hxxps://mail[.]google[.]com/mail/u/0?ui=2&ik=c82c930709&attid=0[.]1&permmsgid=msg-f[:]1877695609467180224&th=1a0eea35569a14c0&view=att&disp=safe&realattid=f_mun2hqtn1&zw

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mail.google.com/mail/u/0?ui=2&ik=c82c930709&attid=0.1&permmsgid=msg-f:1877695609467180224&th=1a0eea35569a14c0&view=att&disp=safe&realattid=f_mun2hqtn1&zw
Sample260929-z84dfswtfx

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{B73073BA-7533-465C-9CE8-F243B2F6BC73}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe
Token: SeShutdownPrivilege	3236	chrome.exe
Token: SeCreatePagefilePrivilege	3236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe
3236	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 6116	3236	chrome.exe	87
PID 3236 wrote to memory of 4552	3236	chrome.exe	89
PID 3236 wrote to memory of 4956	3236	chrome.exe	90
PID 3236 wrote to memory of 4956	3236	chrome.exe	90
PID 3236 wrote to memory of 4184	3236	chrome.exe	93
PID 3236 wrote to memory of 4184	3236	chrome.exe	93
PID 3236 wrote to memory of 4868	3236	chrome.exe	94
PID 3236 wrote to memory of 4868	3236	chrome.exe	94
PID 3236 wrote to memory of 1336	3236	chrome.exe	92
PID 3236 wrote to memory of 1336	3236	chrome.exe	92
PID 3236 wrote to memory of 1500	3236	chrome.exe	95
PID 3236 wrote to memory of 1500	3236	chrome.exe	95
PID 3236 wrote to memory of 1096	3236	chrome.exe	98
PID 3236 wrote to memory of 3276	3236	chrome.exe	99
PID 3236 wrote to memory of 1096	3236	chrome.exe	98
PID 3236 wrote to memory of 2924	3236	chrome.exe	100
PID 3236 wrote to memory of 3184	3236	chrome.exe	102
PID 3236 wrote to memory of 3184	3236	chrome.exe	102
PID 3236 wrote to memory of 5300	3236	chrome.exe	103
PID 3236 wrote to memory of 5300	3236	chrome.exe	103
PID 3236 wrote to memory of 4264	3236	chrome.exe	104
PID 3236 wrote to memory of 4264	3236	chrome.exe	104
PID 3236 wrote to memory of 2804	3236	chrome.exe	105
PID 3236 wrote to memory of 2804	3236	chrome.exe	105
PID 3236 wrote to memory of 3848	3236	chrome.exe	106
PID 3236 wrote to memory of 3848	3236	chrome.exe	106
PID 3236 wrote to memory of 2776	3236	chrome.exe	107
PID 3236 wrote to memory of 2776	3236	chrome.exe	107
PID 3236 wrote to memory of 824	3236	chrome.exe	108
PID 3236 wrote to memory of 2596	3236	chrome.exe	109
PID 3236 wrote to memory of 824	3236	chrome.exe	108
PID 3236 wrote to memory of 2596	3236	chrome.exe	109
PID 3236 wrote to memory of 2944	3236	chrome.exe	111
PID 3236 wrote to memory of 2164	3236	chrome.exe	112
PID 3236 wrote to memory of 4052	3236	chrome.exe	113
PID 3236 wrote to memory of 4076	3236	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mail.google.com/mail/u/0?ui=2&ik=c82c930709&attid=0.1&permmsgid=msg-f:1877695609467180224&th=1a0eea35569a14c0&view=att&disp=safe&realattid=f_mun2hqtn1&zw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff4509c728,0x7fff4509c734,0x7fff4509c740
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,17655526292866488346,1865488080682265332,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,3445131750544389651,2853879924286771103,262144 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,15903486549610525378,7517189858560432650,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,18098163696938415858,16789614518323383453,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,415899250506138882,5252540348352297902,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4752,i,10612892903425865527,4512864469942198319,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,16764412071808743980,1395149740450889417,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:12
