hxxp://Google[.]com

Analysis

max time kernel
899s
max time network
890s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample260925-rtb2nayale

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
5084	chrome.exe
5084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 5600	3932	chrome.exe	88
PID 3932 wrote to memory of 5276	3932	chrome.exe	90
PID 3932 wrote to memory of 5276	3932	chrome.exe	90
PID 3932 wrote to memory of 3336	3932	chrome.exe	91
PID 3932 wrote to memory of 1312	3932	chrome.exe	93
PID 3932 wrote to memory of 1312	3932	chrome.exe	93
PID 3932 wrote to memory of 1528	3932	chrome.exe	94
PID 3932 wrote to memory of 1344	3932	chrome.exe	95
PID 3932 wrote to memory of 1528	3932	chrome.exe	94
PID 3932 wrote to memory of 1344	3932	chrome.exe	95
PID 3932 wrote to memory of 204	3932	chrome.exe	96
PID 3932 wrote to memory of 204	3932	chrome.exe	96
PID 3932 wrote to memory of 4252	3932	chrome.exe	97
PID 3932 wrote to memory of 5964	3932	chrome.exe	99
PID 3932 wrote to memory of 1896	3932	chrome.exe	100
PID 3932 wrote to memory of 5964	3932	chrome.exe	99
PID 3932 wrote to memory of 1896	3932	chrome.exe	100
PID 3932 wrote to memory of 5972	3932	chrome.exe	103
PID 3932 wrote to memory of 4860	3932	chrome.exe	104
PID 3932 wrote to memory of 5972	3932	chrome.exe	103
PID 3932 wrote to memory of 4860	3932	chrome.exe	104
PID 3932 wrote to memory of 2532	3932	chrome.exe	106
PID 3932 wrote to memory of 5144	3932	chrome.exe	105
PID 3932 wrote to memory of 2532	3932	chrome.exe	106
PID 3932 wrote to memory of 5144	3932	chrome.exe	105
PID 3932 wrote to memory of 2772	3932	chrome.exe	107
PID 3932 wrote to memory of 2772	3932	chrome.exe	107
PID 3932 wrote to memory of 5812	3932	chrome.exe	109
PID 3932 wrote to memory of 5852	3932	chrome.exe	110
PID 3932 wrote to memory of 6112	3932	chrome.exe	111
PID 3932 wrote to memory of 5084	3932	chrome.exe	112
PID 3932 wrote to memory of 3520	3932	chrome.exe	113
PID 3932 wrote to memory of 3520	3932	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc42cac728,0x7ffc42cac734,0x7ffc42cac740
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,2410875349128346547,1372345245496106135,262144 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,2659715058502273526,5214983131588352461,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,14605879963002776315,4574652431098799560,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,7015827771882914412,5883499377455947790,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,5352920486269621312,317777211648099277,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,4923352589251986184,4818327958648101642,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,11159011149208116125,8594722299798847650,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5252,i,11493565516780577061,9935895734192699070,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5264,i,134429431655299539,5323425602905621329,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5452,i,1225307043998787279,16202913578985260992,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5256,i,8190552726907467026,4321432542127721498,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5308,i,10922294846284724736,10082152200433287844,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,12645836791454931574,16017788082394950759,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5384,i,15637820314841855201,8825694697457926059,2097152 