e67cc89f239f249f05c3a77c8490898b8204973e84d5d235ced2abad094c6fbd

Analysis

user interaction
yes
max time kernel
899s
max time network
896s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Universal-Intel-WiFi-BT-Updater.html
Size 677KB
Sample261024-c83etswx5r
SHA256 e67cc89f239f249f05c3a77c8490898b8204973e84d5d235ced2abad094c6fbd
MD5 1cb774c1a0542f6e67fc4728abe13d16
SHA1 0cee2673823db8f79bf85e4359f262b7980d64d2
SHA512 97324701f0a894b8de088a9ca78d9e34d0bf7703b9546322979eccbceb1fa7da96f11ec928dbd70143f199e3597b463cf8ccd6e0ebfda2572cdd47943d5d585c
SSDEEP 12288:6UM/6FT+8DMN3NpXoghjs5GtFbNN2HWxN/mYgEBojRF7fAMZGJN5xblvquUQa24o:6UUR
TLSH
T150E4DAE5A3A5916E19074659FC32FA5CF34E719ABB2784A2CC3FC2B5C2C3854E353258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	camo.githubusercontent.com
26	raw.githubusercontent.com
4	raw.githubusercontent.com
20	camo.githubusercontent.com
24	camo.githubusercontent.com
25	camo.githubusercontent.com
1	camo.githubusercontent.com
21	camo.githubusercontent.com
22	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2892	chrome.exe
2892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5124	2484	chrome.exe	90
PID 2484 wrote to memory of 1352	2484	chrome.exe	93
PID 2484 wrote to memory of 2780	2484	chrome.exe	92
PID 2484 wrote to memory of 1352	2484	chrome.exe	93
PID 2484 wrote to memory of 1688	2484	chrome.exe	94
PID 2484 wrote to memory of 1084	2484	chrome.exe	95
PID 2484 wrote to memory of 1688	2484	chrome.exe	94
PID 2484 wrote to memory of 6016	2484	chrome.exe	96
PID 2484 wrote to memory of 1084	2484	chrome.exe	95
PID 2484 wrote to memory of 6016	2484	chrome.exe	96
PID 2484 wrote to memory of 5164	2484	chrome.exe	97
PID 2484 wrote to memory of 4128	2484	chrome.exe	99
PID 2484 wrote to memory of 1036	2484	chrome.exe	100
PID 2484 wrote to memory of 4128	2484	chrome.exe	99
PID 2484 wrote to memory of 1036	2484	chrome.exe	100
PID 2484 wrote to memory of 4580	2484	chrome.exe	103
PID 2484 wrote to memory of 2980	2484	chrome.exe	104
PID 2484 wrote to memory of 4580	2484	chrome.exe	103
PID 2484 wrote to memory of 2980	2484	chrome.exe	104
PID 2484 wrote to memory of 5756	2484	chrome.exe	105
PID 2484 wrote to memory of 2904	2484	chrome.exe	106
PID 2484 wrote to memory of 5756	2484	chrome.exe	105
PID 2484 wrote to memory of 2904	2484	chrome.exe	106
PID 2484 wrote to memory of 1996	2484	chrome.exe	107
PID 2484 wrote to memory of 1996	2484	chrome.exe	107
PID 2484 wrote to memory of 2196	2484	chrome.exe	108
PID 2484 wrote to memory of 2196	2484	chrome.exe	108
PID 2484 wrote to memory of 2292	2484	chrome.exe	110
PID 2484 wrote to memory of 684	2484	chrome.exe	111
PID 2484 wrote to memory of 2412	2484	chrome.exe	112
PID 2484 wrote to memory of 2892	2484	chrome.exe	113
PID 2484 wrote to memory of 4228	2484	chrome.exe	114
PID 2484 wrote to memory of 4228	2484	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Universal-Intel-WiFi-BT-Updater.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd6989c728,0x7ffd6989c734,0x7ffd6989c740
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,13596669833029287973,5101406018477275782,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,14631488408344692022,14745575329768424798,262144 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,3839188351168928216,9605044357617891919,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,11727078768332622790,13481350933890494392,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,16190782452354417099,4089453415055293954,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,16566588848376682388,6821037926966871093,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5696,i,3744288748070949369,9101509851227500560,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5736,i,14986450630314723005,18265405297546117349,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,8309813877912415795,7407983185680477578,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5832,i,3011723116508817696,6470932966836257119,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5104,i,5429042447757011987,6220321562666720838,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5624,i,439225151351041909,15829943633974479328,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,13380427267325234831,11187025424195608255,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5776,i,6054242234926116754,15589786237875561795,2097152 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,16719156829388499705,11716534024264634695,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3216,i,9273292239628992267,1022980177843978338,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,17380954398133790354,7443647213995496677,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5976,i,12788376859312215716,12203652897270274480,262144 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3972,i,10130049839783773351,8959135500175287720,524288 --field-trial-handle=2000,i,17462929937236272891,194783453630946442,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
  2⤵
  PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2972

