e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6

Analysis

max time kernel
149s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 19.4MB
Sample260720-e1cwbaey2m
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4176	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289954966474164"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2900	4724	chrome.exe	88
PID 4724 wrote to memory of 4176	4724	chrome.exe	89
PID 4724 wrote to memory of 1504	4724	chrome.exe	90
PID 4724 wrote to memory of 1504	4724	chrome.exe	90
PID 4724 wrote to memory of 4596	4724	chrome.exe	92
PID 4724 wrote to memory of 5528	4724	chrome.exe	93
PID 4724 wrote to memory of 4596	4724	chrome.exe	92
PID 4724 wrote to memory of 5528	4724	chrome.exe	93
PID 4724 wrote to memory of 2128	4724	chrome.exe	94
PID 4724 wrote to memory of 2128	4724	chrome.exe	94
PID 4724 wrote to memory of 4784	4724	chrome.exe	95
PID 4724 wrote to memory of 4636	4724	chrome.exe	97
PID 4724 wrote to memory of 4636	4724	chrome.exe	97
PID 4724 wrote to memory of 5828	4724	chrome.exe	98
PID 4724 wrote to memory of 5828	4724	chrome.exe	98
PID 4724 wrote to memory of 3528	4724	chrome.exe	101
PID 4724 wrote to memory of 3528	4724	chrome.exe	101
PID 4724 wrote to memory of 4820	4724	chrome.exe	102
PID 4724 wrote to memory of 4820	4724	chrome.exe	102
PID 4724 wrote to memory of 3432	4724	chrome.exe	103
PID 4724 wrote to memory of 4804	4724	chrome.exe	104
PID 4724 wrote to memory of 3432	4724	chrome.exe	103
PID 4724 wrote to memory of 4804	4724	chrome.exe	104
PID 4724 wrote to memory of 4928	4724	chrome.exe	105
PID 4724 wrote to memory of 4928	4724	chrome.exe	105
PID 4724 wrote to memory of 4336	4724	chrome.exe	106
PID 4724 wrote to memory of 4336	4724	chrome.exe	106
PID 4724 wrote to memory of 5540	4724	chrome.exe	108
PID 4724 wrote to memory of 1396	4724	chrome.exe	109
PID 4724 wrote to memory of 4644	4724	chrome.exe	110
PID 4724 wrote to memory of 2224	4724	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa3884c728,0x7ffa3884c734,0x7ffa3884c740
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,10166157273100171544,11160587271985945296,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,13715740286260012214,8151476615663018805,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:13
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,16579108504775279584,1739481731154736827,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,7642025776100908085,12637260937846471391,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,3936374769991274779,15152180510859079819,262144 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,16034255828739814694,15196688814020555123,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5504,i,7380814550309525037,8396045317415306975,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5576,i,2585600157903181380,6039160114776797775,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5556,i,7717877282998684930,4545171828225530737,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5856,i,9895672540536319253,14373907219867068573,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,17681737509899296496,6747102172416717937,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5576,i,6907053236287527331,12136636857559647057,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5612,i,2476127491887533174,4678521825228312778,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5656,i,10434707119012352307,8748879200279332167,2097152 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,15178355084004628198,1008873344794758547,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,12600415529964105299,8210259026530067997,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,9337040549375797442,9943404592703303512,524288 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4892,i,3428022102535327856,14736009599868392121,262144 --field-trial-handle=1984,i,10770078973170010314,1036339241874709303,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5fd047fce3d4d11c0e8198166f007c779c16e7ec3854c9d6da0624e706de85f0