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,14927121105193943677,17830270121301834356,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,11486972756298643874,140996879513118149,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6100,i,6421951544921286497,18151120766233841302,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6120,i,18002897503014280341,12613894175068772339,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6408,i,5293163650546602988,14029553991552355559,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,5550318840284692742,2169934266623276613,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6116,i,3182129882993329710,18368881612103214095,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5372,i,9874480825671777592,7504422046954353515,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6568,i,11806245493717691825,2334799080752793927,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5576,i,6708552538011927410,11123755831876965067,2097152 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,4718690297776597901,9235754586917711111,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,5984597919343734534,1354097516349124786,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,2832221146972796475,6611568420425786177,524288 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4712,i,8814817795066682149,13472725774070518797,262144 --field-trial-handle=1980,i,2084385102456281015,8798469996217962871,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5cdefebb-88ed-4a35-92b6-8eb501f8131b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5cdefebb-88ed-4a35-92b6-8eb501f8131b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 148ee53b6107571034bbee6b31a93b6e103acd21f83eda55824435f8b79042e2
MD5 20c33a5dda6e3e03fe6c96e28fbe3ce3
SHA1 0b7bf345390faef4d1ca60c3b0c426f399e92ebe
SHA512 856e19778537fdffeb82c8d4e021f19c3e36507dfba47408a82488b6e2a2e17cd76c64e986fac9c856010332b262f6b2f25d2a9bc54b49c0abd7f94b6cd137bf
TLSH
T1D4E05E802B554709C7273F33226689812E56569D53AE234283EB4178FE46AB4A22E4BE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f27559c92f1fbf00c5b978d5ece4a85ffe5ddad3bb5ae00087aee2f7f728a922
MD5 719197a61031acca1edf27979d722307
SHA1 37fa0f6e89146ca6ba4670362029db41d3072f4a
SHA512 a3d5288fb21a34327aa4cd1ac24dda3e52680d73ff9f1edfa96d5a0355aa7def4e37cb5ccb15470cc24baf35880e902a19d726ed69177223ce3f91528341f08d
SSDEEP 48:YALlh9nhb9hDyhXh4s1RszfoKsSfs4dVosY1ts9/qzsQ2NsFcsa4sYXLscFsV3a:DDR949DUxtdVoqw2KmYt6K
TLSH
T113817CF7C3D8853D895156F4E7166F1FCE2E0A28532C3C26C8D8AE5B93E2871D21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e4301256a21b550ccd5f648d7ec5aaadce8b3aae1089cba54d13c327ec50ef88
MD5 ed1e74c0299f8d2403b528fbfea0c7c7
SHA1 1aeb476cc6375fec330b92243b082ed21653138e
SHA512 00aa0ee824aeca8cb5bcc15cdd3f4f0633046dc15d404a4c38bc3b82660921a208c4cc611866c0d47759ba0a4aca6be00ceb35c55c84090b4679d32ff0c935a6
