e346f236b1ec080edb825f7af356e515510f509f809fdb8bf48a3418cc5520ff

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boris-fx-sapphire-plugin-2022-free-download.html
Size 149KB
Sample260727-rvavzsvcmd
SHA256 e346f236b1ec080edb825f7af356e515510f509f809fdb8bf48a3418cc5520ff
MD5 20685400a4b497ca58aa7f1fd778443c
SHA1 7d93e2f99738110293312c37bd24beb5d9dd1b63
SHA512 ad87a56dc636a0c94125249713919f5d42ec6bb7422513e7e79d49916e3886a889d6049da9448722538d3ad3d6768ad0d662ea8b2eb9e907b0c9f21beb7b462c
SSDEEP 1536:4GFjIaRjXL3gcSqHo82fbS+ath2G7QtXfYobaE53/lI8tw05ZIATIOQDzY1qEBxv:4j+gMm7M/I4Kn
TLSH
T1F5E320F289E6193763233AD97E6DF70E71E3430DC603088897F642966BC6F5A960174E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296362594922832"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5164	4632	chrome.exe	88
PID 4632 wrote to memory of 4948	4632	chrome.exe	90
PID 4632 wrote to memory of 3360	4632	chrome.exe	91
PID 4632 wrote to memory of 4948	4632	chrome.exe	90
PID 4632 wrote to memory of 984	4632	chrome.exe	93
PID 4632 wrote to memory of 984	4632	chrome.exe	93
PID 4632 wrote to memory of 1796	4632	chrome.exe	95
PID 4632 wrote to memory of 1716	4632	chrome.exe	94
PID 4632 wrote to memory of 1796	4632	chrome.exe	95
PID 4632 wrote to memory of 1716	4632	chrome.exe	94
PID 4632 wrote to memory of 2936	4632	chrome.exe	96
PID 4632 wrote to memory of 1728	4632	chrome.exe	98
PID 4632 wrote to memory of 3508	4632	chrome.exe	99
PID 4632 wrote to memory of 1728	4632	chrome.exe	98
PID 4632 wrote to memory of 3508	4632	chrome.exe	99
PID 4632 wrote to memory of 764	4632	chrome.exe	102
PID 4632 wrote to memory of 764	4632	chrome.exe	102
PID 4632 wrote to memory of 1228	4632	chrome.exe	103
PID 4632 wrote to memory of 1228	4632	chrome.exe	103
PID 4632 wrote to memory of 5436	4632	chrome.exe	104
PID 4632 wrote to memory of 5436	4632	chrome.exe	104
PID 4632 wrote to memory of 5928	4632	chrome.exe	105
PID 4632 wrote to memory of 5928	4632	chrome.exe	105
PID 4632 wrote to memory of 2984	4632	chrome.exe	106
PID 4632 wrote to memory of 2984	4632	chrome.exe	106
PID 4632 wrote to memory of 2144	4632	chrome.exe	107
PID 4632 wrote to memory of 2144	4632	chrome.exe	107
PID 4632 wrote to memory of 1384	4632	chrome.exe	109
PID 4632 wrote to memory of 4160	4632	chrome.exe	110
PID 4632 wrote to memory of 3804	4632	chrome.exe	111
PID 4632 wrote to memory of 5772	4632	chrome.exe	112
PID 4632 wrote to memory of 3524	4632	chrome.exe	113
PID 4632 wrote to memory of 3524	4632	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\boris-fx-sapphire-plugin-2022-free-download.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x10c,0x134,0x7ff8bfd8c728,0x7ff8bfd8c734,0x7ff8bfd8c740
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,3021815224604627682,13241295970079049836,262144 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,9579933777939231486,1665881998089487717,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,4992906785712800404,4684493076708993457,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,3759747430564974198,7646976650701401067,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,8343654333838426242,13441419235504287721,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,17282077513029841662,12988503498908473038,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5576,i,12257931114560762228,17707068690395081682,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5548,i,17701864382794092383,17743975468263768945,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5640,i,11054420560878796211,9749683790296203258,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,10521244099343040918,879053818504714974,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5744,i,7714658540955436385,16255224249851746148,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5544,i,4627629350996060220,13934035990356993737,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,7441831605644904580,14358369512565940443,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5824,i,8245712509308974381,2441631944309632791,2097152 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,962574944929076174,13257037317569688051,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,15551360098673005647,14339925283859440820,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,10005174440551151054,9486213411049877003,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4900,i,10711178336635509055,8716013496646134708,262144 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,10357206442191751781,2302147615310665929,524288 --field-trial-handle=1896,i,7977678306842408540,3332159447181417836,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
