hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260723-dffwssvxfx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5172	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292490369347778"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
2472	chrome.exe
2472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe
Token: SeShutdownPrivilege	6664	chrome.exe
Token: SeCreatePagefilePrivilege	6664	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe
6664	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 6664 wrote to memory of 4960	6664	chrome.exe	89
PID 6664 wrote to memory of 5172	6664	chrome.exe	91
PID 6664 wrote to memory of 4900	6664	chrome.exe	92
PID 6664 wrote to memory of 4900	6664	chrome.exe	92
PID 6664 wrote to memory of 1144	6664	chrome.exe	93
PID 6664 wrote to memory of 1144	6664	chrome.exe	93
PID 6664 wrote to memory of 2552	6664	chrome.exe	95
PID 6664 wrote to memory of 2552	6664	chrome.exe	95
PID 6664 wrote to memory of 2560	6664	chrome.exe	96
PID 6664 wrote to memory of 2560	6664	chrome.exe	96
PID 6664 wrote to memory of 4544	6664	chrome.exe	97
PID 6664 wrote to memory of 4544	6664	chrome.exe	97
PID 6664 wrote to memory of 4836	6664	chrome.exe	98
PID 6664 wrote to memory of 1044	6664	chrome.exe	100
PID 6664 wrote to memory of 1044	6664	chrome.exe	100
PID 6664 wrote to memory of 2280	6664	chrome.exe	101
PID 6664 wrote to memory of 2280	6664	chrome.exe	101
PID 6664 wrote to memory of 5780	6664	chrome.exe	105
PID 6664 wrote to memory of 5780	6664	chrome.exe	105
PID 6664 wrote to memory of 5044	6664	chrome.exe	104
PID 6664 wrote to memory of 5044	6664	chrome.exe	104
PID 6664 wrote to memory of 3756	6664	chrome.exe	106
PID 6664 wrote to memory of 3756	6664	chrome.exe	106
PID 6664 wrote to memory of 5644	6664	chrome.exe	107
PID 6664 wrote to memory of 5644	6664	chrome.exe	107
PID 6664 wrote to memory of 4508	6664	chrome.exe	108
PID 6664 wrote to memory of 4508	6664	chrome.exe	108
PID 6664 wrote to memory of 6440	6664	chrome.exe	109
PID 6664 wrote to memory of 6440	6664	chrome.exe	109
PID 6664 wrote to memory of 4860	6664	chrome.exe	111
PID 6664 wrote to memory of 5932	6664	chrome.exe	112
PID 6664 wrote to memory of 6012	6664	chrome.exe	113
PID 6664 wrote to memory of 6960	6664	chrome.exe	114
PID 6664 wrote to memory of 6960	6664	chrome.exe	114
PID 6664 wrote to memory of 2472	6664	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb2f33c728,0x7ffb2f33c734,0x7ffb2f33c740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,15407844685674056277,7312330120445350591,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4952169940050798351,73990773938639347,262144 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,15879520920411782668,8857473582052258627,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,17880158899285784113,2978721317400829985,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,14694139084095294155,14169194574273008866,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,3486314245651270143,11866959202547781777,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,1383081052375015133,11428188839202731039,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5560,i,7249795809350881912,4030971985401703488,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5588,i,13454517299494768189,13895631728640780857,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5636,i,13700410034150577461,2221346943129812354,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,2253290895018159294,16778341608296374743,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5916,i,4491449470794811244,13500919196623539030,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5592,i,8192796708906758871,4713731857216908168,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5760,i,3512803405565657523,12337446703193636291,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5932,i,2486172847890616953,172596693242143015,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,14591789091170434275,13317185763359553032,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,1048245324217422121,383040061131018874,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,17440358350367784045,289942700984796753,524288 