hxxps://apps[.]microsoft[.]com/detail/9pmf91n3lz3m?hl=en-US&gl=US

Analysis

user interaction
yes
max time kernel
264s
max time network
261s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://apps.microsoft.com/detail/9pmf91n3lz3m?hl=en-US&gl=US
Sample260722-dfhqdsxfnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3564	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291626539186386"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
5332	chrome.exe
5332	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 4248	3684	chrome.exe	89
PID 3684 wrote to memory of 1732	3684	chrome.exe	90
PID 3684 wrote to memory of 1732	3684	chrome.exe	90
PID 3684 wrote to memory of 3564	3684	chrome.exe	91
PID 3684 wrote to memory of 6024	3684	chrome.exe	92
PID 3684 wrote to memory of 6024	3684	chrome.exe	92
PID 3684 wrote to memory of 1536	3684	chrome.exe	94
PID 3684 wrote to memory of 2728	3684	chrome.exe	95
PID 3684 wrote to memory of 1536	3684	chrome.exe	94
PID 3684 wrote to memory of 2728	3684	chrome.exe	95
PID 3684 wrote to memory of 1000	3684	chrome.exe	96
PID 3684 wrote to memory of 5924	3684	chrome.exe	98
PID 3684 wrote to memory of 4896	3684	chrome.exe	99
PID 3684 wrote to memory of 5924	3684	chrome.exe	98
PID 3684 wrote to memory of 4896	3684	chrome.exe	99
PID 3684 wrote to memory of 6092	3684	chrome.exe	100
PID 3684 wrote to memory of 6092	3684	chrome.exe	100
PID 3684 wrote to memory of 1716	3684	chrome.exe	101
PID 3684 wrote to memory of 1716	3684	chrome.exe	101
PID 3684 wrote to memory of 4396	3684	chrome.exe	102
PID 3684 wrote to memory of 4396	3684	chrome.exe	102
PID 3684 wrote to memory of 1676	3684	chrome.exe	104
PID 3684 wrote to memory of 1676	3684	chrome.exe	104
PID 3684 wrote to memory of 5788	3684	chrome.exe	105
PID 3684 wrote to memory of 5788	3684	chrome.exe	105
PID 3684 wrote to memory of 4456	3684	chrome.exe	107
PID 3684 wrote to memory of 4456	3684	chrome.exe	107
PID 3684 wrote to memory of 5688	3684	chrome.exe	108
PID 3684 wrote to memory of 5688	3684	chrome.exe	108
PID 3684 wrote to memory of 6056	3684	chrome.exe	110
PID 3684 wrote to memory of 3344	3684	chrome.exe	111
PID 3684 wrote to memory of 1512	3684	chrome.exe	112
PID 3684 wrote to memory of 5332	3684	chrome.exe	113
PID 3684 wrote to memory of 3740	3684	chrome.exe	114
PID 3684 wrote to memory of 3740	3684	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://apps.microsoft.com/detail/9pmf91n3lz3m?hl=en-US&gl=US
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffb39f4c728,0x7ffb39f4c734,0x7ffb39f4c740
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,10005689455282202576,9477923548990209450,262144 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,8246587356600150887,12066623668489112744,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,1665329853804927305,1079365483134557936,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,5256325652233214561,14751765513357887373,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,13900077955062924049,9044076184416322876,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,15143856938482079626,13193970114189570221,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5508,i,7942028822100450224,14090404666135745670,