ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

Analysis

max time kernel
300s
max time network
315s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260803-dstnesxfnf
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302008477725075"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
4448	chrome.exe
4448	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe
Token: SeShutdownPrivilege	5876	chrome.exe
Token: SeCreatePagefilePrivilege	5876	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe
5876	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 2332	5876	chrome.exe	89
PID 5876 wrote to memory of 4768	5876	chrome.exe	90
PID 5876 wrote to memory of 1864	5876	chrome.exe	92
PID 5876 wrote to memory of 4768	5876	chrome.exe	90
PID 5876 wrote to memory of 5960	5876	chrome.exe	93
PID 5876 wrote to memory of 5960	5876	chrome.exe	93
PID 5876 wrote to memory of 2668	5876	chrome.exe	95
PID 5876 wrote to memory of 2668	5876	chrome.exe	95
PID 5876 wrote to memory of 5388	5876	chrome.exe	94
PID 5876 wrote to memory of 5388	5876	chrome.exe	94
PID 5876 wrote to memory of 768	5876	chrome.exe	96
PID 5876 wrote to memory of 3064	5876	chrome.exe	97
PID 5876 wrote to memory of 4476	5876	chrome.exe	98
PID 5876 wrote to memory of 3064	5876	chrome.exe	97
PID 5876 wrote to memory of 4476	5876	chrome.exe	98
PID 5876 wrote to memory of 4944	5876	chrome.exe	102
PID 5876 wrote to memory of 4944	5876	chrome.exe	102
PID 5876 wrote to memory of 4580	5876	chrome.exe	103
PID 5876 wrote to memory of 4580	5876	chrome.exe	103
PID 5876 wrote to memory of 2468	5876	chrome.exe	104
PID 5876 wrote to memory of 2468	5876	chrome.exe	104
PID 5876 wrote to memory of 3524	5876	chrome.exe	105
PID 5876 wrote to memory of 3524	5876	chrome.exe	105
PID 5876 wrote to memory of 5412	5876	chrome.exe	106
PID 5876 wrote to memory of 5152	5876	chrome.exe	107
PID 5876 wrote to memory of 5412	5876	chrome.exe	106
PID 5876 wrote to memory of 5152	5876	chrome.exe	107
PID 5876 wrote to memory of 4524	5876	chrome.exe	109
PID 5876 wrote to memory of 1236	5876	chrome.exe	110
PID 5876 wrote to memory of 4432	5876	chrome.exe	111
PID 5876 wrote to memory of 4448	5876	chrome.exe	112
PID 5876 wrote to memory of 3876	5876	chrome.exe	113
PID 5876 wrote to memory of 3876	5876	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb604ac728,0x7ffb604ac734,0x7ffb604ac740
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,11650256928934793401,7329428391860744644,262144 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,7554354932014288073,2502691572538825690,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,11127992080902553187,1991188762421287548,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,8596880308235599126,1251617555804490432,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,18217895602637747771,1703023513387195259,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,5804338469555413627,10428822656693990221,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5416,i,10396633866522733326,15559524283415855802,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,17486760875954814023,7887919581508962316,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5740,i,18016873071294269033,1508782663581969739,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5436,i,9741878331926586456,10282931786105846867,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,4797672282120607454,18162675914227925832,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5456,i,4621006211377535667,7914534627520858539,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6132,i,11212954540890763434,7421438333923917582,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5524,i,6218485110433406175,11123094479085355040,2097152 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,10590832914591456355,1636755867305772381,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,12545792931017941876,16327826073411567997,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,12844957379094263196,302779789016629216,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3388,i,15049030118458217380,5528605391306813788,262144 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,2399525720381191970,242405948407831263,524288 --field-trial-handle=1964,i,18419986130508260989,12134953451096903420,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:14