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

246c4df6-7553-49ad-88ab-b1e35e55d01c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\246c4df6-7553-49ad-88ab-b1e35e55d01c.tmp
Size 5KB
SHA256 cb1a857f6c817d40284089836869b93077f148be7792a51daf77662fba19e0d7
MD5 199a3f354d9abb1d5dc230fae072ee31
SHA1 c330acf1116e30054886c80f269530ab7f75c900
SHA512 065a16a74fcefd8100610cc366a324e455aa8445316c2df2084b7b257943e9e99a794f88c2373ee861ae58f32155d6b34e9e3f7a0359ecf5a44b7c95307d10f3
SSDEEP 96:eYC0d+pK242KafJf1Ob5NSl8h4otop5ezD/B6qGyv+msQxwzmRFbB6X2Qc50j9Iz:PC0bt8OdiU26JS0HxbR36X2Qc5UJE
TLSH
T195C12A71B8BC587359F2D550B1023E87CEF422D756619F94EEDE8E2800E71F81382612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b92a4e1-501e-4bcc-9b10-a7557bbcf87f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2b92a4e1-501e-4bcc-9b10-a7557bbcf87f.tmp
Size 5KB
SHA256 afa19e3a4f96d1d5a8f8ec7e2caeea6525000c5ea7b09a1862e75620402af13b
MD5 e33a75bd620d6e72aa91b17a640e4e72
SHA1 0f074624e214f363666c98a5faa7eddb015a9853
SHA512 04d6f7af78c4e69c7661dca9c6687689d3ae0c19c3712995459bd298d5f231a2331a84e91ea1a2e325cbc946dd0f94bbdfa69b06f3d4a2074efc96fe069693ba
SSDEEP 96:eYbJ0d+pK242KafJf1Ob5NSl8h4otop5ezD/B6qGyv+mbyB0XcQcFRNC39ISyVN8:Pt0bt8OdiU26JS0b40XcQcFuCOcRNY
TLSH
T1C9C1E7B5E8AC58771CF6E491B1032E87DEF8219B25657F98EDDA8E1810D70ED1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

517db0e9-b296-4c3f-b97a-658c0f25e866.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\517db0e9-b296-4c3f-b97a-658c0f25e866.tmp
Size 4KB
SHA256 2f5c68cbd0dd378f4bd7d171a6d0f53fba75a8f59a90e488c8737c92ddbf3c9e
MD5 bc93f93f54737b204d44be118568db1f
SHA1 ca588f3e83d607a3eaa566ce45c0c2979ffc7bec
SHA512 702d73366628484fd6ca8fca10038df26e87bb1eafe435d2da1e6d7430676b54f105179e038343ffed751412635131e76cd84212d69b6e4cd2d1aeea16fdfca0
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5esD/B6qpGyv+7hhc0bZv4a:ZlC0bt8OI8lDUD3JPUhhhc0bV
TLSH
T186A11971E96C99B728B6C584B6422F43EFB822A76162DFC4DCDD5A1C20E71F81382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13f58caf-d61b-4bd5-a726-d0a3118d8595.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\13f58caf-d61b-4bd5-a726-d0a3118d8595.tmp
Size 11KB
SHA256 66a361dc61d3bb8654861c039358d0c2a62cbc3157e0189a5c1667b88adee3f0
MD5 0d54254cd0cd71e63c1bcfe6005ba2d0
SHA1 d5e3c5ebaded62ce0518d7fd4dde221d7c760783
SHA512 eefb09885a69f4d52a88567d69adc3a6373c655ececb35d1783d9159af2f324d8fec40cfd04c7d987efb20668c2eb3352fe40375f67d50c0e53d4c1ec66ad71d
SSDEEP 192:SR9d3EFv7E/vAPRp2Ra97Hsb+WNnf2PXpZUkwgLQUVyIsnAUgR:SR9d01q6XTVwOPZZUqR
TLSH
T1F832B52AEE10397B9CDBD229FA657B93D3F5102221952F84E6FC893C25E79DD2127007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a01631a-6ed2-479f-bd51-9751d893df07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1a01631a-6ed2-479f-bd51-9751d893df07.tmp
Size 11KB
SHA256 8ecec3486058d289197fbeb84d0c1ca1eb76d36f8a5c15dbdca36446173499c8
MD5 1112b8b6b24653073bb47f28ff80cdb5
SHA1 cc1d6533379aa8cfeefe7049b02cb11f5401a0f3
SHA512 a973fcd153230d12f42cdae4fa8e5f984c00c7f30787b691c7077a38032d9c12d1f98439454f02d931adc956778ed5698f41c2f7ef5cdedeffe784fed491dd77
SSDEEP 192:eqB4K6uU7KxkXqK4I40pUZNCgVLHrKHfFKslEEEmXzKD/lc+ErUkKN98+LIsG/hA:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmQ
TLSH
T1F632D91B988D6A7F4FD8D54DCC53AB8B6DF4019672680D2452FB9C0803A578A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3542023e-e041-4cff-b2bb-198bed45f786.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3542023e-e041-4cff-b2bb-198bed45f786.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8542c742-d931-401f-9933-4ca6ca02f454.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8542c742-d931-401f-9933-4ca6ca02f454.tmp
Size 2KB
SHA256 6bef353c6c9279f411605b4f5c01687ef7cd69a98a68297fb045496e283de369
MD5 b0a4556298aec85b5ec2d2e7fd04df20
SHA1 1f40bea226c46bf09fab527ca334fcd03918c24b
SHA512 5eb51664f068344b30e202c49cea6cc96d37202bd81d606872b628760144668bc3120d2e2eac33797f7e89ad57d78f23e75b9c70829e756ab91a96efa1095a86
TLSH
T16F514BFB43B0467E8B1195E0EA156E1FCE791126432C7CA689F46E1B93F2572D10139F
MD5 SHA1 SHA512 TLSH

