452154a082fd36b9ec8b5230bf4b6708c4715153e78fad120eb25828fa89381b

Analysis

max time kernel
300s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/index.html
Size 27KB
Sample260907-tp48rayvht
SHA256 452154a082fd36b9ec8b5230bf4b6708c4715153e78fad120eb25828fa89381b
MD5 14c405b7892f466f89d16bb5b3ec68ca
SHA1 d7ba5ce2b5efd4bedc78c3c78eec5274df5b6898
SHA512 6795fe8c7072adf44ef990a12f9a840421622b2c0836a3590a7905e135d42be922f9db1070e09c1fd2f82f1c5d2ee09b4526e27e2454b04923e84d52afa49b68
SSDEEP 384:23JlhPshoRJ/seq06ItLglbyPasN1vnYogfZZ51Px+mppiq:2OhoX/seq06ItLglbyPa65nxq5xtoq
TLSH
T1D9C2D811DA36102CB237462AB5E2BA4E7024C117E6538A7FFA5C5635CBDB08B1E13BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332713185060017"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
4688	chrome.exe
4688	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4316	2092	chrome.exe	88
PID 2092 wrote to memory of 1752	2092	chrome.exe	90
PID 2092 wrote to memory of 3328	2092	chrome.exe	91
PID 2092 wrote to memory of 2896	2092	chrome.exe	92
PID 2092 wrote to memory of 3328	2092	chrome.exe	91
PID 2092 wrote to memory of 2896	2092	chrome.exe	92
PID 2092 wrote to memory of 2512	2092	chrome.exe	94
PID 2092 wrote to memory of 3028	2092	chrome.exe	93
PID 2092 wrote to memory of 2512	2092	chrome.exe	94
PID 2092 wrote to memory of 3028	2092	chrome.exe	93
PID 2092 wrote to memory of 5632	2092	chrome.exe	95
PID 2092 wrote to memory of 4784	2092	chrome.exe	97
PID 2092 wrote to memory of 4784	2092	chrome.exe	97
PID 2092 wrote to memory of 1764	2092	chrome.exe	98
PID 2092 wrote to memory of 1764	2092	chrome.exe	98
PID 2092 wrote to memory of 5396	2092	chrome.exe	99
PID 2092 wrote to memory of 5396	2092	chrome.exe	99
PID 2092 wrote to memory of 4432	2092	chrome.exe	100
PID 2092 wrote to memory of 4432	2092	chrome.exe	100
PID 2092 wrote to memory of 4100	2092	chrome.exe	102
PID 2092 wrote to memory of 4100	2092	chrome.exe	102
PID 2092 wrote to memory of 3476	2092	chrome.exe	103
PID 2092 wrote to memory of 3476	2092	chrome.exe	103
PID 2092 wrote to memory of 5932	2092	chrome.exe	105
PID 2092 wrote to memory of 5932	2092	chrome.exe	105
PID 2092 wrote to memory of 3040	2092	chrome.exe	106
PID 2092 wrote to memory of 3040	2092	chrome.exe	106
PID 2092 wrote to memory of 4312	2092	chrome.exe	108
PID 2092 wrote to memory of 5484	2092	chrome.exe	109
PID 2092 wrote to memory of 5532	2092	chrome.exe	110
PID 2092 wrote to memory of 4688	2092	chrome.exe	111
PID 2092 wrote to memory of 4336	2092	chrome.exe	112
PID 2092 wrote to memory of 4336	2092	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x104,0x7ffa3884c728,0x7ffa3884c734,0x7ffa3884c740
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,6794607013319294577,14031908029025003542,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=316,i,16857252305287453989,2063959715659614747,262144 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,16979991467959433447,6127969843727697430,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,2039534902874789637,17069808154182297612,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,5794298897816180280,9571584605530385808,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,9114314733049421044,5865228803260628690,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5240,i,11614299635724682468,6206904447216260294,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5292,i,12690954790175205811,2044927034395917827,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,13180132664733548412,2897193881792079264,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5808,i,8912866140245264443,18074663149969616998,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6028,i,14939523106807594934,3862961611596281766,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6000,i,4639853633864520826,2119568956374244208,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6252,i,3903244101074399858,13774165069601704604,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5340,i,16344616752808797327,16942802467367415176,2097152 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,16385741102402802982,8441472288443338148,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,12940054694337339513,414231110411674068,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6632,i,5900660062952565530,5630565424468112309,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6596,i,10884478991779624553,13952259720138284132,262144 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=1128 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,13701897321484011848,14117561525586534350,524288 --field-trial-handle=2000,i,7538017250613489286,3353245313928040909,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 18dced0e08e25d66b8d9973249cc99511c8be3cefe441e63d8a85bf0a024a1f9