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,6756570520267619390,12989206710570670293,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,16101020035970079889,10484036248814510028,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,11839493106799259565,9049102100161690534,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5712,i,8865327771818629677,7245524250962414844,262144 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3048,i,7142453648309354083,9556910635690850002,524288 --field-trial-handle=1888,i,17216042458572295248,7708720882120196819,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:3520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4556

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 89b1cf445893f3d4cd140ffe5786ed13fce167551c8f160e7b53349c411abb7e
MD5 efb0209a9c0b3f6ffe5b3523c5039abc
SHA1 200f1ed0214377160125b76bae90691a2bbfea8a
SHA512 5c4d37d4abe598c8d604cc93d564cc24344849e2cdb50e4302206d6a0e7b6c3409c38f8ecdb11c49b5f7eec9db974f7e722fafdd2af4aecb921424c0f8a3ae73
TLSH
T1FEF0F4A9C934EC3B18FC1B1920685647F75517272B905A4B3A3D820C4FB563B419681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 2fe40d637f6e9f82de65d9c56caff460fe1c73d4b7b74e23a8703afd293eee32
MD5 cf8aacfebdb54a77d6b930062e4ffcac
SHA1 ab1bf490824636d85f12794df1d7104e645a1147
SHA512 5289a5319f482a2e0778855489ff4431a6392ea17d6194fb313511b0baa18bdd18b08b67909551c201bfd52e049f6e19d1d18ce1c430bcad4859600d1bd68df4
TLSH
T163D0A7591A00751FFB463B72B8E09C632B3C059F0167639FC0E9143544875758C85845
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fc402529c10ac0f1e0e7df1c83e9fcd3f999d65d91c88d9133926a939dc8668a
MD5 625a44cbb9b755abf151b19bc9b3043d
SHA1 4e630c77bf79136af290a4184e1acc49f251bfcf
SHA512 c46f8242e6ce414185fc6fe9e7d9ac0f0c0e505005254ea01b8582dcb319ffb543ea36512c0b64cd1d2fe8bc74bc5cca4746f84ca2eaf29a1884febd49b5b2a3
SSDEEP 48:YALlhehxhUh8hAhPNhc3s5RsgXLsQfoKsOfsposjtsRBshcsRqzsRYFs74sp+sQO:Dg32qm5N+Y/Z14TO6tKopGfW
TLSH
T12CA191F7C3D8862D880156F8DB15AF1FCE2D0A18832C3C66C8D9AE5B93E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f66635376de81cae44962ab7492b0808bcbc5984c6b796bdafbb1f61d473ffe4
MD5 d84a27acaf60b5a3bb44eac645936428
SHA1 dab1bd35de42b4926c771bd46a309bb5ab516714
SHA512 73c7cde0a2551e7d6474c8c05b9f92ba6634f425a030a25c544aeb128b787de26ec0cbf42678559897c8b5035fdf69bb0c3de842471c2e99127e299b6dffa301
TLSH
T105817CF7C3E8862D890156F4DB15AF1FCE290628432C3C76C8D8AE1B93E2472D21575E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c5cd409f72ce6b682275e0c274cdb86980e7ae02304b236ae71df82bf146a764
MD5 2aff2a2bb0668a6d9aab73e12a2ed3bc
SHA1 9cf874d95aaed063ab8c136068c26b5f54460c52
SHA512 cd6e1ff4cf3d470800c6dff39ab3b61d3a2e3a44268bf51bb0d1e8940c36f6072f179682cce2b0f118f0cdb57204a940d719a0b6690726d001dbe49c64fb6ee1
SSDEEP 48:YALlhYhfhbhXhAhzNhc3s5RsgXLsQfoKsOfsposjuqcsRqgmNrsCqs2J3a:Dittxm1N+Y/Z14TuqttmNfiK
TLSH
T164816DF7C3E8862D890156F4D715AF1FCE290A28432C3C76C8D8AE5B93E2872D25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fab654a605b899ef96cfe4237080926b4233906f9ace13f3fa07b3f760d7e43f
