hxxps://gist[.]github[.]com/jczzbczz-rgb/1e0bbea62f703389865e4f098376ce9f

Analysis

max time kernel
899s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gist.github.com/jczzbczz-rgb/1e0bbea62f703389865e4f098376ce9f
Sample260910-3cnjxafa64

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6136	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335561574580935"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe
Token: SeShutdownPrivilege	5608	chrome.exe
Token: SeCreatePagefilePrivilege	5608	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe
5608	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 1072	5608	chrome.exe	89
PID 5608 wrote to memory of 4892	5608	chrome.exe	90
PID 5608 wrote to memory of 4892	5608	chrome.exe	90
PID 5608 wrote to memory of 6136	5608	chrome.exe	91
PID 5608 wrote to memory of 4704	5608	chrome.exe	92
PID 5608 wrote to memory of 4704	5608	chrome.exe	92
PID 5608 wrote to memory of 3460	5608	chrome.exe	94
PID 5608 wrote to memory of 3460	5608	chrome.exe	94
PID 5608 wrote to memory of 2988	5608	chrome.exe	95
PID 5608 wrote to memory of 2988	5608	chrome.exe	95
PID 5608 wrote to memory of 3260	5608	chrome.exe	96
PID 5608 wrote to memory of 2940	5608	chrome.exe	98
PID 5608 wrote to memory of 2940	5608	chrome.exe	98
PID 5608 wrote to memory of 5756	5608	chrome.exe	99
PID 5608 wrote to memory of 5756	5608	chrome.exe	99
PID 5608 wrote to memory of 3116	5608	chrome.exe	100
PID 5608 wrote to memory of 3116	5608	chrome.exe	100
PID 5608 wrote to memory of 2884	5608	chrome.exe	101
PID 5608 wrote to memory of 2884	5608	chrome.exe	101
PID 5608 wrote to memory of 5568	5608	chrome.exe	102
PID 5608 wrote to memory of 5568	5608	chrome.exe	102
PID 5608 wrote to memory of 4052	5608	chrome.exe	103
PID 5608 wrote to memory of 4052	5608	chrome.exe	103
PID 5608 wrote to memory of 1296	5608	chrome.exe	106
PID 5608 wrote to memory of 1296	5608	chrome.exe	106
PID 5608 wrote to memory of 5340	5608	chrome.exe	107
PID 5608 wrote to memory of 5340	5608	chrome.exe	107
PID 5608 wrote to memory of 4952	5608	chrome.exe	109
PID 5608 wrote to memory of 2872	5608	chrome.exe	110
PID 5608 wrote to memory of 4456	5608	chrome.exe	111
PID 5608 wrote to memory of 1908	5608	chrome.exe	112
PID 5608 wrote to memory of 5368	5608	chrome.exe	113
PID 5608 wrote to memory of 5368	5608	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gist.github.com/jczzbczz-rgb/1e0bbea62f703389865e4f098376ce9f
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffae3bc728,0x7fffae3bc734,0x7fffae3bc740
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11456708657976367300,11313251290961793445,262144 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,1253497868216178689,10895036685683729144,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,16379691774631803138,5942910305891118536,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:13
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,11554385281108866995,5688497365807105900,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,329685214484012493,11006796981876478747,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,3250743996749203466,1075192060639062983,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5556,i,12831370470004456640,16560684369013003842,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,13508074243662136436,10350132393400058956,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,1534471654723558412,2184595116044412075,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6016,i,17239081888578329320,17460286747088948872,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6172,i,11325810094246774117,17108360192618054675,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6340,i,14194393793874334221,12441742487967245940,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5584,i,12228357070027014080,6024924511197617030,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6576,i,1937718710455915404,17060581899965221585,2097152 