff219d3124e8
SHA512 c14e898d6b6a29f0b6c5b9d6d15eeb251a20c8133d07512c6724619a69d191e36316acba3b1f22b2b6a2556285f8061e1d7c72270c9bdb3b40fb149ec4c44142
SSDEEP 96:CC0d+qKJku7fby2f2eaPphBnIESl8h4otop5CItDAQB6DGyvODcyXxwzjQ4PS1a0:CC0AJr7fbyVlOIiU29pbFcmxoQ4a1a12
TLSH
T122C11AB2F8696C7759F39595F5032B43CEB462B79B01AE68DAEA0F0C00E74EC1342516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 336194a1a3cb2da2ed1ac67f369e7dd32e2211ff21c28e1e13568ff64211447d
MD5 430c614ea5351f336c1dfed1ef5d68a7
SHA1 b0c8fb1c2883bd458de5550192ebe57a56bd6f52
SHA512 ab92fdf506d5b25ddfb9cd24df82ca86aede688eec3fcc3dc71045cb39f89616f31684f665c2cddc2b3be920dacc0a5e40135a1ca9b4384648d7e92270d2c5e9
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5C3DAQB6AGyvODqL1/bjv4a:gC0AJr7fbyVlFDUDcpkFqL1/bH
TLSH
T15BA10972F4664C3B5DB6D544B5122B03CFA4A2A77961ABA4DADD0F0C00EB4E80742627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a375c81623c6c850dab482d1607b8d5bae878072a3191ff9547255e12ce81013
MD5 40c0b7ee016a400a80a333eb67ee8256
SHA1 c18045b6eeea2ab9c6d9172edc98222373f8bb79
SHA512 525e1b8180d6ee3c47a64457a34bc11265e0b425fcf57bd538808d3a5a870d446def25e9102283ff288f153312bc4622d1d6fd4f7fb9f58d5ae9fa67d6bbe4ce
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphBnIESl8h4otop5CItDAQB6DGyvODcyXxwzjQ4PS1f:Ct0AJr7fbyVlOIiU29pbFcmxoQ4a1a12
TLSH
T1CEC12B72F4696C7759F7A595F5032B43CEB462BB5B016E64DAEA0F0C00E74DC1342517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download