c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396

Analysis

max time kernel
900s
max time network
894s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.4MB
Sample260905-lqa3asywcs
SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
MD5 adc1ff1ecd313896455e610d15d4eaa5
SHA1 22180374f927b9132c3963caff9c1f28155010c3
SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
TLSH
T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4780	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330756081651650"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
3684	chrome.exe
3684	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe
Token: SeShutdownPrivilege	6688	chrome.exe
Token: SeCreatePagefilePrivilege	6688	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe
6688	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6688 wrote to memory of 4236	6688	chrome.exe	90
PID 6688 wrote to memory of 4780	6688	chrome.exe	91
PID 6688 wrote to memory of 4268	6688	chrome.exe	93
PID 6688 wrote to memory of 4268	6688	chrome.exe	93
PID 6688 wrote to memory of 6396	6688	chrome.exe	95
PID 6688 wrote to memory of 1572	6688	chrome.exe	96
PID 6688 wrote to memory of 6396	6688	chrome.exe	95
PID 6688 wrote to memory of 1572	6688	chrome.exe	96
PID 6688 wrote to memory of 5480	6688	chrome.exe	92
PID 6688 wrote to memory of 5480	6688	chrome.exe	92
PID 6688 wrote to memory of 3992	6688	chrome.exe	97
PID 6688 wrote to memory of 2776	6688	chrome.exe	99
PID 6688 wrote to memory of 6004	6688	chrome.exe	98
PID 6688 wrote to memory of 2776	6688	chrome.exe	99
PID 6688 wrote to memory of 6004	6688	chrome.exe	98
PID 6688 wrote to memory of 2052	6688	chrome.exe	103
PID 6688 wrote to memory of 2052	6688	chrome.exe	103
PID 6688 wrote to memory of 2756	6688	chrome.exe	104
PID 6688 wrote to memory of 2756	6688	chrome.exe	104
PID 6688 wrote to memory of 3000	6688	chrome.exe	105
PID 6688 wrote to memory of 5660	6688	chrome.exe	106
PID 6688 wrote to memory of 3000	6688	chrome.exe	105
PID 6688 wrote to memory of 5660	6688	chrome.exe	106
PID 6688 wrote to memory of 2724	6688	chrome.exe	107
PID 6688 wrote to memory of 2724	6688	chrome.exe	107
PID 6688 wrote to memory of 2172	6688	chrome.exe	108
PID 6688 wrote to memory of 2172	6688	chrome.exe	108
PID 6688 wrote to memory of 1016	6688	chrome.exe	110
PID 6688 wrote to memory of 1048	6688	chrome.exe	111
PID 6688 wrote to memory of 4340	6688	chrome.exe	112
PID 6688 wrote to memory of 3684	6688	chrome.exe	113
PID 6688 wrote to memory of 1556	6688	chrome.exe	114
PID 6688 wrote to memory of 1556	6688	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff9547ac728,0x7ff9547ac734,0x7ff9547ac740
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,1161755465945416543,13680276006956152596,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,2143772743832012918,9378530269480335142,262144 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,297547440674406074,18236316595352591031,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,3022255571483267448,7561864574003382006,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,18279572051987065393,17483158768875499842,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,4356984254241322345,12395544709915216218,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5536,i,13628984431780499878,14194224588358829593,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5568,i,15971187721271361437,18391145998302121873,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,8803970890286795016,5422106379117546899,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5820,i,8957095200356582493,7417398692841335686,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4768,i,5910134575910666936,3661674891182518545,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5572,i,15167083465179247159,8744084523263233715,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5584,i,975796861070371143,11973032225509071103,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,13894953316543760896,8473024707897977987,2097152 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3088,i,1770820221724920759,12718153252747452980,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:14
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,12329747652614128834,12429709750455173796,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,2116247117946252951,10712079544862273747,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4844,i,5618272263692332447,5436871951850424320,262144 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,8013518197225794376,5786445180316454378,524288 --field-trial-handle=2020,i,6085881448737368303,13926233818072271997,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:1556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7008