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5548,i,10497370645877207642,847081741451038851,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,7438407399447901841,100115784663536810,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5968,i,13975209377443283555,8735199478446113587,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5944,i,1413837875032092182,4203808076041367781,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6116,i,112942483741896347,17283013004196034594,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6292,i,7992772721113566092,10578056889568427356,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6632,i,9482825879799163611,6007254589669344963,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5784,i,12215201933560251455,14599283047857734430,2097152 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,13346108598282758315,4071901839258099788,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6568,i,14006489916726538282,16628478056789861257,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,15394956451159070699,18226478493891453922,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5644,i,15445333184881616036,15924195580927566604,262144 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6616,i,2800039288239129274,16771044398155704029,524288 --field-trial-handle=1908,i,281032164827003142,10084049449347000678,262144 --variations-seed-version --mojo-platform-channel-handle=1132 /prefetch:14
  2⤵
  PID:3740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b285765d6ec3322773f414b339aa3d07cec65aae13cb87e5135b77d9a1107f20
MD5 6555ac7f9cdafa598410680856168fec
SHA1 55a907e5679f1c1cd0fd9ad6fd29b12b84da0d80
SHA512 fb04404d9d480d5f4b5167abe78f83fdcfd30d839c24e75dff2ab60f3b7fa0b7a8ab573403d95d54ddddd58635bab52b58ded3f90f8ee0653fd7df4f36b12b82
TLSH
T1CA3182600A993877C747A0F58AEA16D9F8B3017A011F2E9C481621FC58F1FD76A6F832
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 16d9a1b8861dee81a8c10846e22b64cd1a4d59e21cce6cecb1cfd9618f617028
MD5 3804f229d60ad65f48fb18c4eea7ca95
SHA1 9e9b67b6585e35bc643bad4dc2ab9875fbe7eb01
SHA512 6697015a70214b6bdc4ed9cc9e43022f39cd63e71f7874df393764a6e747c9cb38297a06554782afa9b6cb797642688492038bef41306cb29b94f7c466e663b2
TLSH
T11B8177F783E4856E891196F4AA15AF1FCE2D0615431C3C2689D4BE2BE7E3872E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6aaea5a1847e67d1ca91e15cdee37c9c133efc88130a21d592cf9ecb9ece284c
MD5 5800712780dce0ed592852a4f50ad8b3
SHA1 252925c541e89a92f7eb844acf3beaf32651328a
SHA512 3ce986ac55bd98596989888381e1567953ff546f205ae44759c417ff79b947bc5ab7b70b7d2db2836e7a1c3ad2dac46118aa402e6cf1bb8023def9f7f61e58d9
SSDEEP 192:+Ri8YZNwv7ivAPRp2b9rHsb+WNnRfPUz2rTMkwHQVyIsnAUge:+Ri8Qsm6Xw5wlPS2knUe
TLSH
T16132B62EBD21787B6CDBC22AFA217753D7F5102161A42E84EBFC8A2C15E75CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7bf3398b601ffc868661bbc66840b8a5c06061ca7cec24369038c1b90d042aad
MD5 f12359bc187bda464d04d23dbdb3cff9
SHA1 0ac848955cf914b211d6495a7f1e3fcb3fe480fb
SHA512 698c90bb3a9c468c5d9fa3fb6b37aff49279ad6856382501fa68eb672aff1e8a8cdc1aa4c1a54a50ff325af9b1d053d84b2143d0f539df12ade72460cf608fee
SSDEEP 192:+Ri8YZNwv7ivyPRpkqi9rHsb+WNnRfrmU2uz2rTMkwDQVyIsnAUgE:+Ri8QsmMXA5wlB202kjUE
TLSH