SSDEEP 48:YALlh9nhb9hDyhXh4s1RszfoKsSfs4osY1ts9/qzsQ2NsFZVosG4sT+suFs0fqsk:DDR949DUxtoqw2KZV2TwDm/
TLSH
T148919CF7C3D8863D895156F4E7166F1FCE2E0A28532C3C66C8D8AE5B93E2871D21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fc618156c01332216fc906ba0e8891b630547ebfefad72cf0b6f914f1cd98b47
MD5 4a2f2a8d354a65b350e00d3fba4565b4
SHA1 527940108a69e6d8f4e12bcf3b3407d0b85fb7f9
SHA512 3716db39273517137d70a820c157f5e70912de52a99687aeb6b5044dd785d84d1a6207a94444016c3be8f4262ed6276a09210f64a2861c9dd3c41c8df4befede
SSDEEP 192:gRwHulAxv7PvAPRp2Kk0Xsb+WNn5MQlK2/1sLERkw/iyIsnAUge:gRwHuShb6XPXwCD26Aqe
TLSH
T19032B32DED24B57B9DDAC22AFE267717E6F5102134A02E84E6FD892C15E79CC621B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5b068e273cfe9ea0849e31fb43c489c19c0b155d375de28bb9b2b455e0b8c25b
MD5 c20252e44139fa3236f6ed7401d9a1fa
SHA1 fe43683ce45da9838683d3c7bd08f7c5d4dda07d
SHA512 2e8993c48c6fbfaf15c5092e5ea5111220a6479adcc3301d42fe3fb779dd62feb530d9cdd516558a1e80374ce97518fedfd49f21a08514232f2b7ff68f59a274
SSDEEP 192:gRwHulAxv7PvaPRpwKk0Xsb+WNn5MQlK2S1sLERkwyiyIsnAUgE:gRwHuShb0X1XwCD2TALE
TLSH
T18842C32EED10B57B9CDAD21AFE267B17E3F5103124A02E88E6FD892C15E79CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b38125f51fbf626486234ec0b0cd5764b2ccf0df3bb25cf01474edba74c02aa8
MD5 70addd045a79fbdb616212e5f4fa1017
SHA1 504684b288318a1597cf8c529a07b81c635ba1c1
SHA512 edefe13ebb0f1da53afbc097d29cfbb9f99dce6cba5c731bd68742d9635fd61b01a01cb0b5bf990aebcfb2299539e835ac0f99d55362e5955b4f67ef06a93a88
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUddYSl8h4otop5wpVD9B6RGyvtehWtRkdopH:At0oWqNVVxi+9oPMiU2OdjNthWtGdO11
TLSH
T177C1E871A86D996B4DF2A486B0032D538DB820AB6969BF58FDEA5E1C00E34DC0343667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3638dd6dd8172afd61c355aaee9fa539091c7e856b72e2df6d40898b589d4cf0
MD5 c6b706b4ee40cfe1ffb9136f4de39505
SHA1 a7f3cf447a4bd82253bd1981af6e8095043ae627
SHA512 6cabf7a2cef02b4b4d934f738e21a329ba3c2894b0a579ede7b106bc2c9e942d72fcfdba0bd42ba04a4f8ae3a20dd2a8629d955009d2061a240c87d1026b9325
SSDEEP 96:AC0d+TWqN/K890wxi+9M7fX3urjUddYSl8h4otop5wpVD9B6RGyvteer5AugWtb6:AC0oWqNVVxi+9oPMiU2OdjNtMgWtwdOG
TLSH
T1E0C12A30B86DA8B799E3D556B4072D53CEB860BB66659FA4EDEA0F1C01F30AC1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 50caf75e04d1f57fbc342480d5eb4639ffc32ea95c2e60a5e45780125f6bec52
MD5 56fb8e5a0e2e69f18a62f9851d23fee6
SHA1 db53cd80c0f87fd74af84ea3bf9b8142d8d93264
SHA512 3d9a78e432fc3f0385e8048e5f5dd61288dacd382322be4f5d93c223e95f463b9caf8fafc48a9994cfd4a77eccfb7c5972376c9cb0d038280f761fc31d531ec3
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5wp0cD9B6vGyvtBWG0cop3bOv4a:CC0oWqNVVxi+9oP8DUDO0KjDeW9cO3bQ
TLSH
T112A11A31A87999B789F6D585B1472E53CFB970ABA521DFD4E8EE1D1C20B30AC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 25d59d33e59fcbac5842bcf4fbe2f07032ec252b5ed3fba786ac087cffbb56dd
MD5 8d6ded3d50aadd1c37f0d4434e38d465
SHA1 5e27dbbad5f776442686530df3d6f94783f7af8c
SHA512 5f168d4f48c85b3a91123a511a674ab9c003921035c16836d0885884ef3ddd1b93948c171ea4578514dcc47ccf8583e3d87858fd5b60fcd53cc98422bbfe0ba4
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUddYSl8h4otop5wpVD9B6RGyvteer5AugWte:At0oWqNVVxi+9oPMiU2OdjNtMgWtwdOG
TLSH
T134C12A30B86DA8B799E3D556B4073953CEB460AB55659FA4EDEA0F1C01F30AC1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download