hxxp://corporate[.]hkjc[.]com/corporate/english/who-we-are/board-of-stewards[.]aspx

Resubmissions

30/09/2026, 17:54

260930-wg4y5astbs3

30/09/2026, 17:49

260930-wee7zsts2k3

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://corporate.hkjc.com/corporate/english/who-we-are/board-of-stewards.aspx
Sample260930-wee7zsts2k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2192	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 6056	5192	chrome.exe	88
PID 5192 wrote to memory of 2676	5192	chrome.exe	90
PID 5192 wrote to memory of 2676	5192	chrome.exe	90
PID 5192 wrote to memory of 2192	5192	chrome.exe	91
PID 5192 wrote to memory of 944	5192	chrome.exe	92
PID 5192 wrote to memory of 944	5192	chrome.exe	92
PID 5192 wrote to memory of 2476	5192	chrome.exe	94
PID 5192 wrote to memory of 2476	5192	chrome.exe	94
PID 5192 wrote to memory of 3656	5192	chrome.exe	95
PID 5192 wrote to memory of 3656	5192	chrome.exe	95
PID 5192 wrote to memory of 2728	5192	chrome.exe	96
PID 5192 wrote to memory of 2728	5192	chrome.exe	96
PID 5192 wrote to memory of 2196	5192	chrome.exe	97
PID 5192 wrote to memory of 2788	5192	chrome.exe	99
PID 5192 wrote to memory of 1304	5192	chrome.exe	100
PID 5192 wrote to memory of 2788	5192	chrome.exe	99
PID 5192 wrote to memory of 1304	5192	chrome.exe	100
PID 5192 wrote to memory of 4420	5192	chrome.exe	103
PID 5192 wrote to memory of 4420	5192	chrome.exe	103
PID 5192 wrote to memory of 4504	5192	chrome.exe	104
PID 5192 wrote to memory of 4504	5192	chrome.exe	104
PID 5192 wrote to memory of 4788	5192	chrome.exe	105
PID 5192 wrote to memory of 4788	5192	chrome.exe	105
PID 5192 wrote to memory of 1404	5192	chrome.exe	106
PID 5192 wrote to memory of 1404	5192	chrome.exe	106
PID 5192 wrote to memory of 5988	5192	chrome.exe	107
PID 5192 wrote to memory of 1964	5192	chrome.exe	108
PID 5192 wrote to memory of 5988	5192	chrome.exe	107
PID 5192 wrote to memory of 1964	5192	chrome.exe	108
PID 5192 wrote to memory of 1296	5192	chrome.exe	110
PID 5192 wrote to memory of 6132	5192	chrome.exe	111
PID 5192 wrote to memory of 4576	5192	chrome.exe	112
PID 5192 wrote to memory of 4260	5192	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://corporate.hkjc.com/corporate/english/who-we-are/board-of-stewards.aspx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbf6dfc728,0x7ffbf6dfc734,0x7ffbf6dfc740
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3098524877291768199,6743564121078716276,262144 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,1572530869738603382,18284904682281865003,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,10382384083839245554,11108261207410892326,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,5872595223415586855,5590187611379009746,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,7612512227438374283,7776278263644845922,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4644,i,7552584261491061088,16883636385572668660,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,12325857740876617140,5467810527303288126,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5516,i,6240407020183376525,5216780834895733916,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,12591336073588214394,3301515606034553784,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5844,i,18025455144751811157,13593191835535713734,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4896,i,1386127458612141035,2307625780044865700,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,14113929051447673708,977327323256192693,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5432,i,15739453758541345376,14542465452432369042,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5824,i,8563442839102112270,13319476314734910555,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5580,i,15771064983401479105,3173618277187101495,2097152 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,4575728314375531148,1508161787766272426,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,8041299940973912816,5339389819385240138,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,6207825633940085656,16145476782412063451,524288 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4876,i,10733823536051046118,17128570238915067532,262144 --field-trial-handle=1892,i,9944196374413062973,17165043394568812285,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 b3f3f00132adee9d4f80b53512eebb46fc444173e43d8a21a2e543d3de42a05e