MD5 3ba4f2ed6bb79e8d565c4e161a301c0c
SHA1 f5f68ab06703e6cd4e66462a690a71d2feffdbcb
SHA512 6e2f9bff4ee1920cfb09b8fd76845b1227c3ac7a960c72922064cb57fa2748e263bc25a5f45c90757b37afd8a8b1e12d7c7378a541f9b82d92cf4c6f9e1a6ac9
SSDEEP 48:YALlhehxhUh8hAhPAs5RsgXLsQfoKsOfsposjtsRBshcsRqzsRYFs74sX+sYrsPW:Dg32qm5h/Z14TO6tKoXyaW
TLSH
T112A1B1F7C3D8862D880156F8EB15AF1FCE2D0A18831C3C26C8D8AF5B93E2971D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 448b7972b4cbf4e7e96cdf0e2e18f9efbf0a08ac871d24b2fff65e56ef916836
MD5 c5e209759e3311624932c5c6350f0e81
SHA1 43df5580e54c98d5a547a294595b24a8e47f6e7e
SHA512 475f28efdd5a16222b0b634a690e8f07f66b22a21246e051cc988168b1d54342bb3ef9242bf7c157e416076c66e77b22e27a283ca3f0583fe0a4e241ea5dd2fe
SSDEEP 48:YALlhehxhUh8h3s5RsgXLsQfoKsOfsposWrsjtsRBshcsRqzsRYFs74s+z3a:Dg32qK/Z14GCO6tKo+zK
TLSH
T1899180F7C3D8852D890156F8E715AF1FCE2E0A18831D3C26C8D8AE5B93E2971D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4f2ba066993d0ab17bb015ebce249dc30ead7eb40795e19c6b565a16a640d989
MD5 494accce450446a7e7218ec0871eb2c5
SHA1 94de14af322cea6f714fbaad450907a686c1932b
SHA512 7f1920470ff9982e478c176f53d895b64673345c707569276d0c0fda110fd40410176e6adea5b0aceb92cb538e933d2ec758bb9bdbdb25288936b2b8782a7ee5
TLSH
T166F09EA7E77EB46750B9C6BB1D00B88A2CB5E835028274F4CEAB827DE0855F71B02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2662ab253ad30543a3566c26b94d12bd27c7f01220346cf042591b7c0f823e08
MD5 2b138d05613778db7cb23868ed43631e
SHA1 c349e4f1f9c54e7493d2bace8f8c1b8a47dc7f0b
SHA512 17d31997a847ed3390977d3181a7a0e3117c6ffccba76216ad11bb9ab6aa77c07500d2f5b2b47d70bfb4ef35b7ef51401eeebe8b94cef2df2321065350962d2f
SSDEEP 192:SR+XnrlCv7AvAPRp2uWJ9THsb+WNnUMZwW2Zu2qeE0+VyIsnAUge:SR+XrlOs6X+9wHf2Q292e
TLSH
T14142A32EAD20793F5CDAC229F9657B57E2FA103125D52E84E7FC892C21E75DC222B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15bcc8708526dc07fa2a8d90c78085070166d84a99418c6300893ab68a408b1a
MD5 9222361b7bad9a8f0c274648779c8037
SHA1 77fec97c38f096a3401a823fff0a1abc039cb323
SHA512 dc600fff5af9c1c0d239b3a5604a411aca3e02d6eaf2806b7754171e710e5a0f9440e847cf14a0a20dd1a6a393aafe345c40af7979a3888ac3c5493c43104b3d
SSDEEP 192:SR+XnrlCv7AvIPRpyuWJ9THsb+WNnUMZwW29u2qeEE+VyIsnAUgE:SR+XrlOsCX69wHf2M2H2E
TLSH
T19A42B42EED20793B9CDAC259F9657B57E2F9103125D02E84E7FC8A2C21E75DC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 61abad0b9ab114a83375fba12357383f0f44f5a04f064051f660c3b759e7ff35
MD5 ccc952b560b4c98ab5765662578e33ba
SHA1 ef2e23b8fe46fb30215fd6971284c9142442448a
SHA512 4eafe8851407d21272dd2a634f7350b1cd5cf2126cbedb8d74ffcada3d56fa8feddb3decff3d35a4e5e06066422427d4966f6e3319faecca9759402da6fbe98a
SSDEEP 192:eYX4K64y7KxkXqK4I40pUZNCgVLHrKHfFKslE2gOXzKD/XW+ErUkKN9cXcYxSgLu:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOe
TLSH
T1E932EA17A48D9E3F0FE8E51DCC426F8B7CB5016227784D24A2FB5C0803A97CA115A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ffd419f025dfce8_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\9ffd419f025dfce8_0
Size 193KB
SHA256 0831a28802ac1cc8ad8da53601189689075e4d557160c170e46d3504158a92f6
MD5 05cb1d76edc3f2bf09b54e77aad3a9f2
SHA1 e5ab60fad3311d0d9b8d66648c877ed1dd3c50de
SHA512 7d5b2f2b1f4b981578972c7c21e0c70a1b3d9e5ceea2f0875ee266393fc48f5edf56d4675ab1c6f0f8df091ff041f8d6367cf4261ec6af8ef34067c24e87a005