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,2536705592903501518,6174896317768546903,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,9971042603708909785,3673895063063141173,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,10241380971551123422,11465026232994743905,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5552,i,9059261588973802439,10571698903900625533,262144 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,11465047855494208296,16601462891236906404,524288 --field-trial-handle=1928,i,17446879271318583757,8700303704661736832,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:5368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4720

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b3bcb7d0fd456f9b238a30d7d31c7d5be7289d7c8375fe1e37ba81cc7316719b
MD5 67e2cac5c9d7966f487f3884e6226f8e
SHA1 f7365c03cdde2ce17732cf7509c980a8504690a4
SHA512 e3d1f5eed86398ce2b87955bb73a266a42b58bf96fbb43e1a52c0d4e3a30ace8b7d9dfeb297ef01c7c401bbf52e990012147661318bd2d0874c27588fe4a0178
TLSH
T1C321CB8A25CA3949DBC03EBC2BF74D07BB3A668C00079DF668F4D97D6291302DC1B562
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dae4c3eeac898fd02b56e842bdf446a8e324473af36a91cbbabaaf798a7eb91b
MD5 611375d438850516ecbace8837ae4ae2
SHA1 02376ad7f5449aab42dbc946966c7a70ee023905
SHA512 1cc53d1daf47dde8c26f34d0fc526fcba1b164f4476daba0985e15d6c54408033a18016c4ea8014047d6af4f853bca644e110eed757d83b92d6922ac36837537
TLSH
T10F4167F783B5956D9A0295F0EA08AE1FCF690524431D38BA88E47E16D3E3972E10075F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c1da2cfd0005c5da9431be903a0a27a3145eac77025cb622032a41c4e220e7f6
MD5 a7ac5662573bb5eb0859e56a55c476ad
SHA1 354c04351cc6110f8e10fad55c72eeef6613a29e
SHA512 b23e95c0462db784dd20c823239f830a86a326dad330a5a07a8b5b21aabac43447a7102de934befed21a691e9ec348f9601972aa782f05b1e7d0a26089954c30
TLSH
T1D22178B7C7D89A3D890156F8A7156F1BCE290D18432C3D27C8E8AE1B97E2876E20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 df2f0032ce049ab889c188f00d39ff0facdc79e2a5c1a67d5cee0dc12bc8a93b
MD5 a74c66e2f12d6212576ab41f759804cd
SHA1 fb18ec868976c27a9e07e1ff084013c7a490f866
SHA512 e37d006051930d1093083443fed2b17e2241b912ab4523d264d3a56c57673cc9cc20834e1f9202a4bf361b02474e8524671248c030d48fff3d105248d4c49ff3
TLSH
T10E5178F783F5956D8A1256F4AB08AE1FCE290524431D387A88E47E1AD3E3872E10075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c987347c31c1b51234189370ba7c28fde2bf7f0a085cf2f171a0b91ac4cf16bd
MD5 3b5c603fba28d8c404b53dd752ad4b60
SHA1 02696b7a6c28f795790f547a3dc9d124c3e6b9ae
SHA512 eecfdfd84331a73c13fb5f0deaaa1de0f2c520677107e85a5cb70804c00bf4a0800ff89f89e0237bf2f89c0089cc26fff29151605fa50532ad71f00a27d9b5da
TLSH
T100216A97A9BBB46F807944EB1E08780969BDB835435198F5DFA6C32CA0D25F30B21036
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0877eaa2258f750b8c29cdf128e6fa1215029c183316fc7faef38a02343f9caa
MD5 c56a93703bad6c3f5eea2e13b9c8d4b8
SHA1 9fa7e7601380523d1f16f7b9ee1772961e8e07dc
SHA512 af2aa57e6ec267cd56c408b9bd4e067ce7f4c2b53d13b51040b12938700ef41b15700fc91e6bab40f97ac6ca5656507dd2e4f7e289cd39cff803b478d9af8ec1
