hxxp://tips[.]uscis[.]gov

Analysis

user interaction
yes
max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tips.uscis.gov
Sample260807-1stpradj5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306133243249643"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
2728	chrome.exe
2728	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4512	1372	chrome.exe	89
PID 1372 wrote to memory of 5952	1372	chrome.exe	90
PID 1372 wrote to memory of 2176	1372	chrome.exe	91
PID 1372 wrote to memory of 5952	1372	chrome.exe	90
PID 1372 wrote to memory of 796	1372	chrome.exe	92
PID 1372 wrote to memory of 796	1372	chrome.exe	92
PID 1372 wrote to memory of 6136	1372	chrome.exe	94
PID 1372 wrote to memory of 6136	1372	chrome.exe	94
PID 1372 wrote to memory of 2804	1372	chrome.exe	95
PID 1372 wrote to memory of 2804	1372	chrome.exe	95
PID 1372 wrote to memory of 4620	1372	chrome.exe	96
PID 1372 wrote to memory of 4620	1372	chrome.exe	96
PID 1372 wrote to memory of 5244	1372	chrome.exe	97
PID 1372 wrote to memory of 5672	1372	chrome.exe	99
PID 1372 wrote to memory of 5672	1372	chrome.exe	99
PID 1372 wrote to memory of 2984	1372	chrome.exe	100
PID 1372 wrote to memory of 2984	1372	chrome.exe	100
PID 1372 wrote to memory of 2252	1372	chrome.exe	103
PID 1372 wrote to memory of 2252	1372	chrome.exe	103
PID 1372 wrote to memory of 5876	1372	chrome.exe	104
PID 1372 wrote to memory of 5876	1372	chrome.exe	104
PID 1372 wrote to memory of 4732	1372	chrome.exe	105
PID 1372 wrote to memory of 4732	1372	chrome.exe	105
PID 1372 wrote to memory of 3508	1372	chrome.exe	106
PID 1372 wrote to memory of 3508	1372	chrome.exe	106
PID 1372 wrote to memory of 4896	1372	chrome.exe	107
PID 1372 wrote to memory of 1164	1372	chrome.exe	108
PID 1372 wrote to memory of 4896	1372	chrome.exe	107
PID 1372 wrote to memory of 1164	1372	chrome.exe	108
PID 1372 wrote to memory of 672	1372	chrome.exe	110
PID 1372 wrote to memory of 3916	1372	chrome.exe	111
PID 1372 wrote to memory of 1744	1372	chrome.exe	112
PID 1372 wrote to memory of 2728	1372	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tips.uscis.gov
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8eb5fc728,0x7ff8eb5fc734,0x7ff8eb5fc740
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,9867233439782270108,11214621877660113752,262144 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,15193893926565640629,9002123364041127470,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,13402390485939479175,614586232880402189,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,13959472187895842729,6878629234115414085,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,1458134295940976261,6541862919342133624,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,2033397963432911365,1468258103925198986,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,14763331524531615191,10360675621403533144,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5404,i,4805168928666800461,14034253555180823289,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,7595364441556580104,12544497025860145789,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5736,i,16479104246438493089,9777935553712017346,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5696,i,16246549537942334106,5585992748855825171,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5432,i,6173321815865448258,1988753537842410882,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5968,i,9793048444098563298,7511980901124014851,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5660,i,16237886006478173439,7079233663000035852,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5296,i,5674737854873081878,2449065825514473554,2097152 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,13705647083432513889,5096793432417044965,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,17046799753978305757,15167699720067208665,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,8476718679788941557,2925171497779150521,524288 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5780,i,18213231381761880927,6722749749444273001,262144 --field-trial-handle=1896,i,11182691235704247697,12591230784195882969,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f1cd2e1b21596fd0e6b94e4ca97c7109ccf3eac5ee766c491b7fc743561d3ace
