hxxps://shorturl[.]at/bPDtv

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shorturl.at/bPDtv
Sample260924-bfcs2aae67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346855223028347"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2356	3416	chrome.exe	88
PID 3416 wrote to memory of 4956	3416	chrome.exe	91
PID 3416 wrote to memory of 6048	3416	chrome.exe	90
PID 3416 wrote to memory of 6048	3416	chrome.exe	90
PID 3416 wrote to memory of 1820	3416	chrome.exe	92
PID 3416 wrote to memory of 1820	3416	chrome.exe	92
PID 3416 wrote to memory of 1676	3416	chrome.exe	95
PID 3416 wrote to memory of 2088	3416	chrome.exe	94
PID 3416 wrote to memory of 1676	3416	chrome.exe	95
PID 3416 wrote to memory of 2088	3416	chrome.exe	94
PID 3416 wrote to memory of 5028	3416	chrome.exe	96
PID 3416 wrote to memory of 5028	3416	chrome.exe	96
PID 3416 wrote to memory of 4576	3416	chrome.exe	97
PID 3416 wrote to memory of 484	3416	chrome.exe	99
PID 3416 wrote to memory of 5684	3416	chrome.exe	100
PID 3416 wrote to memory of 484	3416	chrome.exe	99
PID 3416 wrote to memory of 5684	3416	chrome.exe	100
PID 3416 wrote to memory of 4116	3416	chrome.exe	103
PID 3416 wrote to memory of 2512	3416	chrome.exe	104
PID 3416 wrote to memory of 4116	3416	chrome.exe	103
PID 3416 wrote to memory of 2512	3416	chrome.exe	104
PID 3416 wrote to memory of 5968	3416	chrome.exe	105
PID 3416 wrote to memory of 5968	3416	chrome.exe	105
PID 3416 wrote to memory of 1288	3416	chrome.exe	106
PID 3416 wrote to memory of 1288	3416	chrome.exe	106
PID 3416 wrote to memory of 2800	3416	chrome.exe	107
PID 3416 wrote to memory of 2800	3416	chrome.exe	107
PID 3416 wrote to memory of 2868	3416	chrome.exe	108
PID 3416 wrote to memory of 2868	3416	chrome.exe	108
PID 3416 wrote to memory of 4936	3416	chrome.exe	110
PID 3416 wrote to memory of 5380	3416	chrome.exe	111
PID 3416 wrote to memory of 4372	3416	chrome.exe	112
PID 3416 wrote to memory of 4840	3416	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shorturl.at/bPDtv
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd2b31c728,0x7ffd2b31c734,0x7ffd2b31c740
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12798516421347498015,9274166017861298516,262144 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,15008003394658940208,3692654942579621069,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,17949732915637457251,1797532262755991122,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,6692502636392392769,15325034457106090971,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,3166344248440629407,545501334317726593,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5160,i,13016158050241652865,4961914534877918236,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,5541366955079546185,18434625373527208244,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5380,i,13087634492419567130,11673069488783743087,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5568,i,12265412034619951418,17737497254385154372,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5880,i,7123110409030606791,12893409990693334297,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6040,i,7668443634493175885,5541871102355312776,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5180,i,1991594697022887650,15271535036175207054,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5452,i,12198196696887495422,7012854895389878835,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5720,i,5303633177643939538,3005073306705016302,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5812,i,6965736884757982099,17342005207123290666,2097152 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,4632240148896511036,11380420209020102946,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,1778994588162549725,5324859783866489643,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,13663146859783046391,18037488432439105175,524288 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5992,i,13004588241051070778,3461793388186052723,262144 --field-trial-handle=1928,i,14884273401022383616,397170972471459913,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 528B
