e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6

Analysis

max time kernel
300s
max time network
322s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 19.4MB
Sample260820-vbprksvsgz
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317186379202358"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1412	2724	chrome.exe	89
PID 2724 wrote to memory of 4304	2724	chrome.exe	90
PID 2724 wrote to memory of 4304	2724	chrome.exe	90
PID 2724 wrote to memory of 2644	2724	chrome.exe	91
PID 2724 wrote to memory of 4872	2724	chrome.exe	92
PID 2724 wrote to memory of 4872	2724	chrome.exe	92
PID 2724 wrote to memory of 5212	2724	chrome.exe	94
PID 2724 wrote to memory of 5212	2724	chrome.exe	94
PID 2724 wrote to memory of 5648	2724	chrome.exe	95
PID 2724 wrote to memory of 5648	2724	chrome.exe	95
PID 2724 wrote to memory of 3776	2724	chrome.exe	96
PID 2724 wrote to memory of 5876	2724	chrome.exe	98
PID 2724 wrote to memory of 836	2724	chrome.exe	99
PID 2724 wrote to memory of 836	2724	chrome.exe	99
PID 2724 wrote to memory of 5876	2724	chrome.exe	98
PID 2724 wrote to memory of 2332	2724	chrome.exe	103
PID 2724 wrote to memory of 3436	2724	chrome.exe	102
PID 2724 wrote to memory of 2332	2724	chrome.exe	103
PID 2724 wrote to memory of 3436	2724	chrome.exe	102
PID 2724 wrote to memory of 5016	2724	chrome.exe	104
PID 2724 wrote to memory of 5016	2724	chrome.exe	104
PID 2724 wrote to memory of 1500	2724	chrome.exe	105
PID 2724 wrote to memory of 1500	2724	chrome.exe	105
PID 2724 wrote to memory of 4712	2724	chrome.exe	106
PID 2724 wrote to memory of 4712	2724	chrome.exe	106
PID 2724 wrote to memory of 1852	2724	chrome.exe	107
PID 2724 wrote to memory of 1852	2724	chrome.exe	107
PID 2724 wrote to memory of 6068	2724	chrome.exe	109
PID 2724 wrote to memory of 5684	2724	chrome.exe	110
PID 2724 wrote to memory of 5644	2724	chrome.exe	111
PID 2724 wrote to memory of 3828	2724	chrome.exe	112
PID 2724 wrote to memory of 3292	2724	chrome.exe	113
PID 2724 wrote to memory of 3292	2724	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd18d5c728,0x7ffd18d5c734,0x7ffd18d5c740
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,10079492674427238387,17530559551742810766,262144 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,14429635582515544540,658605327228176381,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,16988575596738704934,17074711508471117194,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,7164309458826405563,13829948510231928534,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,17223883785890314846,776187712738331601,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,5637601978175501934,9332317083951936392,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5520,i,17096666701479539250,11359126707067397512,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5560,i,13557973390366572172,3743290051671487302,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5808,i,18283440317092747305,11245165342530090127,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5916,i,62124356292871860,7899058991640811275,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4768,i,6021387224187150892,4874095693595624087,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4784,i,16421955935960519877,13349642387668524450,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5580,i,2612414117829658344,15381660685805405153,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5924,i,6624054309834535027,11891226975095823263,2097152 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,4166623294253936568,13918952943551566821,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,10937274576007162393,12175070438541877134,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,2354738423505088725,2816720820676106393,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4708,i,15690261637475372371,11757427380489623089,262144 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,16653143566570547414,5259030193706349433,524288 --field-trial-handle=1864,i,1068791666895954295,12804912650834544966,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:3292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dd77d7616290e053d0f3a558a769939a34d742259a193726b5fb0fcd7fc1303b
MD5 1672071a2254f2ce079afb0bff6b9a4b
SHA1 2909ce02c1ba66436490b28f44779310c75c79f9