MD5 7079c7a8a8be72094c66412a9a1f9257
SHA1 c12b83bd65bbf17201415b97c74066f93c70948b
SHA512 161c2e38ef7a907819f16416c014cd7ed6b5fe1dfa2016887983eb699818dd9b5de4efdd76550d19982a47c2d101378a4f267a43b01095ee5b4b9953a2c49444
TLSH
T122B0110A0082020AFB82A238C88A088038202E2E0202222383EC28A88A0A3F0A000000
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f0a1193124368bbf5a6f4aeb53b20db8672abd1f7257f7996e284b342ad77560
MD5 521b09928394c760d547fb8a72bcc614
SHA1 8e99bbed19a480e1013251b742496e6a9f0a53ef
SHA512 7c4efc1e494700e4d911ace3eb72469a3fb377d14c9efb5b32432feb9b348d610361f2ea9d5a64843182b4729d07d3132e78e067df3f29fb0da29ade3fee1d34
TLSH
T1F641DDF7C3E8963D891156F4AB167F1BCE6A0918432C3C67C8D4AE1B97E2871E20065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 33dc83452494d0c10dc0b65c470dd5bffa5d96cea8cf9185f509771b3cdff262
MD5 2ac7b7de682d8ed67effa3069587e3fd
SHA1 f19e7428bdbb80d50dcad643e9fcb9ff4881f738
SHA512 a6598f896ea0a52ad6b608c0b081fe10377cb245f620486aeb5ab841493c987de9abc2464266215aa4cc33325991dc4cc19eedfff4f86b750323bee4a642b3b1
SSDEEP 192:+R2IYCBv7ivAPRp2uiO9rHsb+WNnxgtiEWm2szCHaKoMXZVyIsnAUge:+R2I5Rm6X6O5wuovm2saa1U/e
TLSH
T11C42C62EA915797BADDBC229FA217753D7F6102121E42E84E7FD892C24E75CC221B01F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 61fb146a7a560ecec4a7991ca9c88a3461f9c0fc3fb33a815fdbac1c994f9040
MD5 aa338f406b928e5c1eacfc8bf8eb6c43
SHA1 83a7784b7cae211a38346d974d623571e66758d1
SHA512 18ed2b6ec0f6295fb7ef4eaca241522caa7289339f5ae725a657108680c83b2cbeddd1a8daa9071f7424983a8173c00d1d2c5450be9c9ce11d7b0a2d12a64bdf
SSDEEP 192:+R2IYCBv7ivKPRpyhuiO9rHsb+WNnxgtiEWm2sHCHaKoMJZVyIsnAUgE:+R2I5RmUXyDO5wuovm2sea1U/E
TLSH
T10842B62EA9157D7BADDBC229F9217753E3F5102121E02E94E7FD9A2C24E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 56979f5ba372c0220e0fccfa32e3f204f085aa1b54baf0e7031c3ba74fe766d3
MD5 d84b6a6108f7628495523f0a0707a588
SHA1 a6563c04ae08c0ad63f9ab8073a362e43679f1b6
SHA512 5717954f1fc18fcee6cf0cf315649a45e0c404e50b7c3e68ee8dda7b4d0fa8754614583367a34e4bb606a5822c90fc1063d6ec638cecb9c83bc942645be4f228
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8IqGG1Sl8h4otop5+FWDIB62Gyv4Y+L9tcxG0:Tt0cTkJaRZi/CF2lGiU2SQ8SI+L9tcxx
TLSH
T12AC10871946DACA759B6A985B0032D87CEBC316B39547E58EEEE2E0C00E74DC138343B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 83c541c22dc8a418b9613106c0aec202dd13b70578cb2a29a5f0aec50ff7ee74
MD5 d8ed1bf5edac6aecb0a18f95efdcae5d
SHA1 88d9887890382b6c69f8a31b989c6450ec783c8c
SHA512 09e2c70c6a9dfa8949513f9b53c414bcd4590d1f12c2079f1741d77bce4d13fcd6bc0684b95abe1fcbdd9919b06d0fcd4f6f97b0af8a6cd8e3408f7db055b3ae
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IqGG1Sl8h4otop5+FWDIB62Gyv4Y+mE1I07Ga:TC0cTkJaRZi/CF2lGiU2SQ8SI+mEmWGa
TLSH
T122C12B31A9ADE87359A2D595B0433A43CFBC326F6951AE54EFDE1F0805EB09C2383027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a27fb77a38c9e21581e995e14e3302ce381632c27c33ec0f3830b8c1b4b505f1
MD5 f9b0ae44bb8f4a618a054c8ecf2882dc
SHA1 5547c21535a88f9c0fcdd60fdd3d77be206566b8
SHA512 935bc1c0e324a894538d7f831ce4a634c94e4de50c36d2f00f27fa2850acf513a5222c759432253195da4b59ef495eba079466472b9de3684038e93c3ae6b154
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5+FADIB6xGyv4YR5gGObETev4a:TC0cTkJaRZi/CF2lIDUDS28ZIR5gGObV
TLSH
T1A9A13B326465DDB76976D989B4423A43CFBD722B7950AE84E9DE1E0C19FB0EC1342027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fbbea97f5f561f572221f4c64eebccb8a66127b9a96b757f40985a5b4e6ec18f
MD5 a1bd74233def8247cc798e75fe45366b
SHA1 0aa0d699623af221fd58b33b8b4b57685b6f52b7
SHA512 ff7554203ccd62fc538d581b540243a35eec55a42c32fe97d6d154a6b4748cdb67874112b6b3a4805598e3574a5c2e558de860fbe0d35a3bc5238bd8683cfee6
SSDEEP 96:TbJ0d+PTkblaRZiIEby3rUfsfuZ8IqGG1Sl8h4otop5+FWDIB62Gyv4Y+mE1I079:Tt0cTkJaRZi/CF2lGiU2SQ8SI+mEmWGa
TLSH
T10BC13B31A86DE87359A2D595B0433A43CFBC322F6951AE54EFEE1F0805EB19C2383027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download