9ab0002f82818438132e00ca678e8ce00ae7badd7589f176ef9cdc5548c631c7

Analysis

max time kernel
899s
max time network
878s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
project3128579.html
Size 5KB
Sample260815-13ba6avybv
SHA256 9ab0002f82818438132e00ca678e8ce00ae7badd7589f176ef9cdc5548c631c7
MD5 29db6e703187e37d1750c74706e471db
SHA1 a071c61e707f9120410ec0917664dd8d08e3465c
SHA512 6423540da80e838ce2a90e6aab59453365510785a75bdca101b7d2e9ca2826c0435963b40d12f3385c63e5b371a734328fd7fbac7c4fa97980843e97acd8c3b4
SSDEEP 96:PNyItoXZzIEb0EaW8706pvBJi+uxY2Mr+VWNHaBuYzueh8Nmw:PNNtkCBlvHi+J2MCVWcTyuw
TLSH
T1C7C15AF7AF35A137CB6567A504F2B32C7120B18EAB0184A4D2A0D37C86DEF9BC000195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3920	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313058154114909"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
6056	chrome.exe
6056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 5012	4088	chrome.exe	89
PID 4088 wrote to memory of 856	4088	chrome.exe	91
PID 4088 wrote to memory of 856	4088	chrome.exe	91
PID 4088 wrote to memory of 3920	4088	chrome.exe	93
PID 4088 wrote to memory of 1096	4088	chrome.exe	94
PID 4088 wrote to memory of 1096	4088	chrome.exe	94
PID 4088 wrote to memory of 6048	4088	chrome.exe	95
PID 4088 wrote to memory of 6832	4088	chrome.exe	96
PID 4088 wrote to memory of 6048	4088	chrome.exe	95
PID 4088 wrote to memory of 6832	4088	chrome.exe	96
PID 4088 wrote to memory of 1336	4088	chrome.exe	97
PID 4088 wrote to memory of 5516	4088	chrome.exe	99
PID 4088 wrote to memory of 5516	4088	chrome.exe	99
PID 4088 wrote to memory of 6800	4088	chrome.exe	100
PID 4088 wrote to memory of 6800	4088	chrome.exe	100
PID 4088 wrote to memory of 2880	4088	chrome.exe	103
PID 4088 wrote to memory of 2880	4088	chrome.exe	103
PID 4088 wrote to memory of 4944	4088	chrome.exe	104
PID 4088 wrote to memory of 4944	4088	chrome.exe	104
PID 4088 wrote to memory of 7056	4088	chrome.exe	106
PID 4088 wrote to memory of 6456	4088	chrome.exe	105
PID 4088 wrote to memory of 7056	4088	chrome.exe	106
PID 4088 wrote to memory of 6456	4088	chrome.exe	105
PID 4088 wrote to memory of 1112	4088	chrome.exe	108
PID 4088 wrote to memory of 6072	4088	chrome.exe	107
PID 4088 wrote to memory of 1112	4088	chrome.exe	108
PID 4088 wrote to memory of 6072	4088	chrome.exe	107
PID 4088 wrote to memory of 7068	4088	chrome.exe	110
PID 4088 wrote to memory of 7096	4088	chrome.exe	111
PID 4088 wrote to memory of 7104	4088	chrome.exe	112
PID 4088 wrote to memory of 6056	4088	chrome.exe	113
PID 4088 wrote to memory of 4884	4088	chrome.exe	114
PID 4088 wrote to memory of 4884	4088	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\project3128579.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe2d36c728,0x7ffe2d36c734,0x7ffe2d36c740
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,4481060221869288936,12304191244455239520,262144 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,6585052175059143967,4455454612555331846,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,7155792697939246854,2579296440946699779,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,7742932291550084867,7864123839039402184,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,15558358136706427727,3976767758202798241,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,3538471122986789572,15086523262249941716,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