hxxp://example[.]com

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://example.com
Sample260930-rl82esvcng

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5996	chrome.exe
5996	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 4928	5380	chrome.exe	88
PID 5380 wrote to memory of 2844	5380	chrome.exe	89
PID 5380 wrote to memory of 1044	5380	chrome.exe	92
PID 5380 wrote to memory of 1044	5380	chrome.exe	92
PID 5380 wrote to memory of 5256	5380	chrome.exe	93
PID 5380 wrote to memory of 2500	5380	chrome.exe	94
PID 5380 wrote to memory of 5256	5380	chrome.exe	93
PID 5380 wrote to memory of 2500	5380	chrome.exe	94
PID 5380 wrote to memory of 4604	5380	chrome.exe	90
PID 5380 wrote to memory of 4604	5380	chrome.exe	90
PID 5380 wrote to memory of 2364	5380	chrome.exe	95
PID 5380 wrote to memory of 2364	5380	chrome.exe	95
PID 5380 wrote to memory of 2788	5380	chrome.exe	96
PID 5380 wrote to memory of 2696	5380	chrome.exe	98
PID 5380 wrote to memory of 1652	5380	chrome.exe	97
PID 5380 wrote to memory of 2696	5380	chrome.exe	98
PID 5380 wrote to memory of 1652	5380	chrome.exe	97
PID 5380 wrote to memory of 432	5380	chrome.exe	102
PID 5380 wrote to memory of 432	5380	chrome.exe	102
PID 5380 wrote to memory of 2812	5380	chrome.exe	103
PID 5380 wrote to memory of 2812	5380	chrome.exe	103
PID 5380 wrote to memory of 4964	5380	chrome.exe	104
PID 5380 wrote to memory of 5700	5380	chrome.exe	105
PID 5380 wrote to memory of 4964	5380	chrome.exe	104
PID 5380 wrote to memory of 5700	5380	chrome.exe	105
PID 5380 wrote to memory of 5124	5380	chrome.exe	106
PID 5380 wrote to memory of 2964	5380	chrome.exe	107
PID 5380 wrote to memory of 5124	5380	chrome.exe	106
PID 5380 wrote to memory of 2964	5380	chrome.exe	107
PID 5380 wrote to memory of 4884	5380	chrome.exe	109
PID 5380 wrote to memory of 4500	5380	chrome.exe	110
PID 5380 wrote to memory of 4988	5380	chrome.exe	111
PID 5380 wrote to memory of 5996	5380	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://example.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbc390c728,0x7ffbc390c734,0x7ffbc390c740
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,11587192364014227281,5287439413242229254,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,5814263311672137493,9488827385182362829,262144 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,13577158002143432129,5613029132140129605,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,551406231457318039,6212922314319542257,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,11992940748947808186,5139028980438935389,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,6979696522058817670,3566593387258237532,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,1148508643753962893,15603540391346973541,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4376,i,17819129320115960681,14332739755140109231,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5640,i,8948083757629480763,8068213226698345612,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5924,i,4863800497138058837,17300159985602158261,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4976,i,1528889114568778271,7645799422060553160,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5112,i,6407616443999793598,16881314885079221903,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5932,i,11867212470555972431,4271815255591040697,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5788,i,7082912265386284729,10287336111742430530,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5492,i,10918719423178154039,2462737276265655425,2097152 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,17341337188683103855,16597864858823186080,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,11458382618849743772,18280130864473750641,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,1200249331732384631,2343767242388944140,524288 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5740,i,15079236154370963083,16368263302994437373,262144 --field-trial-handle=2044,i,17551482216597931479,4640062455459597673,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 af25413c9544c7e25172f2b3e816d1f51ee2c24b01a7eb7f74099878de07b113