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4780,i,12839278439011782099,10267370724598503847,2097152 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:6960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,15177369924997240633,421874827555157109,262144 --field-trial-handle=1888,i,16297441478600825205,9108170566078566123,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4711e84f9f2909057e1b4bf423c4afa777bd69a22e5d45f3778d9c00fcdfdd94
MD5 359bd017569a22392379b51115da1cd5
SHA1 583e4cd53ee260145f55b39e51cb30033b2d036b
SHA512 7748b0e73a2b23c9da786f8690223996bb5e4b14dad31e5a050eb1158979fa37d0530168fdf3aa5c20f0960db9da124accd7acd19df7e7ded802188ceca6e62f
TLSH
T13711B11D51A6882DFF750F77D99AAD36B0639CBA3E1B1AF70155D17D36C34201050048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 2b837388bee3946efe006809d25c59a8cb5441f4ce2e6253cf9f17ddcd4c5a2b
MD5 bed0654a2aed86eb74442e4eb593fb6d
SHA1 317482af4314764154462096686945c05c8714ee
SHA512 5089e242a1c07762da301b9e58085f0dff5e04c4d9b7059b240a003327ce26560123547ac8f725a58cfb1447c0a0879a3ac652c2cf485cf83ddd5b47a5abcf9d
TLSH
T171E02E806872821DFF190AB016EBA133F2B0A8FA138229F10260CC8C08C2228A0020D8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 1c04b2fc5ff2055cae94d60eba53bb1e762da304c56921464848aeddb0e75a2c
MD5 f443783862a13dea874d8ad4c662a160
SHA1 4bca2e06f0c5e980e6446f1cb67d501b96cc1ad0
SHA512 fe90caf2f958007431e510856fea7d4853495e326518f16c4e7e153357e1dc03c88fdebe8219685f789c60cf4aa117c735ed9cdf901fc3e195a120f428eb14f0
SSDEEP 192:D9ZOxIEkJXJRL3+6FNvBKJ9gaPkI0vcfPENPaWIzpk3IRIbIe:D9ZOxIEkJXJRL3+6FNvBKJ9gasI0EfsB
TLSH
T19EF19BF7C3D8C52C884156F89B256F1FCE1E0A28432D3C26C8D9AE5B93E2871D25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c29f7e54eb8de8d3cbfcc5065ee3989ba1c7df793efa24327359759366bf790b
MD5 671219614d4522f57002c7b3aa7773dd
SHA1 e025b2dbce5e01f6887644a55e99de0288d9951b
SHA512 1aa049ca12402206a150f842c5526788a74b84d448e022281b283abec6165b1511992934264f3977d52cbe294459d5e810a2fa9f880333b72525bf84567ecb66
SSDEEP 192:D9ZOxIEkJXJR+wM3+6FNvBKJ9gaPkI0vcfPENPaWIzyIRIbIXhTnW:D9ZOxIEkJXJR+wM3+6FNvBKJ9gasI0EE
TLSH
T1BB029BF7C3D8C52D884116F89B257F1FCE1E0A28432D3C26C8D9BE5A93E2871E25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 abe1c8fabbfe98f0345e669330b39333a86c3f88fda66ffc40ef28023ac47e72
MD5 dd3db0c30f2fc87515e67c793d53a608
SHA1 1101c96bb8691dd8dab1f6e739a29093b065c0e0
SHA512 35ef8c525ed1ba8e76dabaedb8b2cabfb32175544e4ab30c758a2650fbba85811876418a1ed4bb9c10c7d90041c0ef57da8c4b7781ae673cb845a39c676f94dd
SSDEEP 192:+R7YxRAIFv7FTvAPRp2B0o9CHWSb+WNn70Z2r2UOUkw/oxVyIsnAUgR:+RUxuI15T6Xak/YC22fCR
TLSH
T10832A22FA924297B9DCAC229F9617757E7F61025A2D42F84E7FC8E2C00D76CC6227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4ecf2f9339e5de938837f4b045e17292d0493c48f72279ac314d3adb87b0bf0d
MD5 31f9c81bae53bb36da08040a8a4179c5
SHA1 aea64d087b5fae90d535c59542436c6207466990
SHA512 b112cbeb4ed6f2109bb5c3b8e94f77a874e9673b4f595e715f4b1b18501a07ad3d725f13a93fbb13af4bdd67560c52e907fe4fb37e98cdb1dfa374701697b433
SSDEEP 192:+R7wcBhxRAIxv7FTvfKPRpBBJU9CHWSb+WNn70Zfotsd1OUkw/onVyIsnAUgE:+RkmhxuIh5T8XSk/Y6sjf2E