  2⤵
  PID:3524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e549924187d89575e8ad61a973b1118d2c04e4e2493d0705dafe4b05d6da66e0
MD5 8f06ad3f7d13befca73cc175bb93f903
SHA1 7d8594bc52497122e1dff7808aad3fa3f503f942
SHA512 10c34f9a29e80c61fe2968f17565e30fee8abb74f890f2f969722078c7c58a0be4f7d76ca27441ad18bc459edc867874de7d464636d5d9cb78ff96f15744feb7
TLSH
T1E251ACF7C3D88A7D884512F4AB257A1BCD2D0E19422C3D268CE5AF5F67E2871D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5a7b46ac6119c558f993766b304e05f0c372ef5ee9ee92291d89e4f2950ea772
MD5 4d3a9974506bf3ee207b0b3804d1c317
SHA1 032c2e5163cd3df44995b922dfc9193f4e327dc8
SHA512 9a64d875fa9dbaad8ea707cf53323a2eb1f15ea06ba6971bd1fb717e24174aebc48cd06b029923072c275d0d8079145650416915008d6169b6e3ae4b06c3a86b
SSDEEP 192:5BRLGaCEyv7QvAPRp2Wo9XxHsb+WNnISbP2l2yeK5VyIsnAUgR:5BRLG4e86XgfwRbPO2eR
TLSH
T16432872EBE10693B6DCBD229FA627797E7F6102121D52D44E7FC8A2C11DB5CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c45fe255b57500742b38021be6b2265e724d1594c39ecaeabcc597ab08edbcdc
MD5 8f7d4b088d536093b3862fee10a49d33
SHA1 25b4043baba66e38b3e66f36739c7aeb4b9f962c
SHA512 01224cec4f33245b41b47a4b22604775ddc2e7081c6436e3eebaec5f6c9a2a2761560bd158cf9e769dfce578a6898846118879de0261a1767a386ba6fc7d2914
SSDEEP 192:5BRLGaCEyv7QvSPRpqWo9XxHsb+WNnISbPyl2yeKkVyIsnAUgE:5BRLG4e8sXEfwRbPy2HE
TLSH
T13342972EBD10693B6DCAD229F9667B93E7F5102561E42E44E7FC8A2C11DB5CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e149ae7f0677dbcfce3b160d7e80759f03e28cf985d4fa1d4549916da0e8d2cb
MD5 04447ec091fc0cb5d095268971517b5a
SHA1 77fae246292c4878c69cb879266e26b359b10322
SHA512 9d7162888c896522ffab2044635eaec308f3b3e1321694e6dd03a1ae8ef4f69840b641f758aababaa1dad024817234ea1440ddd77015aa83ceed342a260de6e0
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934+YMNSl8h4otop5GicDfNB6rXGyvn0Svhlm+9sxRNCZ:Rt0ITo+TQ0IwiU2QfTy2PSvhlm+9sxuX
TLSH
T1D7C1E775E46D4CAB09A6E886B1132947CDA8206BE965BE64FAD90E0D01E74EC1393533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 371c39d160b8678a36d5879c0d54ca60661b53059d01c794a53113f4856ba0b4
MD5 c5ce2bd46bcf85d7bc836e58c8cfe95c
SHA1 b221e25537ebc7026792fbd400f1fdc1b9c6fe26
SHA512 9d6eab91a7576edccbd141e314dd6d7471e0f9e9b67515cfb11b4a100e88e666a0b7f3e8e4d61c1e671d9bb8ec4a5d89695bef169c7f2fa821a7bf94005a9d2b
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934+YMNSl8h4otop5GicDfNB6rXGyvn0SvQxwzQ9hjm+O:Rt0ITo+TQ0IwiU2QfTy2PSIxZhjm+9sD
TLSH
T192C12A76A46D4C7756A7E442B1132A47CDB4306BDA51AF70EAD60F0D11EB0EC2392523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cc25c197f7d8d07695eaba86f9f894e2720c2afb2c6de22440b68fd228d0dfe5
MD5 228f0509792a3868ce6b000e01332f65
SHA1 949f26cf2066d02e8286880fa1d5abd50f5ff51c
SHA512 682170446a4744e4ba7e6d2d5ccb30e0bce09a4086bd3020280bd037064ad774511d7414c7709bc38c8e3305c1040da600aaf7596902751eef0355aa795e5693
SSDEEP 96:xC0d+r2io+TJ/E0f6m934+YMNSl8h4otop5GicDfNB6rXGyvn0SvQxwzQmhj+9sD:xC0ITo+TQ0IwiU2QfTy2PSIx6hj+9sum
TLSH
T1AEC12A36A46D4C7756A7E442F1232A4BCDB8306BDA51BF70EAD60F0D01EB0EC2392526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ad2674fcab06eb374fdce74d5f8c519fa91982c1a2b2c861dc9e7b58dc57529b
MD5 93150b135d283118064593e64ba3de24
SHA1 ab22fdbbeecf8a6fe39db7bfa3166b807797521c
SHA512 8ff2f403ba5552abfb07adbca89033e12626e480285e14dfcfa657cb6cfcf5a39b887884e1e4f24cc60ceea29167516c6661f817ba28b7f6be9cce6515bd07de
SSDEEP 96:RbJod+r2io+TJ/E0f6m934+YMNSl8h4otop5GicDfNB6rXGyvn0Svhlm+9sxRNCZ:RtoITo+TQ0IwiU2QfTy2PSvhlm+9sxuX
TLSH
T12BC10775E02D4CBB49B2E886B1132987CDA8206BE955BE64EEE90E0C01E74EC1393537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 43f66b0d42910c7c4bc2e0c71d9dba3c0ac71e024515ff42d2abc6832eb2830c
MD5 194d9421f084af82f61887b910d883cf
SHA1 5e5d732afc4e4e84f877cd7f598cd9f072b0864d
SHA512 d129c756a7497c769a009506fb624dbc071e57352fe6f18e998fd35782ba23a6014ecd5bf678c7cf4fa3b87573ea7ac36ad7ce74c5757b45e32cd64b9e1fd849
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5GmDfNB6nGyvn0b4T8sybJv4a:xC0ITo+TQ0InDUDNfTPPb4T8sybl
TLSH
T13DA10936E0284D774076D446B1626A43CEB8706BE9B2AFA0EAD90F0D15F70EC1352A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download