MD5 e9153ddaf4691ea9784fd14c8321ea5b
SHA1 97c3154a78646ff4fec94ceea41bd995f71b4be4
SHA512 2578dc10ddb163dc8eaf6efcf0ded41c961599ac9ea25ac0372588ab1c27f643c95a154706db0d9445688ea992b4d884e3cdeb15dc2901b896a08031702d3e9f
TLSH
T114B011CAB8800A02E20003B028F0082333200EBC02A202A28EC8C0B0EC203B202CA282
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8da2fe2a3b796109eb1b708af7dbea2554cadb26b8dd4ecded1c94a5db484d0a
MD5 650800accbe1e5d3e474fd9fe1144084
SHA1 e215eb915b049f5009a6e5a324a670c92334a099
SHA512 21514b673c631558c186e39ac74ffd0721b481580a6fdc4a6f0168cb781cbb57ad467bd87d591b0290f5ea0c4881fc3d1e75c0a90f15a1f63225d8dadbb68b4e
TLSH
T183416BF7C3D89A7D890156F4AB15AF1FCE290A14531C3C66C8D8AE1B57E28B2D20065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4a6f2da0b8688691f3595a15ba49c2206af21aa18cfd21b265b1ecd346a54098
MD5 98104d73bd5439d998a33c63d0735503
SHA1 1f327333011d290219264b4f09f116174d24475b
SHA512 3e7de076a9ec0664484b95641435b1ab731ac3c95141160a6edd37dfc7fe85bf55908d2f3d055fa46d64dab0ab7dba51ee99a87962b02702b721998b16778517
SSDEEP 192:vRjDAY3mv7DvAPRp2Qj9bHsb+WNnw4jus2nSskwpCMVyIsnAUge:vRjDj3S/6XRBwDh2DJCoe
TLSH
T1DD32A42EEE50B57B8DDBC22AFA617797E6F1002160D42E84E6FC892C14E76CC7227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 313d123e4fb6ee0ea27d8a727ea0f3f7fea9875d64a9ec4be17ddaa198a30a8b
MD5 fd4cfbafe3ad1a02352a90f0e0566fb2
SHA1 1913506c434f486a545c5bdacb70bace7a41c12c
SHA512 8c1ddf4b56e3a586856aea683e7ae55430c8b86df81c2cb169b8d4aa428bc283e23908234775c46d016e9ea993f1ffbda82e09f7d4e0d38c2e7f976083090be7
SSDEEP 192:vRjDAY3mv7DvkPRpKQj9bHsb+WNnw4jus29SskwcCMVyIsnAUgE:vRjDj3S/eXFBwDh2N8CoE
TLSH
T17442B52EED50B57B9DDBC22AFA617796E6F1102260D02E88E7FC892C14E76CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2ceeaac034ec914811598673d3d1a4a8ea230053c7eb51e83decaa5ab91151e
MD5 7a735dea41e860c89c7b92fd3ea51888
SHA1 c284764af583a5e229dc3bbf1766010e8861e7fa
SHA512 e43054e613dee5c761e256cbe78787b806139eddb5b6e2b56d0d0b90227614e96a076218257df017aa165043f602e37d19717c0317ca79a9a4b84cb311941da9
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5U8DzB6vGyvQH4jYg0bblDv4a:qC0xJPz8/CkqDUDntfr4jYg0bb1
TLSH
T150A12931B86D8DB784B6D585B2432A03CF64B197E621AFC4B9ED1E1C14F71F81342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cad2ddb2d880359c1d4ce263f31e3302cae8f0ba7e3f68f163a68e62436e3459
MD5 7d28ac903c02f484de918c259729dfe4
SHA1 79506b3ac8071615ff0b9dc4885f896b9e8a4dec
SHA512 a13590ff81b1de1e0fa171fea03bbda4e1168758ba4ecfe0b42d6aec6d6f31723929ffd861ad8d87a72b2ec4c8a862f6cae0efd136e095647e4f68344e5d429a
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzHNVSl8h4otop5UdDzB67GyvQH4QXzJgqRNC39ISym:ot0xJPz8/CkJiU28tnr4QXzJgquCm5
TLSH
T1D5C1FA71A85D9CBB4CF2B485B1432903CEA5605BB914BE94FADE4E1C00E75EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0f7bbd054eb13ff531ba557812648e23bdf15786bca338ae96490c1b517564be
MD5 a079a3f007c011dbd9082c96eecb2ef2
SHA1 7087f7ca55922f652bf62742aa3f09017c3f72dc
SHA512 6089cdaaf5e899ffa93abd2467898e83f2e81486aff114aab93d67ae38e0578e3da7afdad1538aa5422002515145e04115c6ab29fa2be81ea5578006f9305136
SSDEEP 96:obJ0d+qJw6eq8Em6eifKcIzHNVSl8h4otop5UdDzB67GyvQH4Q8TBlIXnJgu0j9s:ot0xJPz8/CkJiU28tnr4Q8mnJguUUf
TLSH
T13CC11A7178BC9DB358F3E592B1433603CEA4615BA6149ED4ABDE0F1C04E71EC1746A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f7a4ccfd3e26188b990a6a9d56d0380322b0d2926a9c6ec365538b98e31cd935
MD5 18fec510bc3a3e4bb44df8611cf07c31
SHA1 3ca4127b1c61492aca4fb797de582bc0afad04a0
SHA512 d10691362198063f22a286f36d8935a91b0504e5f2d20262173b70a7fb9f6ebcc9c03e8ed5f9b623b0025f7da04a01d2a6e7c96387bd2f1e1527d6b0b1317c16
SSDEEP 96:oC0d+qJw6eq8Em6eifKcIzHNVSl8h4otop5UdDzB67GyvQH4Q8TBlIXnJgu0j9Il:oC0xJPz8/CkJiU28tnr4Q8mnJguUUf
TLSH
T1E9C11A7178BCADB358F3E592B1433603CEA46157AA149EC4ABDE0F1C04E71EC1346A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download