hxxps://urldefense[.]com/v3/__https[:]/vendor[.]paymode[.]com/VirtualCard/G-1CN664MV?enrollmentCode=H36ZP6BSW__;!!O3mv9RujDHg!l35DdTvMJzmgRpGmQ664b92xSlgXTXxqUjfs4sGkCRD1FMkvDUrZDfKg1qXc5rF_XYqk-CSR30HI-AJOXgltbm1P0DyiVTlUPOCd2wPC$

Resubmissions

26/08/2026, 21:34

260826-1e8azsxaqg3

26/08/2026, 21:29

260826-1cdzcsbl6t3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://urldefense.com/v3/__https:/vendor.paymode.com/VirtualCard/G-1CN664MV?enrollmentCode=H36ZP6BSW__;!!O3mv9RujDHg!l35DdTvMJzmgRpGmQ664b92xSlgXTXxqUjfs4sGkCRD1FMkvDUrZDfKg1qXc5rF_XYqk-CSR30HI-AJOXgltbm1P0DyiVTlUPOCd2wPC$
Sample260826-1cdzcsbl6t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5036	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322534162046583"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
1268	chrome.exe
1268	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5048	8	chrome.exe	88
PID 8 wrote to memory of 4284	8	chrome.exe	90
PID 8 wrote to memory of 5036	8	chrome.exe	91
PID 8 wrote to memory of 4284	8	chrome.exe	90
PID 8 wrote to memory of 5600	8	chrome.exe	92
PID 8 wrote to memory of 5600	8	chrome.exe	92
PID 8 wrote to memory of 1376	8	chrome.exe	94
PID 8 wrote to memory of 1376	8	chrome.exe	94
PID 8 wrote to memory of 896	8	chrome.exe	95
PID 8 wrote to memory of 896	8	chrome.exe	95
PID 8 wrote to memory of 5380	8	chrome.exe	96
PID 8 wrote to memory of 5380	8	chrome.exe	96
PID 8 wrote to memory of 1900	8	chrome.exe	97
PID 8 wrote to memory of 2776	8	chrome.exe	100
PID 8 wrote to memory of 2776	8	chrome.exe	100
PID 8 wrote to memory of 636	8	chrome.exe	99
PID 8 wrote to memory of 636	8	chrome.exe	99
PID 8 wrote to memory of 4304	8	chrome.exe	101
PID 8 wrote to memory of 4304	8	chrome.exe	101
PID 8 wrote to memory of 1464	8	chrome.exe	102
PID 8 wrote to memory of 1464	8	chrome.exe	102
PID 8 wrote to memory of 3852	8	chrome.exe	104
PID 8 wrote to memory of 3852	8	chrome.exe	104
PID 8 wrote to memory of 1108	8	chrome.exe	105
PID 8 wrote to memory of 1108	8	chrome.exe	105
PID 8 wrote to memory of 1960	8	chrome.exe	107
PID 8 wrote to memory of 1960	8	chrome.exe	107
PID 8 wrote to memory of 5044	8	chrome.exe	108
PID 8 wrote to memory of 5044	8	chrome.exe	108
PID 8 wrote to memory of 3672	8	chrome.exe	110
PID 8 wrote to memory of 4392	8	chrome.exe	111
PID 8 wrote to memory of 5848	8	chrome.exe	112
PID 8 wrote to memory of 1268	8	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://urldefense.com/v3/__https:/vendor.paymode.com/VirtualCard/G-1CN664MV?enrollmentCode=H36ZP6BSW__;!!O3mv9RujDHg!l35DdTvMJzmgRpGmQ664b92xSlgXTXxqUjfs4sGkCRD1FMkvDUrZDfKg1qXc5rF_XYqk-CSR30HI-AJOXgltbm1P0DyiVTlUPOCd2wPC$
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf97cc728,0x7ffcf97cc734,0x7ffcf97cc740
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,168721548058937724,4894705079422889873,262144 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,3562112348353299144,286957472951488479,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,7281940789574674560,16109926396361182406,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,6321077823001909619,2683040685416643621,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,5273975928542745333,4519289953305587307,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,10528896969271158466,12120240371512262662,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,9690921747617599818,8374603078188837426,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5336,i,18284682233008502179,15434015772739089005,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5368,i,14096507257968537943,15420866094043892920,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5636,i,816274204292375203,10427141236000469946,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,14014003265740354941,14561178937359636546,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6008,i,7213378762964088348,6480807914135478347,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6204,i,7826907628588122718,3439866039014798206,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6344,i,2438494977085084236,5599119638548708165,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6488,i,7015684360820141921,476368848285496043,2097152 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,15531480318992791008,7349582021806964057,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,11375818241219689043,9651921064112440031,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,1129033843407332709,9569100154919543349,524288 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6172,i,7493933249495656490,11114999156541428811,262144 --field-trial-handle=1904,i,34039321399640132,3179652863285934978,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7681207410885e53394b04a8aa5ff770b4414f03a124bc99c3006cb71c4fbb31