MD5 92266bf90db2cbc6bd2c881ec9c2e39a
SHA1 13c662a2cf45a78588c318e5685db366e6085ebc
SHA512 70ec7f701014bfd158c3310c86d10621f6440eaf5d4da486872682fccfe58a46a5eec361c7693ed4578a08c20d1555fff7f5daf1e5c1c53b946ddf3d58a375ef
TLSH
T1CD418CF7C3D8853D891156F4AB152F1FCE2E0A28021D3C66C8D4AE1F53E2972D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 34f9c4fe23993f09ab5e1da9924c7798938ccc2bdbb43e45c2c5c383041b39eb
MD5 dcd990a0c1531842a60ca3fdd8f5c7a1
SHA1 c0614563fcfadfd00425352f26e58903ef7e384a
SHA512 4e28ac45736d71b29b23988d7a550b54c4e0152a9cc5989a2ded14cd891614e4179991a4cb1472db5428404a67e8146e9680ad7d40f2c6a2ea24f7386152c3d2
SSDEEP 192:bRmPo4Nv7xbvAPRp2Pc9GHsb+WNn/TPYcgkwLUVVyIsnAUgR:bRmPrtN6X/gwrPMYDR
TLSH
T1C732A82FA914653BACDBC22AFD227793E7F5102171942E84EBFC8A1C15E75CC222745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 48ef97823a926ef2ec8acbfa1285071399172664482622faff9293c64e3afe3b
MD5 e46c001b4c044040a55174c3cf8f4458
SHA1 c9c0d1fb42521eda2cb4330f61531a680b3379ab
SHA512 efad2622f2dca28908519304b02d5362b778db9a7d513130db021d06780b00247f96364b63512eb6cf041e7fb8d535c9e56387305d052e0daa906b8efc00d5b7
SSDEEP 192:bRmPo4Nv7xbvBPRpuPc9GHsb+WNn/TP4cgkwL1VVyIsnAUgE:bRmPrtNhXngwrPsRDE
TLSH
T10242C82FA914653BBCDBC21AF9267793E7F5102171942E84EBFC8A1C15E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 28efaa890a38c85f5cecc63f684b5bb3965f2d47acdbee672ddb0f4c64d7cc48
MD5 6ba655bcb75a60b467ae0badcb4b1411
SHA1 98c789f2916bd6df735022d9bf04e30d6ff61f88
SHA512 8f009db0a044c922cd1b2f9902655a8c24158914e8bb3a52605d820bf54baa456d8daa0ceaed2816f4716bdf6a4dedf0c6d0e50e669a8c92fcd5620d665d726e
SSDEEP 96:QbJ0d+CVgOeTnnGBfYZSSQ3/RSl8h4otop5kiDtB6oNGyvhyY8f+caTyRNC39ISE:Qt0JeGnxiU2lzGa8WcaTyuCELq
TLSH
T140C11A75F05D9CA758F6B489B1032D83C8A5216B9A157E58EEE84F0C01E74DD0343937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 db7bbf95bd63654818088a7fbab28a5ec68fcc56cb0d03b09555443c56618ba9
MD5 82516eee23d13300d22c9574850314bc
SHA1 69913c341930b0624fb5d1e86a20d5a01b1a9fee
SHA512 3a08db3f0e1ae16b9e51aba8c47aa718b3c373006ad696ad5d050e5194bd3c171379bc6a3d4d8f1528b5f2f3f12d2fe6a619f3a0529155a865bbc419ff853d38
SSDEEP 96:QC0d+CVgOeTnnGBfYZSSQ3/RSl8h4otop5kiDtB6oNGyvhyYMUGsakO0AGXwXf+M:QC0JeGnxiU2lzGaMUGsQXWiaTUiUv
TLSH
T100C14E71B4AD987358F7A959F5022A83CDF521ABD651AE50DFE84F0C01EB4EC1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 da31a944d3de47d8dfd67698d4260881d6b4c472a7c987d19447275a16bd02e7
MD5 82dd46967cdc8aab6477f1a7fefe9161
SHA1 a33fd8502bc3fc8dbd47a560450f70c939a70004
SHA512 023bb92e2e717ed5564ac2bf4d9fc173c39a99c376f9579aabe7d3c5e5a0f70556908974a30e1b761ce5a879a77c8f57b0ab7dfb095cb965573c27b94ffe1f10
SSDEEP 96:QbJ0d+CVgOeTnnGBfYZSSQ3/RSl8h4otop5kiDtB6oNGyvhyYMUGsakO0AGXCf+M:Qt0JeGnxiU2lzGaMUGsiWiaTUiUv
TLSH
T19DC13C71B4AD987358F6A959F5022A83CDA121ABD652AE50EFE84F0C01EB4EC1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 60c0ed4fbabd28402b9c45616f987f93361796e92ff3a731076ed121b7b6d7ba
MD5 7a4fa847a1bdf81ae1fc4c63704f4588
SHA1 90bf46d70c5473fcdbcd5cffc8a26efccb4a0648
SHA512 2095db4654cc14043f4bd2bce9035506a781cba3b94660d57839e9b3a705d629f58c735b99330cab931cec04bc825a51a73550fd99e13dbce52024d125ed60e8
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5kcDtB6gGyvhyLfOLTEbZP9v4a:SC0JeGnpDUD7zE1mLTEbj
TLSH
T160A11C71B06D997354B69889F9526B43CDA521ABDA31AE44EDD85F0C42FB0EC034293B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download