SHA256 6292e68d29decce02e7881784af7490f02a2ab3e7fe74692b4dafdd7e75b9ce3
MD5 19905e47d034b3269e97c01ae02f7f7e
SHA1 ece83cd68d4d2f21b5b119146862270f2995ce4d
SHA512 f628589681fc0b385f9082861ffdd2eaab97c91331922ef2b12162948b727179f54f53737b33eedd5f852694e3492755a4bd30868628ee234c537efc8cf73071
TLSH
T1FDF0ED0569D42C12EF2DFF36FCA108D8216005BC0AA20BF3A3C61138910B6F08491DB2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 85102a014954041a29897c45bc42bd50b6ee820289c24ad6b7f48bdd54e90d69
MD5 0d464cf6ca478ea25886b3c951777953
SHA1 48f7f799a82a6464f1df507ff5898c02cccdcfc4
SHA512 0ae987eb194ba8bf979845653819bad06631cd3e7a93fd0c17ab1c734bcd73879821fed2366976c6be979819d66ac93af0f59c86721c228e3ce8a497fb4d55d0
SSDEEP 48:YALlhZvVgs7/Rs6XLsI4foKs7fsOosj7OBXFsg4skOBXKsgo6gGxJgGfs++Azsf6:DHtp6srT7uX3kuXy6GIGd+Zj2yK
TLSH
T1A3918AF7C3E8DA2D891152F9AB152E1BCE6D0914532C3C16C9D5AF1B67E28B1E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 509164aebabe8f4a4c14cbe106e38eaefb8457397c53168fc555e94d3bbf0e5d
MD5 40c9340605248a78edfdde0c1c61e611
SHA1 5d5beb7d2a337759ac9c0669496e5838660d7d9f
SHA512 c59ed5dc62d493cf1e9ab87c275455897fc08781914fad5999ef85b8b3489d56285200bf2563b2c4e3c5daf61f524a15f5ddc33c9fd16e0cd4886ea93fd94999
SSDEEP 192:RRWJDbtbv7YvAPRp2+R2x89xHsb+WNnPCPKB2mm2pokwGVyIsnAUge:RRWJntjk6XNDw6s2t2q+e
TLSH
T18A42852EAD64797F4CDAC629FA257B53E7F5202170A12E84EBFC8A2C24E75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 729cba51b0cfa99fe1ef05ab435ddd4dd79669b190e8c9f28336361740de7cb2
MD5 105c2721b81655d5bb831079194df261
SHA1 aa1ee60a000aa69ac02a2518e649a453d47a0783
SHA512 10a1d23f0d74dd7d18f1ca6764f51a57c0283283307e34798476724afb9ccae893b49ca1218a4c1fb61fc11290d859d75664b22c2b3af9a8decddcb58143cec9
SSDEEP 192:RRWJDbtbv7YvIPRpC+R2x89xHsb+WNnPCPKB2Km2pokwkVyIsnAUgE:RRWJntjkyXhDw6s2p2qAE
TLSH
T11442A52EAD60397F5CDAC62DF9217B53E7F5202160A12E84EBFC8A2C25E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 6e70010c7b80028370de21c6190e5c91c3373217661b6c8bc2396f17b9bbe2a8
MD5 87913ee04c115ad4d584a822b5165c00
SHA1 5238378943144dc17400da88d132777fa64947df
SHA512 30b4e2ed2610f58bc5bdf17de689f6da707b47348939925dd18cce4024a3fcc8b0dbe8e827db9e8780a7f4b621d9d495339d1e831ae3fd4a16ea96bf0a490170
SSDEEP 768:RpSK4+4F62Mqdou0a+1MKovQlz0G8VNdV46ODD8rVOa8UuUabkHLC:jSKZ32+wowG8VNdVcDysUuGLC
TLSH
T11A1302385D4ABDDD0DA1586AE0265D870498E2B32BA0FC4199CDFDBB084E4CFD773661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8eb56beeec0f394af6bedde195269f9e02a3fca2c41e6b9d4e3a933a83f65b97
MD5 1694c77e9a1ba4812b4a6d03d9acfac8
SHA1 f6c9daa9169f101f4c68bcc7544bde08065f5754
SHA512 7740d680cf12400d4ed1a89c90e2781f11a2f8c712432f495d282d16e6a08a05153854753fd59573bf119d41ed63006c5d5d5ef7b6878153cda31ca8f2da0a0f
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5T1hDcB6FGyvoD3EmwW+Tbv4v4a:fC0ESKkdDUDTDwBp4mwW+Tbvi
TLSH
T171A10835E8689CBB59FAD848B4532E43CEB4307BD462AE94F9DD0F0814E70EC1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 275dce1f633109694bfb09e994b6455a2cb870042dcb3ac24bb78d36213d047a
MD5 da967206095c81034fa4bd6930e64a23
SHA1 ecfd6b92580e08839b0e14c0aee28c7f602f5f88
SHA512 21d2a780ad491473c0aa687ec652f13c8c5b2a1ebafd0b3c68349bc3ca50dc8605363d8f4b5f2e23dee2de6dd894c16b93d996edac3c8216513250e8139f2378
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVrsbfSl8h4otop5T1cDcB6sGyvoD3EFH0p1QzbpXKZB3Bv:Dt0ESKkIiU2TowQp4FH0c43BWyULc
TLSH
T1C9C118B9AC6CECB759F6A9A1E4032A43CEB4207B9540AE94EADE0F0D11D70EC1342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 49c7e2d93ffd947300cda035574481dc5b20b85154723ff162f7fb309568c2a1
MD5 4c1da27f6b07e4ce37bb46bd8985bbcf
SHA1 252bc71b2b78d5fc2e7493048408a135a3aaa7b8
SHA512 03f2100e53351514a4d646d9aac88b9a8cd13a4cb81812ba864194130f753f8c1815651361d31531c1128c2f77dce94b43e2520733a54f66c3c1440e6a886916
SSDEEP 96:DC0d+7N0X7jVYVfGTVrsbfSl8h4otop5T1cDcB6sGyvoD3EFH0p1QzbpXKZB3BW2:DC0ESKkIiU2TowQp4FH0c43BWyULc
TLSH
T1F5C108B9AC6CECB759F6A9A1E4032A43CEB4217B9550AE94EADE0F0D11D70EC1342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download