SSDEEP 192:5Rqv75Ev7+qvAPRp2A79pHsb+WNnZ1FHf2KYelu087KVyIsnAUge:5Rqv1gV6X7TwbJ2Qu06Ke
TLSH
T1D342C72FB910A97B6CDBD229F9667757E3F5102221912E84E7FC8A2C15E79CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2295bea58c6da2609fb6d277dacbfc52c2b9aaa8b93835c2353b9b31580f5454
MD5 b8157e17c26b31f84f069f4bc4da4cbd
SHA1 73380c0be6466ed00fb298827e8af522c4ecf388
SHA512 db522874d5e473a5d70169cbb2a52fd90785e1b19dac06a8b7ae52c92f27303bcb114a63abfe1c7cefd6771ee4eb4a51d32a3016e2a6905e11b0c3b95a37e4c3
SSDEEP 192:5Rqv75Ev7+qv0PRpEA79pHsb+WNnZ1FHf2xYelu085KVyIsnAUgE:5Rqv1gVuXVTwbJ2Fu0CKE
TLSH
T1DC42DA2FB910A97B6CDBD229F9667B57E3F5102221902E84E7FC8A2C15E79CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8a91501-396a-44e3-96aa-ace4fba4131d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f8a91501-396a-44e3-96aa-ace4fba4131d.tmp
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6a6b3f90ee6ca5007b84220219f0b362eb063b422a2e629bf5790e2c5da58990
MD5 81b230fbf31549ce5413c78c75327162
SHA1 7a34c99e40025d535cb30fd2898b79dcf16d99fa
SHA512 9d8083f44d9f73e18ecbfbd1e14501904b45b8cdeb84887832a43b3ab76dd6f1c25596c05dd8e7e443fb80b4bbdbfe9bbeae7f312ed595566874e310fee617c0
SSDEEP 96:msbJ0d+Ar2aetJRxW2rgj0+f+U+/EmxezrSl8h4otop5j3DfwB6pGyvTNcfjQf9M:9t0Nr7OJRPrL9/E9iU2vspIcf8fDyDP5
TLSH
T13EC1D871A47DECEB4DF3A455B1032E47CDA8626B6925BF58EED92E0C00D74DC5382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6a0ad5ca70a6920745a5d562036fae76f642eb358b35cbb0eefabe127798f85b
MD5 d4cc986ee3006fc3184d35e4b99616f2
SHA1 07c8c38d6231d5b3da6e592fae3511971788d509
SHA512 7e5ac49b0a332bcb56a5613c3b7b22019c674a4f1bd05db5d06523a7a0473d6e2acd226458c89cd0b5d7d251c15dcd311b4562a99e7b5e57dd0dfe637f9893eb
SSDEEP 96:msC0d+Ar2aetJRxW2rgj0+f+U+/EmxezrSl8h4otop5j3DfwB6pGyvTNchCzb3mF:9C0Nr7OJRPrL9/E9iU2vspIcMn7fRyDf
TLSH
T18EC119B1687DECB359F39556B5432B4BCEA462BB5A20AF54DAE92B0C00D70DC1387923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e166de7cb5c371d81756189311efbca7c9a1fcac344425b1715c3daad913816e
MD5 8dff2fa9ce899b40e368b6da851698ce
SHA1 c59489099c317db8973c2242bafa3165695e332d
SHA512 5041a03e4ca8230b15c5c75c2cd99758b65ef261f390a4edb791afbdf315dcbaed6160c44729ecd4e3b317e98453741973f627db4d9b0a13f7d02e07dc4266e3
SSDEEP 96:msbJ0d+Ar2aetJRxW2rgj0+f+U+/EmxezrSl8h4otop5j3DfwB6pGyvTNchCzb3y:9t0Nr7OJRPrL9/E9iU2vspIcMn7fRyDf
TLSH
T1D3C108B1687DECB359F39556B5423B4BCEA462BB5A20AF54DAE92B0C00D70DC1386923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b93fef13c5f31fd0b6c2f899120c2842ee59ffcd1456fc20cb8b8fe8d25d2873
MD5 8584f9414f1da1ae40df47a62a1d4ec6
SHA1 12df5677c7a34dd0325267cdc837ea0b11412e26
SHA512 2978f66270b43162d076da1ccf4b21bcda3d03fdc45febca9db63706c73c6c3ce68d7f489a72c7cb2737b44661183d6fb2706e7999580da932c9661bfc6b491f
SSDEEP 96:msbJod+Ar2aetJRxW2rgj0+f+U+/EmxezrSl8h4otop5j3DfwB6pGyvTNcfjQf9M:9toNr7OJRPrL9/E9iU2vspIcf8fDyDP5
TLSH
T185C1E871A46EECAB5DF3A455B1032E47CDA8626B69247F58EEE92E0C00D34DC5383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f1601cf994165200ff0f4e347079219a15ec6f81d5e47e2f4075275523bf1232
MD5 724034dea56a2fc3940f928a5fd586e9
SHA1 96bb22bbb727858e069f93b88694ec9fb5406023
SHA512 fad0689375db6d0af6e86895484feedcd8247a9f3c26b791d9797a182699ba8fdf3c8db15122545ea9a2b6b3ec3f359cb55b12a3d514414fe3dd7338994193c3
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5jVDfwB6JGyvTNm6zjD+PEhiv4a:mC0Nr7OJRPrL9/EtDUDRs9ImgjD+shM
TLSH
T116A11872A47E9CF759B38585F5563B07CFA4B26B5A21BF44E9DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download