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 41e16c400e04b1343dd8ca6663dbfeae9953691b4ce7a2b462686780f57082db
MD5 6226544c4fcce2eadc4878faa0160bdc
SHA1 a3c8e375b38f561e09d5d50e2db7e677db5dec51
SHA512 b8c0a2efd847f4166dbe0ec281cb2bd8b50bb0629ac7497bce7e485fa60a86b0ac13a4f71e40325e85b8a9522e92c23c2702d4706faf554a078ccdbc9e4246b8
TLSH
T1F5217DF787B4857D8A1142E4EB15AF1FCE6A0514031C386688E46E2B93E2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 45714f673124dbf5e7fad09573863753994733683801514ff4e62b23427ab0d7
MD5 d57e557c9449daa10d4c3831b60171b6
SHA1 8f30114030da5a2114fae0cac8425573b4e8f2c5
SHA512 26a7d8750b7255dfe95b6ca05cfd0e7f9d0aa63ed70b5dec2990ad7766a5fee5d2e95593be4668cb65a3da801275d124b37baa72d85154d46b29901bc51e269e
TLSH
T12AE0C623A67E71F300B940FF2C06B8006AF4F8332A0208E1CA2E836DE0924EB0A00423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f9934150dfe04b03aaca1f3d6a56a7b1c869ad12ded0974b736c436107f2a0a
MD5 c12a8b8c48cb4e7e4ac8ce41a454e746
SHA1 7051b7c74ce8c255d8510c21c7c585a701b2cb01
SHA512 2f3005015784856addf7fe83b57d255abc826dc95e34b0eaad26f78cb8a26613753590dcb4d0d1bbbc2246fdc9d5d1cc11b74ddb496aedf422958fafe5d23151
SSDEEP 192:+R2vRfMv7FTv7PRprCt9CHsb+WNnZiP/qkKs2pkkVyIsnAUgE:+R2vRY5TLXSkwUP/DKs2p1E
TLSH
T1D242B46EBA10687BADCBC269F9617F53E7F5202671A02E84E7FC892C15E75CD2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2df01170b7ef5469f27e060165b95d009f8d5708f724048fb319dd45d096f3f7
MD5 fae2a285c681d50a1c4ea2ef48e701e5
SHA1 b1d4362e902c5a3daa34a402884c84b0f6a4058b
SHA512 fca4c769071dd8c04293322156311c22c582e48068c6972da46c692220df0a32c98dc6b13429c0daa48ff284605fc14fe3d13dd9f017aa69e59fa516891d8af4
SSDEEP 192:+R2vRfMv7FTvAPRp2Ct9CHsb+WNnZiPIkKs2pkGVyIsnAUgR:+R2vRY5T6XxkwUPxKs2ptR
TLSH
T13432D76EBA50687BADCBC269F9217B53E7F5202571E42E84E7FC892C15E35CC2223017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d106015afd3f08c40fd3ce41e9cadc3cf112c5f8d28705e1cb8b99400f3bd7b5
MD5 aadfd8319f0b5c59db5627413eb012f4
SHA1 4029a0547dc47039f38fc5417632975a51747e50
SHA512 9255ec7ca576c8a985c3c595fb6816297effbb762a430afdf5345b9c7a0e7432acd3b83d28109c4a2df568d81d9c1ac5aa329dc6447bf1e75d5c280cc0729bc1
SSDEEP 96:McbJ0d+CNkx/Fc5vBh2F8vIfjnNAvrVSl8h4otop5JBDKzB6/Gyv1fubGIHnRNC1:Mct01N2c6AXiU2HKtXwIGIHnuCoRr
TLSH
T184C1FA72A46D9CB74CF3E48971032D43CEB8612BA911BE54FADE5E0C05E74ED1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a0fad7ed258edcc53841251bde59ae9bf134816b618b88b5750ed7d6f424b957
MD5 fb37f4da3a27676edcc1325160e9fe3b
SHA1 2afa0e5ef4ac3a750df7844850c642024ee4ee41
SHA512 600195cb07ee3482b382ccb579d26a63c53ae6540a5a14757f4c5b594f88b79a1f4bee742fdad95f0259efc099cfc9e1b040a40471de3f9735a8a210d5c11980
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5JVDKzB6xGyv1T5HqbKv4a:MkC01N2c6AGDDUD/Kt1U5HqbU
TLSH
T16FA10932586E9C7788B2C549B5522E03DEB8612BF921BF94E6ED5B0C11B70FC2381517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1f73cc7d19078dcf3d0bde00a9c122ee4f4654d0e17adbd31c51994dd19eb5a2
MD5 f41c7b6680a367e094209ffefe3b3671
SHA1 e9aeedbb9ecf543bcb4746f778b1b1951a0c4d1d
SHA512 80260fad6cd9fdf5ab98cedef911b51976f2fde42ce292c06054978aaa9dad89fb5502ac2cfca2c08d7f17170b9f8d999e8db49ca26a47fd35e335f3be0c9a7f
SSDEEP 96:McC0d+CNkx/Fc5vBh2F8vIfjnNAvrVSl8h4otop5JBDKzB6/Gyv1fQBFv1QzboR0:McC01N2c6AXiU2HKtXwQBF++wIHlU5i0
TLSH
T1D7C10876686DAC7358F3D559B5131E43CFF4603BE911AEA4EBDA4F1C05E70E81382512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0044874f569dd90d705f379f9d93ef8b160ce7b286ed39011bf16bee99101adc
MD5 9d85a2cdbff34884dfa16e7d7b51900a
SHA1 d99043479ab7cc561745c661e44cdc263e1ea47b
SHA512 2e798f77a970a168a6fe8c2a345a45bd056bf17a48aac141673a06106c1687c403f4489fbb0573dfaee5121266328a3f284f8bb1624cab129e7856385714c5b1
SSDEEP 96:McbJ0d+CNkx/Fc5vBh2F8vIfjnNAvrVSl8h4otop5JBDKzB6/Gyv1fQBFv1QzboM:Mct01N2c6AXiU2HKtXwQBF+QwIHlU5i0
TLSH
T12CC1F876646DAC7358F3D599B5132E43CFF4602BE911AEA4EBDA4F1C05EB0E81382512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 19bf7afc2aab88e10c75ab78c2db204b90b001bea558b5143688e4aeeb4dcefd
MD5 31704519743dffcc47bac124d628526f
SHA1 aa3c31f7b20dc0b8f4a4de90a40a4c2ca27f266d
SHA512 119a9bbad8d2ea2dcdb368715245ff80b11806fbf9c5e88a8b8a4baa20cac596c23a55a9a9efe9eabd42413ac9bc2a86c274efcbd73ba66a57b78959310b317c
SSDEEP 96:McbJod+CNkx/Fc5vBh2F8vIfjnNAvrVSl8h4otop5JBDKzB6/Gyv1fubGIHnRNC1:Mcto1N2c6AXiU2HKtXwIGIHnuCoRr
TLSH
T1ADC1F972A45D9CB748F3E48971132D43CEB8212BE9107E58FAEE5E0C01E74EC1382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download