T1E242C82EBD21687B6CDBD22AF9217B53E3F5102165E42E84E7FC8A2C15E75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\5402dcaf-c2f3-4bb9-a46b-4cd4f80e8983\index-dir\the-real-index
Size 72B
SHA256 2c517280b73543ffb8967f79d6f6c1ac0db34becb958e60dd1d31c08db11fe55
MD5 95ff028fe1adc5f9a532d76560706093
SHA1 fb4c4c0f78bf1305a8d0c1a439d64ad1972c445f
SHA512 9b72843a4ba348dfe2499c709389a2b1a7c233ccd1786276a89300ea89d0b85b3724cb21821b25f83ab7615c78aa0921fe83e735032d7c02e44355be36e1a89c
TLSH
T1A3A0029049498431E103C676A0B1058E721288E91749035A40B412E88850B818212031
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd1a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\5402dcaf-c2f3-4bb9-a46b-4cd4f80e8983\index-dir\the-real-index~RFe59cd1a.TMP
Size 48B
SHA256 27ec27dd57ff4cc3d1ab54ac04cc6efbf156a0f1c8b6c8b36912a67ac42d7dcb
MD5 eac3e9acb913030c663b5ea0222db449
SHA1 af23dec649889c1e5ac21a315c445dc6f09625e7
SHA512 6c3f354c34c5fcfe89536c23d9db6666120cb02c104059e5153341f5d5bcb1b682f412866c7ca7932c67c08317944cf79cad977e7d82c11db82a6fdde4c9c71c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\85b40e6e-268c-4fc4-b461-c6e12e8020e9\index-dir\the-real-index
Size 3KB
SHA256 1979f3346144db9a141655481ffaf4e9d513406046942c76e1ab0ef6abe2ec48
MD5 d19a822a2794cd175ef7c6838ce959ae
SHA1 0526d325986b8cd490a0dc7e0421ea2998c92c4e
SHA512 248c362c703f5570c97fde696e9522f77569a2988baeea9664815edb74b57d5d2ad97ea8d5149c8fc524f1bf588368c14c49ab711739ba4aa6d4324df38333d5
TLSH
T10571EAA62C53D530C51E8D3341F8DC1FE33F73DC034A3A1D142D1AB46E462292B51790
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59deae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\85b40e6e-268c-4fc4-b461-c6e12e8020e9\index-dir\the-real-index~RFe59deae.TMP
Size 48B
SHA256 1cb966dee3fe70d2127f722260ce2133eca36149b62565e7006dd367fe753c79
MD5 a5fa1aee6e1ee08def386275e5a88e9f
SHA1 ee85a627bb4e265642a3ddbb54a3e22c5413c42b
SHA512 1505d9e634c0c28ebca813eb47cce2ff916b94fd73516e39facbfa17ddd2ccbc7272cf9352a377ea74c105864da44a57b9f4cfe3ee7e71e05c6a1d022777d2ee
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 b33264f1e30e95552eb9b2f89eac03761728f4d29d1714bcf73536e8b3f374da
MD5 fe7fbf5222d9e3bccb327415a1556ba5
SHA1 34cd03353005cb7cdcfcec0ff08c486bd349499d
SHA512 1e992d561be83f6c2c7a790bc8113b9b7c0ef041db8be30c7b1c8cc3137980412c92c3f621b7c9497a8fd2a661c52cddf5bef88551a9960e06725cb65b156390
TLSH
T1EDE068576572A211E7E54CEE09D0F24CD83F3E83AE90CFAC00C0B04208BBA6A8563F13
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 f44f57cb2eca908a0ef2cc612665acca5f5940df8a564ff6ba06b4282d1cac6a
MD5 fc2e30de9d202326442fea615c138269
SHA1 8d3983387630b4fbb4cb8c46f6480bf8bbc2f54c
SHA512 be8a6610b0f816c1d401cb2eee89fa1ea2485bfe40b276fc9777d8bd1e3f20fff5e1e10cdd1caa3e51b954f6123fcc818b441d3f283da7207361f1268ce51b1c
TLSH
T18BE0685762729211EBA14DEE09D0F658D83F3283AE90DEAC00C0A04208BBA7A8563F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597edb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe597edb.TMP
Size 195B
SHA256 b605fc3618d6f8b0d6a7d654f34d043a6241fa70e54bf30a613e0c22f5e7f3c0
MD5 33df7a6c69bb92ce3f081408d2e9dadb
SHA1 7ec9789fd9ce8d0864e0a276bbf470355d58db3d
SHA512 73c584c577d728a8c42dff783079b573c6ed3f44e5b955f6a39dce0ba943ea0f3d1875e0a9bfa4037e0207c5b77a1b9a7c686a283099d3946d47b995652034ea