MD5 49003278c9dbafb856340c997ec0b4e9
SHA1 7d1c305eac4d5a21780e9e20902106116d1ca9b0
SHA512 3398ae424cbf261235d1aa78881ce9613f5a44ce238a34658b2027846f0f6c50ca68449defe6df14b8883a602081b9a96a4a0a0dead069cfd707d7f534a01e5e
TLSH
T1A51147A4B5E86CC3CF47B0399CA1EC482E31FA6904A25B03CD5C2463FCA36FD4106795
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eaaad055b648d0b7a20162a282620232c5b4e8c2686fc3bd75fc728d69c308f6
MD5 41846ad218ccd03d9c0d145785d9fc6a
SHA1 85cc3475f2fd315a9bd5f9e6db85bf06ac8cf829
SHA512 c3ce09ab8d740f8745561a76b40bfe811a64c01191fc164d0ffd14fc19bd3a8a417f5d49c9193be188b7dcb1d0613ffed67297641987912a3926f8f7bff01e6d
TLSH
T1A3518DF7C3E4967D891156F4EA156F1BCE2E0914132C3C16C9D8AE1B93F28B1E14069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6bb60f2c52f1e6135f84ba8ecac25452e21174da379bd5e3ec34412c161abcf3
MD5 a58a25cfd5083d7e29c6ba413d080563
SHA1 d0a0c442bb60cc125c134c1669fd26f52751b356
SHA512 eea0ca838588d8d158d1b381b6818dbabc299ec4acbbae80c9a10d162e70e8b914c7d5d630785de5e42290f655d49615a7124b5db4541df5172b404f143ea878
TLSH
T103418AB7C3D89A7D894167F4AA116F1ACD2E0A18521D3C16C8D4AE1B53E2DB2D60029F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 63f8e98cf7c485bbe5898c590b1055a8f42419f4b39ff1262a64625cc154763c
MD5 6bb32469d5c67fc40a1b1271c9ef85af
SHA1 d5d8eabe515fc4b89e55974d6ed3012c4dd8abd1
SHA512 1893af3a90169531b0517078508392951f5e698aadfcd38b1b568b21b432eae6874db9036198345d918b0f8de8f3b24c0cfe06bc1a6f3229c187d54da524b980
SSDEEP 192:xBRmZyA4Uv7dvQPRpaTyZ9JHsb+WNnD0IBOeeI2qMkw6VyIsnAUgE:xBRmAnQpKXyuHwoben2faE
TLSH
T16D42C42DED60793BACDEC219F9617B53E7F4102161912E88EAFC893C25E76CC2227457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3765741e8c11a405f8df1caed28ec7687dcd12abd7b2ebecce2cec6a6dfb230
MD5 5267aedcc35f7fb75d213c1b52ed6e6c
SHA1 b8c721bd2eee7fe17a34bc2cb03add3909d8e2c5
SHA512 4c10aad612823ab21131a265238f835049417dff513db8a2e77477c580a9fcd2d235b5504eb35733dc556fdfa04d5974e5ba2caed790eb421b81febdf931c15b
SSDEEP 192:xBRmZyA4Uv7dvAPRp2TyZ9JHsb+WNnD0Izo2LI2qMkwjVyIsnAUgR:xBRmAnQp6X2uHwoD2k2flR
TLSH
T15532B429ED60793BACDFC21AF9617B53D7F5112121911E88EAFC893C25E3ACC2227457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ef7b169cc7aa207319b82f6ce5a50172a839961eab2685d9694ac7c86be655db
MD5 862e49ac54297b9181bd659bfcf7113b
SHA1 64204d014d02e4a28f9d6c9e8b80f18c7c60fe6e
SHA512 ac8f658837e096e285c57e8c70990e29ba9b7872afe84b36a4559b092d3efc9cf5e5738eed9aad5c3362129fbf9a40a297788528873d2b3eeef05e801722f73d
SSDEEP 96:NbJ0d+qw+CWJKhPPf36vdtkSl8h4otop5jvYDIB6LGyvr7jAixwzFWD2K9N0j9Iu:Nt0h2WJii4iU2ju8vqj9x7D2K9NUJ5
TLSH
T151C11AB2A46D6C779AF79641F4032D03CEF022AFA6156E54E6DA0E1800E72DD2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5692b077a1e1ccb40c2140034f97db494e4dbfe90d0a01f23505d8e3dc990b54
MD5 15083b31014f8361d5ae717073bff370
SHA1 5affdc3d7fa5329f195177252720b55530268ede
SHA512 45f11e32c7aefa0886ca86b71ece2f58408cf3ee883f4a45d49547c020d0d5804fe140b9aca8893c1034be970b261acd3967690ed8ac68d5fb4470d7b8ca6767
SSDEEP 96:NbJ0d+qw+CWJKhPPf36vdtkSl8h4otop5jvYDIB6LGyvr7jPcK9jRNC39ISyVNpw:Nt0h2WJii4iU2ju8vqjPcK9juCnw
TLSH
T157C108B1946C6C7B8EF6A985B0032D03CEB4226F69157E58F9ED0D0800E76DD6393A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9913eb31d9deb452d1ef12eb64c130752da97baeae4ba7ef835eaca5294bcf6a
MD5 f4b8f74c9e7c5a4e60668a4bbab82c4e
SHA1 c2b3146b117c55ce9f91f7fe43aa897956f479d5
SHA512 954c058d05ae7a4022bd74b6a2b3d3440b69e8618ae1e82c28442728c9a0f59b30a84bd6e0a753b7921031b56cf6093ed476ba091e6b2804fa8216cda38c23c9
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5jvsDIB6WGyvr7w79sbm3v4a:9C0h2WJiiniDUDj68aqw79sbC
TLSH
T120A1097294685C7B89B7C685B8832A07CEB0226FA521BF44D5DD1E0C11F72ED1393A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3820f7ec3e887a3ec78ed13230fb64c77aa28fa7438e6ca7be5b383c526cc203
MD5 88236ab3a4be0bb2172e5a1bc72b640b
SHA1 184c25d762ccb1c6319beb940055b209c1ad660f
SHA512 697a03df7a35171e68957be390dc88ccfeffea197cf24cc16854292dfa5bf9c1472c8d845ac369f638eae4550bf03379cc55b6c237af012937b6d47d10e0017f
SSDEEP 96:NC0d+qw+CWJKhPPf36vdtkSl8h4otop5jvYDIB6LGyvr7jAixwzFWF2K9N0j9I+5:NC0h2WJii4iU2ju8vqj9x7F2K9NUJ5
TLSH
T1A8C11BB2A46C6C779AF79641F4032D47CEF422AFA6157E54E6DA0E1800E71DD2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download