TLSH
T1EE42B42FB924297BADCAC21DF9517B57E7F51026A2A42F84E7FC8A1C00E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1913a2a5de34959c47834786713473fd288131d58039210a64ad5cd382146e1f
MD5 0104d47597992c2138240e4cbd28508d
SHA1 180a29c35c96da61b8c2f8d92d925a1d60ba7f90
SHA512 d0e0a8f364acce7d5ec037b4446d4e11b129146622675c717ca1501ba5ef16cd88423f39043f17f69b358771c12ca639c1e45dc8349e472c07489062a6e043a5
SSDEEP 192:+R7YxRAIxv7FTvAPRp2Bnf9CHWSb+WNn70ZiXWMOUkw/oxVyIsnAUge:+RUxuIh5T6X8k/YqWOfCe
TLSH
T12442B42FA924297B9DCAC229F9617757E7F6102561D42F84E7FC8A2C10D7ACC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 483182afd533cdd659e50dc1eb030af251161c9a8605d226fd3420c4294f4088
MD5 aec680d3b877b028bf29e57c6f5b6d3a
SHA1 8a990d28f98f0085ab69afde8f9f679e22ed20c8
SHA512 36b9f80e32473170f0bc5e07e63f608bcda106d9f50073372241afe44d354e91f53b2f05a43c0cf6ae66e4781d7e0041edb8260884ffe22738d93d62e5832c7c
TLSH
T154B0029C60556622C62CE374B5DB8171F3644CA76F53034763BA1494E823AE946A2D83
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 308a57b7887e73854f5ec2317ff1a9e6ba8ec25d3ec9605d518f541c0451209c
MD5 3a4edfd7a91ba9d343b800bf375a1ac8
SHA1 62d298602c1b66611ec8de166019191de1d153e4
SHA512 6ca4d20cfe3adb14c9b97cf4fa18007bbf6e883ae184a881f514dd488ff3ea5b24c06486c9818bf18e12e305ee825482c0708a5f1c5433bddf1e39f597526c8d
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5aVDMB6xGyv1T5QqbKv4a:MkC01N2c6AGDDUDmA1U5QqbU
TLSH
T1CCA10936582D9C7788B2C949B5532E43DEB8612BF921AF94E6ED4B0C15F70FC2381927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6049fd79d81f4f367c5384841d06733d30974e4925238636b1e57ecaca2a847e
MD5 eefd60970b9d8b6bb193bd2b4fd86e58
SHA1 26e805ae783f3d4b8791d083ec153ea3377db00b
SHA512 1d414f044285b1e33a9a3d573186a795f78f2761651f0f75a78229a4a81647fee98dc588809db4d490dc4265e079e88cec5f5f78c67adcba4852c60eba8b133d
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA/ryJsSl8h4otop5aBDMB65Gyv1fQBFv1Qzbob:MkC01N2c6AuJwiU2CA1wQBF+9LIQpU5f
TLSH
T13CC1F93A686DAC3348F3D559B5532A53CEB4603FA611AF94FBE55B0C05DB1E81382522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a83c440ac4ba58451cdfe9d68c63264e3cd693573a932ecb870f1c79e2504f12
MD5 47c4a84e5888ac1a072428aa5cc5508d
SHA1 7626b0e70cff6be6a498ec68037348127c3d14ab
SHA512 c98796ffd6cb0eac11c78dc5d389ed38ab5cd6e0414646fe9e82481b662205b8458f4b2bad65ee442dcab1f4f5b03311bf4b72c459257bb63224bc8bb3a3a69b
SSDEEP 96:MWbJ0d+CNkx/Fc5vBh2F8vIfjnNA/ryJsSl8h4otop5aBDMB65Gyv1fQBFv1QzbS:MWt01N2c6AuJwiU2CA1wQBF+8wIQpU5f
TLSH
T154C11A7A686DEC7358F3D559B5132A43CEB4603FA611AFA4FBE94B0C01DB1E81382522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 51f58ad9baf861a0b040db358b76c5683d6503cf9b0045eadbdefeaa63b555e5
MD5 2e6347d1a1b43537734b69e5bcee926b
SHA1 e0a0749253cebd5fdbf769236a3d68efe40734d8
SHA512 83c6d18f3c28fd9d1dc93be2a70cedadd0fcdbe51a1627a1f6625ae915361203ec40e97e78e7873d7d0b7ff174db38227c9f0c6ff1bd8664be1fd088ad2cafaf
SSDEEP 96:MWC0d+CNkx/Fc5vBh2F8vIfjnNA/ryJsSl8h4otop5aBDMB65Gyv1fQBFv1QzboT:MWC01N2c6AuJwiU2CA1wQBF+8wIQpU5f
TLSH
T1C7C1197A686DEC7358F3D559B5132A43CEB4603FA611AF94FBEA4B0C01DB1E81382522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0fa58554b9daf0455a1fc28cca59335a48eb99c41ba5b69a25a31b0f0fef5c74
MD5 478b6b3d2afe2e6ee8fe2a1999b2bd57
SHA1 b488fbde94d20e1eba63dd1297268a53de6eb961
SHA512 3e27ddd9c6c53608cbb18a286c0f97c4356940e02e226893a75a0db0c056b76ac232a0f5ece865525107683e6af5717ed70a426f72d83ac00b7018d022bae78b
SSDEEP 96:MWbJ0d+CNkx/Fc5vBh2F8vIfjnNA/ryJsSl8h4otop5aBDMB65Gyv1fybcIQvRNF:MWt01N2c6AuJwiU2CA1wkcIQvuCoVm
TLSH
T131C1F836982D9C774DF3E448B1032E43CDA8612BAA10BF68FAE95F0C01E75EC1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download