5532,i,7968677324742291406,5264204896214481165,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5544,i,8252061618503957288,6866145732664176788,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5876,i,14216703065701120327,15140505097584973878,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,581877198503678154,8370690707275667161,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6040,i,13449692765030888622,13196106960231344948,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5396,i,12635384539194135738,2519972151441824687,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5612,i,3589297071435833201,13672777263113106915,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6108,i,17886115853449164946,14793004808391010450,2097152 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,10980748663923208782,4737417231967149671,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,7447005218235525044,4150746236329380944,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,4370880296720617137,3518322234420493800,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:7104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6008,i,16101960641142823795,3171780393220053204,262144 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3176,i,12502576620036813523,11592041647355948955,524288 --field-trial-handle=1904,i,17191850064385151434,1657048770905001709,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
  2⤵
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3048

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dc0517b4bcfec6c007b25b10f9ce92a5dcecd858c0f3e639bbe6c3966488250a
MD5 84d0c601ea4fd6ebbc2f748ad2ac8216
SHA1 5d018909805b75fb4b5405d4ccb773d6f90bbed7
SHA512 0365732ec65f4a4733feb653d5298cb7828cbc91a090068bf62d18bbdeac2d1f962aceff68d6f851e2817388dba17b3995e399ed45ee1f07533fac3e8281fabd
TLSH
T1AF21ACF787B4957D8A0546E4EB15AF1FCE6E0524031C38A689D46F2B83E2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e5f0b1c2b18daf8d79d7de1ed5e7836cb7f779c9c9dd1c2a34141bed7053bf9e
MD5 913e43b4e6b9c2aab1d72d6e7eff1720
SHA1 4cb85d9f4164761667f264b80b7634cba90c217e
SHA512 6c69abe028158f6d9640298f98030532a9964c9fb18cdf08319412febf70fefdef0d8b867d85c17e9119a2bba26cd531ad89c009e01eabee3b0646b106b1cd9d
TLSH
T1FF218CF783A4857D8A0542E4EB15AF1FCE7E0524031C38A6C9E46E2B83E2972D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f510e48aacceaa5f1de9c30ffec1e4cc7e2cb85b7900176d8f7c0a62a9ba77f9
MD5 120c95b331dcde92e9959f74755ae488
SHA1 edef0a7d14c4d79269c50a03006fe32efe9499c8
SHA512 fc2c00d7468d7773f84f5a8ce3834871bfb724ecc3f99d9662f7f582c8e2ea0cb3b1a219520c5ca3deb6ab2bc55bbe7c24c5ced19a35000a5e1a99f01ebf48b4
TLSH
T1D3217CF783B4957D8A0546F4EB15AF1FCE6E0524032C38B689E46E2B93E2972D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 e2152b21606ecea2706ef4fc13854c8bf240628b2ff1d481346777c06c146d2f
MD5 f8e762fcd67930e2b9b30285a8f280f5
SHA1 52aacf9adcb99296e0992194322cd2a0dedc637c
SHA512 1c388547784f9a3541e6eb8cb118dad1d208c6d0898382d26e712088ec7d4d68128e331ad86e789abb60c319593d2e7fb2700ddcd65dfa2ea80e8af2f394f9fc
TLSH
T164E0C073863C70F7007C00EF1D07740459B1B83021410DD0CE2A42ADF0814F70B00883
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 48dd05b580171ab660a1e5b97def1f6f3b8a0c72488685059e881365f81d68d6
MD5 4d559d0b9eb5e7275ef925e762a416ec
SHA1 71c9d5e13a3b3d206ae31d702b16945f230d0bb0