TLSH
T1B3D02296803251018B900D964DA1F288D82F2E836C82CCB980C9B0404CB63AA4193A62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bbed9c15e17a1ea45f691de84da7bcc017033280f5cdc09f8807e0a6827cf9bb
MD5 05f1d60439f68056e76d942b1db5ac22
SHA1 21fb30bd8b3065160c2235b64310042bd1c99fef
SHA512 3a63260193ecd8ad0ed488a043247c9790b285a259aad202520e9861fadc1c29d12794183fef14555e75125357496a93e7b2372ae1b3c480573c5c321cf464f6
TLSH
T10BB01212808FD522CC0142B025C4648C31328E318611130E96E06DEADC432E001102A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9f3ef8d6091fdb512d461f0461c3c1dcb47b4eb8a98586133922f9a4fdcdf59b
MD5 a66d1d7edeaba35a0762d656bba0699f
SHA1 c845152196cf0c4dde2f93ed6badd88ea0d3b6f7
SHA512 9a6bf2fa203f7512dc4a4e8aa12574ea6b0003f803ed1b00345715af1ef67c063e903d630f1b716ffc5c4fcc8febc40f39eb2c37b188c469561c87e65662a6fa
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8ILGGQSl8h4otop5YFWDbB6LGyv4Y+mE1I07Gj:TC0cTkJaRZi/CF2laiU2AQlvI+mEmWGj
TLSH
T19CC11B31A87D98B369B29656B0433A43DEB8326B6D546E54EFDD0F1901EB19C2383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 daf47508de8cb7a03e7ba3b26ffb9fc33be46d9fb354cabec08a0b235dccf903
MD5 08782336d3c1692f1aaf6accc45af772
SHA1 22aedfc0b05369c84403be658a291ed6c1dcb865
SHA512 cb0376e26adbc88f0f90b0b4ef0a41bed6ce024853f150257942e1835fdc68b92b7052f36f73ea991527ae1a6b37dadfef6123849a71218d5fb4b879d7bedab6
SSDEEP 96:TbJod+PTkblaRZiIEby3rUfsfuZ8ILGGQSl8h4otop5YFWDbB6LGyv4Y+MytcxKa:TtocTkJaRZi/CF2laiU2AQlvI+MytcxB
TLSH
T155C1E771986D9CB759B2A986B1032E43CDB8226B7D587E58EEED1E0C01E74DC1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 891af8e7bb27fe87f0426296b9959991b9360522e44ed2cab905843cf120f562
MD5 89c3451483f888ef787dfdc23c6468eb
SHA1 9d794c730dbb56556299fab4bc3d9e164516b818
SHA512 3d2f0d54cfaa7bbbcc4ab20bd500664eeda714a26a5375d6b0382e4617f126886f060993928f7ff32353f4009243aeba52a921ab58c7c3dda7da2c59e1f609cf
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5YFADbB6xGyv4YR5gKObETev4a:TC0cTkJaRZi/CF2lIDUDA2lZIR5gKObV
TLSH
T1E1A12A3264658DB76976D98AB5423A43DFB9722BB950AE84E9DD0F0C15FB0EC1342133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b79aa6921a749d9e4548f13d8d66b29d99a2d7273846336a92d0ae188c4f49df
MD5 a4ac90017eb3880c17596323a7dd5243
SHA1 30e3c85cc3e2f95f06fed43d6ecf45419f0e7233
SHA512 470e3a992412348bf03d84ef860d19d5ff4d817686691eb1267ca5cfc9c85967385857e593376ac4ac7ca8c06ba9c3d42ebfadbc08f36fa2e9115dc86da5662a
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8ILGGQSl8h4otop5YFWDbB6LGyv4Y+mE1I07I:Tt0cTkJaRZi/CF2laiU2AQlvI+mEmWGj
TLSH
T1E7C10B31A87D98B369A2D656B0433A43DEB8326F6D546E54EBDD0F1D01EB19C2383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 beefeb3b9d840cebdf1be6f7a399a706cac4ee1cdae8c1fc9141f66561e888bf
MD5 ec9bd1b28f3f726246f786abab562601
SHA1 11286d3b6fa219a4f059b93b4359be67a8860112
SHA512 e0f347303fdafb455e53f5a507e74aaf5a0a5b95cd7c48d8019eedc1687ca40f6fc88b3f467f1817bd643e5e90c529d41f83b333062a5b8b80df66c95cb89562
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8ILGGQSl8h4otop5YFWDbB6LGyv4Y+MytcxKa:Tt0cTkJaRZi/CF2laiU2AQlvI+MytcxB
TLSH
T169C1F772986D9CA759B2A986B0032E43CDB8316B7D687E98EEDD0E0C01E74DC1383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download