MD5 f94f872061a8413f586fea18b50ebae6
SHA1 9e94f6b42c582569e88b390c565b680f1fd2afae
SHA512 f5dcb623f82802f54b7df55e9d5b62c249cb9c153c1870315ae2e902b940ecc30a793d33058834d83295c7d09daab1786572a510bca202d232b86b4b77617d00
TLSH
T11F418DF793B4897E8A1192E4DB11AE1FCE7D0525031C3CA689E46E2B53F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 32b107b7d008af50d97cde3d76acef27072119138f9707bec7c50bc64265e463
MD5 fbe86b322e15408d611c93a74792d71a
SHA1 d0ec0343edfa288dd43717af0d290cf693e5ae7e
SHA512 4b33c0f7368850a1015e6492d669d5ce27ce16edbd3830db4825fd050fd32e0b14fcacc20fc9895eda967e12f80ef800b3425c375b2fac534bfc81927ab7fe91
SSDEEP 192:bR1BVoMMv7xbvAPRp2PN9GHsb+WNncePy323esOSnPDVyIsnAUge:bR1BVnYN6XqgwJP42BOkPle
TLSH
T17942D82EA914793BACDBD219FD627753D7F6102171902E84EBFC892C15D7ACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 64cd43db82decaaa6b2c9d7268f6e9d4e750baa5ee53efe9e2f0a0eccf3e9fe3
MD5 39ef0e1c7e7982efff88aa10ccda0688
SHA1 65264bbb7cef4f8f297830734a03280f3bad8823
SHA512 813feecef081117ec7a3e83e97017fc0f78ddbbd8eb20abe112ccd1fdc469a2b58493d72ca40bf772927fdc049d2d829d8150bcb0fe66a1485cd93fe395a8e36
SSDEEP 192:bR1BVoMMv7xbvnPRpbPN9GHsb+WNnceP2m323esOSYPDVyIsnAUgE:bR1BVnYNHXRgwJPJ2BOlPlE
TLSH
T1A642C92EA914693BACDBD219FD52BB53D7F5202171902E84EBFC892C15E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2843b69b8a7ec9eb2dc736f70c2542cbcda2876aacf7464b667174b040583dab
MD5 0a728314bf8b137880ad563d4134c6dd
SHA1 d8ff7b46f696ab717bda4589a643c6cf33daf6d0
SHA512 4908e6b6cbce094867735639e8f4d28affc1011f0da54471041e5e9a87edfb4ce198ab0342d21d858aa6e5fcbdea1e0ca8dabc6b7ea64fd4640e68e912730268
SSDEEP 96:+mbJ0d+CVgOeTnnGBfYZSZH3/USl8h4otop5wiDPB6/eGyvhyY8f+canyRNC39Iq:+mt0JeGnZQiU255YXa8WcanyuCEJ
TLSH
T116C10AB4E46DACA789F6B885B1032D43CCA561ABAA157E58EED85F0C02E74DD1343533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 71089d32183834245814d2b62c5634a384775764e3894ec6cbb2c2979479196c
MD5 1581f65ba807d8e3b19c8f12af6aaff9
SHA1 9a318732c5a9479a19758f068f6869b21b404c4c
SHA512 f614539a9a1fac99ee48d7401f7a7db67b680d2df5acf099b34a65cdfdcd70a55482f10c582f9eb0bb4a6901ccf413636103cdaa41d8fe97a8f6f6b7b0158654
SSDEEP 96:+mC0d+CVgOeTnnGBfYZSZH3/USl8h4otop5wiDPB6/eGyvhyYMUGsakO0AGXXf+Y:+mC0JeGnZQiU255YXaMUGs3WianUiUH
TLSH
T1C6C12C70F4EDA8B389F7A959F5422A47CDE161A7A652AF50DED80F0C02DB4DD1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a1c31bd4abeaa2157401aaef6bdd22b60281af4b559a5180540159b96908069e
MD5 3e3cb15a418f09c57395ce4817a62144
SHA1 f8002b65b98d465317c9fdd3f5c624cac97bffce
SHA512 2bc4f3ef75b06440da59b7af34132f7a782563b90957c50f54d830fe22252b819d44181f3c8b2dc724c390ff303c4994c6b8881f0547f5cba33c68286d96e390
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5wcDPB6gGyvhyLfOLnEbZP9v4a:SC0JeGnpDUDH5E1mLnEbj
TLSH
T126A11C71B46D99B384BA9849F9527B43CDA561ABEA31AE44EDCC5F0C02FB0ED0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b74e2e97a018bdd03cbec073da424173c09fdee64b76990590fe8c7dbb69e4f1
MD5 a900d00a3e9bdb8c185d04c949579c7e
SHA1 43de6638b7e21bc13187b271dae0536573d28c5a
SHA512 819780c154614b59f66cf030dde16da4aadcc3dc7889316466c2804eb3d6672118bfad44631375c81aefeb95805013142fd84308f6d59e295dd3d1f9e11d1d9e
SSDEEP 96:+mbJ0d+CVgOeTnnGBfYZSZH3/USl8h4otop5wiDPB6/eGyvhyYMUGsakO0AGXXfZ:+mt0JeGnZQiU255YXaMUGs3WianUiUH
TLSH
T1A9C13D70F4EDA86385F7E959F5422943CDE1619BA552AE50DEE84F0C02DB4DD1303527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f428c67061392583375aed6d59e383be946cd974675a96ce69dc5e1a49154c41
MD5 a1f7d5470c30073d481c1faf96eeb848
SHA1 1d24573f9ac6715eba43c8d69c3af6536fb39346
SHA512 ddb359407ecc851ece2ae970a6af90d818de5108f834aa15f2f40d16072f96fa595825b0c873bd7e48105fbf3d60882498870686e5cf8c0018221fc94cae6f45
SSDEEP 96:+mbJod+CVgOeTnnGBfYZSZH3/USl8h4otop5wiDPB6/eGyvhyY8f+canyRNC39Iq:+mtoJeGnZQiU255YXa8WcanyuCEJ
TLSH
T10BC11AB0E05D9CB789F6B849B1032D43C8A561ABAA157E58EEDC5F0C02E74DD1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download