SHA512 747d26470cc39f5d22e199719cbc06c9eecb1d6e863511729b141c502755415c7b410c98b1889f89aa664b756cd51662646bd93601916978aacddd71a8537015
SSDEEP 192:+R4fAvRdUv7FTvAPRp2CG9CHsb+WNnlhxPfbw2SrAczEVyIsnAUge:+R4YvPQ5T6X6kwTxPf02Sr58e
TLSH
T12B42C32EBA10697BADCAD219F9657B43E7F5202131D42E84EBFC892C15E75CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b7dc6b6131887e3be7bfa41fb5e3ef240a94a6e2195acd499074cbd332e6bb5
MD5 0e51264e5fb04c97c80b6e80b6404466
SHA1 751ba2a636b3a7879c5489115be40365b65e421b
SHA512 0426c7d23c8a29d75cfc33e632a80e95fe510e31286935b4269f4baa1e3d07daded1e4dbde30bada849d846b08cfc9c5249100283886ded51a87a39d0efcaaab
SSDEEP 192:+R4fAvRdUv7FTvfPRpSCG9CHsb+WNnlhxPf2w2SrAczpVyIsnAUgE:+R4YvPQ5TfXekwTxPfX2Sr5rE
TLSH
T18A42B42BB910297BADCAD619F9657B53E7F5202121D42E84E7FC892C15E75CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 abcdbe98ff8d076f63d9b2dcfe52f7ac2faa64bbda7634f2bec82ca5490da63f
MD5 7b49a40a82888870c60f7c3c5df7b5e4
SHA1 d1f1d39aea590e8414ddcb2000a13f51a7ff2500
SHA512 6dff1184447ccbd0dfb5743b1397d929678147869e8bbe33b50e43b5a63fb2f815e7e6300476275361e89181744d0318b49056431a341059ce9b9c8bbda1f70c
SSDEEP 96:MRbJ0d+CNkx/Fc5vBh2F8vIfjnNArWrGSl8h4otop51BDdB6PGyv1fbbGILCRNC4:MRt01N2c6AxiU27DnwnGILCuCoNu
TLSH
T174C1C772A85D9C774CF2F549B1032E43CE68612B6951BF58EED99E0C01E74EC1382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9f2604026af848b456b7ba8aca41ec9c1c84ef8135a6bf44784a8432c4d629a6
MD5 5c97598dec83459858ec4eacb66542fb
SHA1 7a474251c9498fbe9b0caf5e9263aa0392267f77
SHA512 18088f9d0544792f70d3850c9c9e2c3c03cb2ff6e637548b98bcdb1c487b39b450254aa0b35aa3ff1c2982ebfea6013be0e9546d58ee74ec0ee188d6400bd143
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok51VDdB6xGyv1T5LqbKv4a:MkC01N2c6AGDDUDTD1U5LqbU
TLSH
T197A10A32686D9C7788B2D549B5522E03DE787127F921BF94EADD5A0C11B70EC2381917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eda02b775ad51adcecb79279ce1cd2dcb25e03e17211dfcffde2be6c73b11797
MD5 88f268b153c1d0baf755cdbe8afbaefa
SHA1 8bfcca4b1600f0e00c634cb67f604d82982947d1
SHA512 71393ddfceb1a96caa5494e13d8f5c427b2853ef4e174b43ea67ec3b14ee21eb216246cc5c16eb17b4a4ce573b9a317b7c7f03db3da11413058efb4e77d945e8
SSDEEP 96:MRC0d+CNkx/Fc5vBh2F8vIfjnNArWrGSl8h4otop51BDdB6PGyv1fQBFv1QzbooU:MRC01N2c6AxiU27DnwQBF+vwILtU5a+
TLSH
T15BC1087678ADEC3358F3E559B5132A43CEB4712BA551AF94EBD95F1C02DB0E81382813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eae66e3eea99ee4d85938b1f0e0258f2fedb2c29ad9ec3cb40ce0427b7860798
MD5 89a4c7afceec39eeed6f395abd8bfd4b
SHA1 7347897ebb1493435abe75365643c96c008d7da6
SHA512 df1deb8d470ca3f971b5d2a5354ccb089c298565619365c3cd1cce77f33b77671adb35dc9fad7a7585ffce44d63be612c565d06c30072241e47ca402ee52a27f
SSDEEP 96:MRbJ0d+CNkx/Fc5vBh2F8vIfjnNArWrGSl8h4otop51BDdB6PGyv1fQBFv1Qzbod:MRt01N2c6AxiU27DnwQBF+vwILtU5a+
TLSH
T1CEC1087678ADAC3358F3E559B1132A43CEB4712BA550AF54EBD95F0C01DB0EC1382813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 782b04216c4f71c6d86defff92bc594b7f989dbf4198dc128f046920a7979108
MD5 1d8bf46952d137465a178e05ef0100ce
SHA1 a224dc078f261e5e28712278d68d5ce5927d3782
SHA512 ec393a57f6ab61e4849a47f754a49977078a633f62d8b01b231b7e4a905b411cd4b338d1805b603b564aa1d0e04ee917c0eca58977add88d541a9d23dda33d67
SSDEEP 96:MRbJod+CNkx/Fc5vBh2F8vIfjnNArWrGSl8h4otop51BDdB6PGyv1fbbGILCRNC4:MRto1N2c6AxiU27DnwnGILCuCoNu
TLSH
T1A6C1D872A85D9C775CF2F54971032E43CE68712BA9517F58EEE96E0C01E74EC1382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download