  2⤵
  PID:3876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2b2aa9ce22f52ba5a29488f5cdb9fa2073e89bf7875f630516bc8466bb59a95e
MD5 8a6e9f948261a0dcdea1328cddd2add8
SHA1 dae02bf41f95a773a4d3e8ec9641d639b89423a3
SHA512 6735fa47eea94d82e9b84100c009d6f7dba4aefe48ff849e838f5c2982066c82d1f9a835813a7bb74fb78987f3221937edb5188dbcf31117ebd4d1c42c774eba
TLSH
T16B317AF7C3D8957D895152F4A7256E1BCE2A0A18432D3C26C8D4AE1BA7E2871D20468E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 873f6e4a0eb0c3dfa51290850c85a405cc6476b409bba0dcbeed274dd8cc08fc
MD5 de0d4098c36e6a6494fe9641dec4c837
SHA1 e116e4fd30240a885ab1829a345efe6d3dc8139a
SHA512 4a2c0e3a6f8c0d4fba26caa4bf78d3313d5d49eac8955961db65135e1f1943358032274f9d3459d8c2c11e8bbcf1973eee503c6a758eed545bac0ae54c0b6811
SSDEEP 192:rRNKtCGov7IvAPRp2hC98Hsb+WNnI0Pnse8X26ZRsVyIsnAUge:rRYt3086X7uwvP026vIe
TLSH
T1C832962ABA54797B6DCAC219FA757753D7F5102271D02E80EBFC9A6C10E79CC622700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1d87436a632983df1c3a140153234c22e28f6ec3dafb63065f7df8b963f186f
MD5 5dbb375d1e732610e5499192f4cd5335
SHA1 57807149b76fc5e7ed3cd248512923397de67ae2
SHA512 f0e102ad555f6248837c7cf98072e53d685f2cf43e08654ca31a52f4676769d77a96827e70d0a0cdc8281451a147a560be457fc5128215cb533af5f7cb07aede
SSDEEP 192:rRNKtCGov7IvAPRp4hC98Hsb+WNnI0Prse8X26ZdsVyIsnAUgE:rRYt308KX9uwvPg26PIE
TLSH
T14142C82EB951797B6CCBC219FA657B53E3F5102261E02E80EBFC9A2C11E79CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9cab0fc05659dccd35405e7e6dc5041c81123d6b88ad21b460b68e5d04aa94a1
MD5 be156400e59753879e25777f96d8412a
SHA1 7fce9d5ae492d397b51cf52ec9b6217c8331897c
SHA512 da5ad284e6c8bf2e396d3f01c8ec9bcd366544e1a8aafa6b52aa8c268d63a59ee96feb09295f0c39c23a3930342cd3ce80dbd819e714c56d2b2f765df592544e
SSDEEP 96:5IbJ0d+oJm4V0FH+pqf+HBKyoUVthSl8h4otop5joD1B6OSGyvkfXdGh5RNC39IR:et0HJm5FHuPgqiU2iLdzXdGh5uC0g
TLSH
T186C109B194AD9CBB5DF7E681B0432D83CCA5616B69A4BF24EDE94E0C01E35DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 72e7b4ead3cf3d1ac84353de032c96275bdde16041f49961eec42299c92273bf
MD5 abf07811441afde854dac3fc66b56ed6
SHA1 f424acc9270f58d7ddfb093212a76e0a9159233a
SHA512 25c1d204e126e892211bf81ff7e7eb407704dd6f2e3962aec118f639e807a1b8bc2340df2e4acded2a8676a13185534583edf91ce2e0e39de5ab638543e69c0d
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5jHD1B6eGyvkonhob1v4a:MC0HJm5FHuPgXDUDfLW8nhobZ
TLSH
T198A12AB1A4A94CB759B7D345F8822A83DEA4A227A9A0AF80D9DD1F0C11F71D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 560d4c1b8d33574602cfbd48d78cd847a17c2c501155de5b5afc84fd5a4348f0
MD5 bdcf22ae6d19b51aa0e8664c22c99c2d
SHA1 041929e7e8d37c1c27e25eaf5fdd069b9c8375cd
SHA512 97774ded87a18e38ef75fbd250876245bfc9546f313fff73d57bf2da4bdcedfd57381c6127328e1d6757dbb5e270fc9af75d2984c6d40b01b42e57fd74f2325a
SSDEEP 96:5IbJ0d+oJm4V0FH+pqf+HBKyoUVthSl8h4otop5joD1B6OSGyvkfFl65zrtunGhL:et0HJm5FHuPgqiU2iLdzFl6hQnGhgUD
TLSH
T199C11BB1A8AD6CB359F7D791F4432583CDB4626B59906F60CAE90F0C01E75DC2743627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 88a54c77b527be515ec456c6592fdcc17874828f9362f568d088255910bbc9dc
MD5 57a0f3b7449f8382f2afa4e78a3fab63
SHA1 889963dbe30739742a83e10941f2a5500c95b2b0
SHA512 7d57880d87de6f590892ad448e4893a1ce5482908d3ca543d241c59c75ebaa5ba1b27feef2d0217bd6ebdfe268b300a3aeb7ed4d5194cd0fbaa3d935d9e83131
SSDEEP 96:5IbJod+oJm4V0FH+pqf+HBKyoUVthSl8h4otop5joD1B6OSGyvkfXdGh5RNC39IR:etoHJm5FHuPgqiU2iLdzXdGh5uC0g
TLSH
T12DC118B1D4AE8CBB5DF3E685B0432983CCA4216B6954BE24EDE91E0C01E35DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8fe615fe36d9887da08d6fd81241a4b984549aeaec15b656bbc9cdc3c0c3c133
MD5 ef6bf7ffe98d8eb7207d54352c835666
SHA1 33c2f2b2038f7bb0e2ff828dc4eb1cabacdb4f66
SHA512 a2a84139f68806a16b0fe0d08e0035143eb1d8a9902679732df655d8c592d6692d571e73c8e6bdec14e047bab8bd5ceb20d5b6043e452841e72afbeb0fbc9228
SSDEEP 96:5IC0d+oJm4V0FH+pqf+HBKyoUVthSl8h4otop5joD1B6OSGyvkfFl65zrtunGhg8:eC0HJm5FHuPgqiU2iLdzFl6hQnGhgUD
TLSH
T1B6C11AB1A8ADACB359F7D791F4432583CDB4626759906F60CAE90F0C01E71D8274362B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download