SSDEEP 1536:yoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:brFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T155145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 70388ea96a03e55b9c6a48dbd390b124a8569fd3322cb2b52a8fea6706e4c857
MD5 1560155da6dacb8ccf6c7eb8b1219b6c
SHA1 f42c029af961f23ede92c3755bb02691957f1ce5
SHA512 fd2b595319e8d99b45c65dadf54d7a01e8fc87b2ba8d76ea36ba663ecb3008d39c2bfaafa43af2233139e0eeaf7820ab853cfb3cbe8bfcb082516e0071c6a521
TLSH
T1ACA0021A01C05D5BCD000BB02491038023708B557E65E2079DB0A1CCD992581911112C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1ce7e07e26bf6f22882938fbb4343056a2fd2f051806b1672d229e07288d78c1
MD5 afe7a1c07afcdb5e10ce6db08497193a
SHA1 f441eb423f460fbf3d9c447bd165414f59f987f2
SHA512 2d7bd93c5fc9480d87852deab463909f74aba04501d3e3114491c0ead58263e6c0bde25416096fe95810a2d06c5af20831c6589d494d7756970a3cf98f00b1d5
SSDEEP 96:pbJ0d+U7D/u1i5WFtfvuvTgxwjHSl8h4otop5XqDUDB66GyvutK2UWaMtRNC39IO:pt0z7q134vliU28ca7K2UWaMtuCDS
TLSH
T17DC11874986C9C7B89F6A485B1032D47CDB822AF6908BE58EDE91F1D01D79EC1343A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a0a6f21aa8098f377ab498505d2654429a2280baaf89fd437b45a41a5c373922
MD5 2e33b5ceb9457a128af3fd0e0ac09900
SHA1 f81643b3bbe92198e80b9f44ebfa06e9a891ff35
SHA512 289f39f6b88062203533320f327b75a830e3504d0c9d308dbee6118ce9f536fdf41ae4867ed730f0b429f749561b2d2e77320868caba2a0d697fd62530ba9ff7
SSDEEP 96:pbJ0d+U7D/u1i5WFtfvuvTgxwjHSl8h4otop5XqDUDB66GyvutKRevO0Ao9GUAaH:pt0z7q134vliU28ca7KR2AUAaMsULg
TLSH
T151C10A70986D68B785FBD585F1032947CEF462AFA805AE90D9E90F1D01D75FC2343A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 02fe9c60508de245822e6772f06f49ed8d79c85eddadb2f91b9b86ed3b006715
MD5 f59e4368dfd715bbfa0f1fd476b2f37f
SHA1 3cbf16817d1dc48ecfb31b26be87d144444785db
SHA512 3fffd2c5eb9615693130c6b049e0b4b12db836d99b15faee7dece0194ce055e851b089be8c0d03f2b17eacd5ebbdc6032743e749892d97b83852a91e4d9bd722
SSDEEP 96:pbJod+U7D/u1i5WFtfvuvTgxwjHSl8h4otop5XqDUDB66GyvutK2UWaMtRNC39IO:ptoz7q134vliU28ca7K2UWaMtuCDS
TLSH
T1A0C11970986C9C7B89F6A445B1032D43CDB822AFA9087E58EDE91F0D01D75EC1383937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 df83d20d53f1b5dc7e632dd87618031b7f4bb6714566ae5b0204f1f8b277a042
MD5 b6014e421af229add2ae5fd65caeec9a
SHA1 bd48e3834e97873d3badf686e2f342c40cae51f5
SHA512 d2eed998ded169bc664a052c7ec11b09db026b7aa0c94decc568da4d294a22c687e6cd3fc39bb5523af916142c19092e22607a6f34919127225c9940e71a5ec6
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5XHDUDB6jGyvutFDLMmbYLsv4a:pC0z7q134vtDUDTcf7FDLMmbY6
TLSH
T102A12A70E87C99BB857AC485F5422A47CEB422BFA901BF84D8DD1B1D11EB1FC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fbef88501e6a43c81b0ba84cff0b7c51fa453c288fbb391e5dfb6df9e33e3703
MD5 f26b6446cfbc0747aa3abb70cd0965e8
SHA1 de4dba18533b4a1decbc5df3ac8d3013483bb259
SHA512 404e9dd5d9343d89dae9246d99559af16fa9591d9f82fdcc5906de52da88f1459d3dd695ec35451e8ce1b63891346ad57cf8762c2c8da902979a94256c5a6165
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTgxwjHSl8h4otop5XqDUDB66GyvutKRevO0Ao9GUAaMo:pC0z7q134vliU28ca7KR2AUAaMsULg
TLSH
T109C10970986D68B786FAD545F1032947CEF462AFA805AE90D9E90F1D01D71FC234392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download