SHA512 0002a488fc949c05e9ad09a3dc7f257f8ab948a246848f645afcbb97d14621b32ed1fc1dee7d138a33edabe2315d918e1c6eefbe94f8bf1c09f1b20090d9c5a4
TLSH
T133316BF793B4957E8A1192E4EB15AF1FCE6E0524031C38B688D46E2B83E3972D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 efb5cac3f34fbd8372ff6d68d0695334915378baa2dd59290f2302a9ec64734b
MD5 28421c897ac4f7e741b926b8d93404d3
SHA1 aa86f1bfbbffeab17349ebbe34dc7d30b9d06c93
SHA512 d32aeb774b95a2ec4dae6d0955843def98fe7b01f1f161c31cccc7f31330882d0a9b6c78230dd75e47e771c2097e5daf765c9e10137c8b27bb2fd0fd941a696a
SSDEEP 192:yRCJrAqnov7zvAPRp2SK9EHsb+WNntkPqoH2K+Rykws+dVyIsnAUgR:yRCJrxn0/6X6mw6PqS2K+RyM0R
TLSH
T1D132A77EBD10293B6DDAD229F921B793D3F5102235A02E84EBFC492C25E75CD2223517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2701de5b0db9c363d38cad3fc88e8e9401a20fab7a775b47cb775b0f89853fc6
MD5 d372a458556a7a35c53a7dc83b9578a0
SHA1 f6bcfc5e73e903abb6f751fb309c2fbee4eea2f3
SHA512 595dae4cdefbb6ac3a753c7311cc27053b524623eac355a774e78056626a96ea1c7b3bf1c22ab1b3f3cad704e10d1c3e6440b23608cd5742fc69ceacfe163552
SSDEEP 192:yRCJrAqnov7zvsPRp0SK9EHsb+WNntkPqtH2K+Rykws+cVyIsnAUgE:yRCJrxn0/2XMmw6PqB2K+RyMZE
TLSH
T13742B77EBD10293B6DDAD219F915BB93D3F5202231A02E84EBFC892C25E75CD221751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b22f18717c0276be91394275d7de44d8e310832f85406000dfaa5336732f2593
MD5 59bcfd4306b7bb3bc25d8442fc73ee71
SHA1 a50640437df5fdf14f77c1b7f91bd90971092ebb
SHA512 a11ecd6499a5039cbcfbc0a9210324065c87b5ecd80061feda1dc858ef5d92c4ce04ffe7a8128e88413c8dfabc6cd2b82dbd9e4f56f331c0b12127e3ca9419b7
SSDEEP 96:lbJod+EZUAbKFKu0d6aF7QuGJfmbN3MSl8h4otop5pNDWB64dGyvnpneO23nRNCR:ltoPtbKFKu00UUSbmiU2/G3wMeO23nuD
TLSH
T17BC117B1946D9C775AF6F58AB1032D438DB4606BAD15BE68EEDD1E0C01E78DC1383227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c27c3bf537e6aa07d1db30591a2c1e1dce89dde78a719929c310a1dc58562e9e
MD5 ccbd62d4e5fe5569cb12ad866af00155
SHA1 3aa1682cb4fc241b24733b1aef7c7cc6c872ba13
SHA512 264a111278f279e3ec142811088e39dd1f3d7e81475b70bb088280202227cfb29e9831c2d55ba38eb487bfefa9fec741e5c067e35fb8f6ced465c6a46e854d7d
SSDEEP 96:lC0d+EZUAbKFKu0d6aF7QuGJfmbN3MSl8h4otop5pNDWB64dGyvnpBkeceQ23h0c:lC0PtbKFKu00UUSbmiU2/G3wMBkyQ23r
TLSH
T103C129B1A86998735AF6E646B4032603CFB4616B9D519F94DFCE0F1C02EB4E8134323B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b70fda4245a5de5271a16311999046c0bc8d0643ed35770206763bb91bd78323
MD5 d52a0631d722e8c1aab52d62509e3dcd
SHA1 9a6144d7cc62b1e6c1ae156dce617b79cd026c8f
SHA512 195cea4257d9f78ab8f39de6c8adbc4880e8f2e34795a7d0affc8eb76856a1aa41e891dbfdbe7cfdc71fef5cca43e9aee4865d24c154b7dc99118fc1cad7f5a4
SSDEEP 96:lbJ0d+EZUAbKFKu0d6aF7QuGJfmbN3MSl8h4otop5pNDWB64dGyvnpBkeceQ23h9:lt0PtbKFKu00UUSbmiU2/G3wMBkyQ23r
TLSH
T1D2C12AB1A86998735AF6E686B4032603CFB4616B99519F94DFCE0F1C02EB5EC1343237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 793716be0bb061f354bc85f95582e2aa64c8b0242e2a29e288bd49eb5248c946
MD5 93d355bf3a968e8c7386034e5e649e7f
SHA1 56f52a6d1e1fb34ec2ac8219713903d2e8945dba
SHA512 2f994f402c46163b7f107c6cef2022a7f2b1ee649ba43953dc2662fc7ceaa0c02ac8531357eefe720733cd23a0db91e429a4441ab269dd2d9a7846207a8c1a6f
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5plDWB60GyvnnX3lbKmb0v4a:xC0PtbKFKu00UUSb/iDUDzGECX3lbK7
TLSH
T1DDA12C72A4698D7359B9E649B9662A03CF74E12BED22DF54D9CD0F0C01F74D80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9c59569eb319d677e650ed03134e5ffc0c3f21a13847ad0e69fb51dd1373d327
MD5 e5c5f2d54bbfbdebde962e36e9727685
SHA1 10ecc6d1b97fc47cce117d991ade8a184d705fcf
SHA512 a2c0a599c783ad14be3e7e4936a0cb3ac9bedfb7c8a9f0e8d214eb5a16e5fa236bb353a87d2acb533def4a2d7a295a18d1e4959eaa6226b3bb511045ba3ea2ca
SSDEEP 96:1C0d+EZUAbKFKu0d6aF7QuGJfmbN3MSl8h4otop5pNDWB64dGyvnpBkecAr23h0c:1C0PtbKFKu00UUSbmiU2/G3wMBksr23r
TLSH
T18CC12AB1A86898734AF6E646F4072643CFB4616BAD519F94DFCE0F1C01E74E8134322B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 363636871ede91b3d17cdbd5c49e2d91720778ad387e0ddb88159277cebde045
MD5 299a1b3912f998e1e3e154f479e46710
SHA1 0750324e8ede2c3f48992c455ad02632a0914817
SHA512 a9f87b584dd369a9745cebcf8ca197684712bc18511fcf743d82f867145648cfa12b0d475bb39b097fca403e103e8dc95b4d3019baeadb826011064e81711410
SSDEEP 96:lbJ0d+EZUAbKFKu0d6aF7QuGJfmbN3MSl8h4otop5pNDWB64dGyvnpneO23nRNCR:lt0PtbKFKu00UUSbmiU2/G3wMeO23nuD
TLSH
T1E3C107B1946D9C774AF6F58AB1032D438DB8606BAD55BE68EEDD0E0C01E78DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download