MD5 89f11cd552277174124d53c77bed81ef
SHA1 4169684751dee495b7fe4e52db799b078aa95392
SHA512 58982a668826bcc89544dec0a80ec44f857f19763ab938a9b56cb90d0cb096c52d538fb20db39147082a8ac984aee90d9b8161fc8827e7cac7fc52dd5969cff4
TLSH
T123D08C2B40A61245C7804AB5E0CB8EC0367207181A1B560308D59068F21A7FF1F828EE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e5e6ec76162b07b6925da40e6b4b601ff74a608c1b236f16fd2bf01a87f3fc88
MD5 36eafccab6691298871e3f7d9d9b79e6
SHA1 41cbdf86941105973275e875281093175cb8ef92
SHA512 780fbb6fe337d9f7d8a83b1b163079b43c212c21aa5a5fd1670e966257de88c934c9c3ccac80d971ae0d6b30e871ef1ea8c080f711efc609b6ab1c8de4731ac5
TLSH
T1557199F783F48A7D99015AF8AB157E1BCE6A0924432C387689E47E5B63F2471E20464F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f5a1019ce92a811e1b5c0c67478fde3a23826e2bc94451d98e4eb01a9006936f
MD5 1c9b51a81ff735c42c7d82c6721b0d4f
SHA1 2854d7890981269b1d1996391707b70ba08a8eb5
SHA512 d2c35c553d55f1651a70f08f05c7c4ac1940c99c97b37aefa22aa510f10f0daf911615923fdf3c5f2621eb0e4ccca89fcff92966b4a3d7c39d76d1ec141ce3ac
SSDEEP 192:5BRlua5GLv7QvAPRp2ah9XxHsb+WNnZSMlL2i9KUl2rhQhxkwgVyIsnAUge:5BRluyGz86XRfwU+2gKUl2rihxEe
TLSH
T1D542B62EBE14693B6DCBC229F961B797E7F6102121952E80E6FC892C15DB6CD212740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 286989dc9d5d5c85d65e2fd8bc6cf37d492b28f9ab9ba46b4a432041e0912b66
MD5 09276720bac48e69c46761aae7bb1a80
SHA1 fec6c817247aabb9984d2df889a14e250b337137
SHA512 857398f703a1cb31d9b982e98d6f3ba57a42bf12d12c1b9d16d86c157d75b37b41bc51ceba6377b2e39c9ba0bd0ad2f7a63fb8c6591109bc8a8efd83be03c4ed
SSDEEP 192:5BRlua5GLv7QvKPRpxah9XxHsb+WNnZSMlL2/9KUl2rhQhxkwSVyIsnAUgE:5BRluyGz8kXQfwU+2lKUl2rihxyE
TLSH
T1B442D72EBD14693BADC7D229F951B797E7F6102121D12E44E7FC8A2C15EB6CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eaca9837e6fe7788729e18ee452a06b8d7707633ffcd8e7cd99e966f0200c757
MD5 dc0d916fefbc606f683c9c3c91767424
SHA1 0d97e617726efb01a8476ae4bd28a69cecc5fd57
SHA512 b8167cbb1c1f3dc76525ed81e204e16215f8a507fb46c032b4d352b2d30ddfb092ab4c3996724b9f23aa4cdf66edde9c090ad494dc56ede0d56985c3fabd91fd
SSDEEP 96:VbJ0d+r2io+TJ/E0f6m934HMlSl8h4otop5BicD8B6WGyvn0S2hlm+9kARNC39Ii:Vt0ITo+TQ0I4iU2rQKPS2hlm+9kAuCj2
TLSH
T1E5C1F975A06C5CB708F7A485B1032A47CDA8606BAD65BF64FEE90E0D01E75DC1383937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 71830a80c74e05ee1703b42c9db4ff4245bd3b1e21be65cc7485fa93c024bb7e
MD5 c3d227ab6e72f01052a5bf2278646fed
SHA1 e9a07abde8cac45829def33ddec23741e4c3e2dd
SHA512 3f6beded889ec54bd27e4466ecaf5ce021e70891b764aef91bfdfc448954c305a279624880e640c880fc878807556a13fb7a3659e21313575451ed2f7f3e6fba
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5BmD8B6nGyvn0b4T8kybJv4a:xC0ITo+TQ0InDUDqQPPb4T8kybl
TLSH
T1CAA10835A0284DB74077D486F1626A43CEB8706BE9B2AF90EAE90E0D14F71EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0548e71304c4963b2d0e890c6cf1d0b4366c7e922fe8e1da8e94dffb7f370c6b
MD5 27b90962ff8e2777d40914df37041929
SHA1 e92ec5ee0082fa960d1c3737b8971cf9ff8f583f
SHA512 2e733790ec1a023dc8387b87747fbce0ab0aa0145a5f37ac80d751b5245cb4628dca0538669677bca9647e1934b9473b725df89fb741dffa37ed38b674b7a500
SSDEEP 96:VC0d+r2io+TJ/E0f6m934HMlSl8h4otop5BicD8B6WGyvn0SvQxwzQLhjm+9kK0G:VC0ITo+TQ0I4iU2rQKPSIx3hjm+9kKUs
TLSH
T1A2C13A71B46C5C7705A7A446F1136A4BCDB8206BD952AF70EEDA0F1D01E71EC2342937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 99376e8274883ec5797a7ac2ddc27d76ce09a880f5afa0e6b949dc1d7ee0f09f
MD5 0908cf16ea140141a3f46415ad2755d7
SHA1 6d7c1d03e972dc38b8e858c8d9817d8fa7c1b32e
SHA512 ade8ca53fcb759455471418ec43ecf817d07e9fc94a855ceb0a73ae2cbd7d88ac63e3a9261fd95619529e219f1c5034b0c0a02b2827c679349f524fc6b8cb114
SSDEEP 96:VbJ0d+r2io+TJ/E0f6m934HMlSl8h4otop5BicD8B6WGyvn0SvQxwzQLhjm+9kKf:Vt0ITo+TQ0I4iU2rQKPSIx3hjm+9kKUs
TLSH
T15AC13A71B46D5C7701A7E442F1126A5BCDB8206BD952AF70EEEA0F1D01E71EC2342937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download