Submit Download

969122a6-858e-409f-b4aa-e5de2431bb7b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\969122a6-858e-409f-b4aa-e5de2431bb7b.tmp
Size 2KB
SHA256 56c259499d1905d03f52ae8e56020c9d81cc822d47c73c9a3c5a2e042674dfd4
MD5 5a726d7777af6c0c6b329ad2cd22ba15
SHA1 5a5830fa278b706d9c2128585087a70f532e865c
SHA512 aea37cff22711414fa1e56f1eb81426bfb924db99ddda19ab13a4944a7ba05e42ba8c059b4e0f428769c76e80d5620eee463bf37309eea1566e987247fb3d874
TLSH
T1C8518BFB43B0467E8A1196E0EA156E1FCE7D0126432C7C6689F46E1B93F29B2D14139F
MD5 SHA1 SHA512 TLSH

Submit Download

cdfa1a80-1590-4d6e-aabc-261d0361eeaa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cdfa1a80-1590-4d6e-aabc-261d0361eeaa.tmp
Size 1KB
SHA256 ec9bcaf6af0a9d3e05dd6bceb045f166e802a42cdada86d19d6f909775881de4
MD5 33ce49cecaee3cd48a0cd96c757ebab6
SHA1 fc99c276f246450e544a85b1b6e2fd8d779ed44d
SHA512 db11340eba792f7cb91091700794783b8757c4620be9d83fe4b8ae6c662f011e7facb29e39a488a37dc0aba0ebc683cc0e548de96628ec998fa866426ec31675
TLSH
T137317AB7C3D88A7D890266F8AB152F2ECE690D54621D3C56C8E4AE5F53E28F1D20054F
MD5 SHA1 SHA512 TLSH

Submit Download

d03a9594-540a-404a-b2f1-158dd0c7a59a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d03a9594-540a-404a-b2f1-158dd0c7a59a.tmp
Size 1KB
SHA256 068e229e961add2cf0cf0bcbd4634af17bd9ecc2c7752684c5fef81757445b66
MD5 10d81b8752341289b0b97a374a9b1e9e
SHA1 f950aee72f9837eac400acc59768b7906c423d82
SHA512 953518e959cc7933af08f9f1fd1bc777cd7b8b5a886cf948377c3500a253274d3f58694be0a5469ec33c5e45dd5689b381c4a708f4dae47c6f5f4301a8c71c02
TLSH
T13F314857D97A747B00F909AB1D08FC056A7AA8354291A8F0CF6782ACB0C55F70B11527
MD5 SHA1 SHA512 TLSH

Submit Download

dc4eb399-a564-4b3d-856d-91e3580c28e2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dc4eb399-a564-4b3d-856d-91e3580c28e2.tmp
Size 2KB
SHA256 c31019979c53555b32763006ebbb047317799aa2cfd4e3a20740c8305edca7e3
MD5 f4955c658b3aa94f171146bca17ac12b
SHA1 1645e7c2b6949ca9d4a5a96147cf1b39f0a04b4f
SHA512 e838b8dcdef2f2c6d88d10058d8a5d63e8a0eba1324affe24e7c0eb34ed362cf4e4fe756e4896e413059731b8019cde078ab5f52e1b5b28850361d31222ca113
TLSH
T156515AFB43B0467E8A1196E0EA156E1FCE7D1126432C7CA689F46E1B93F2972D10139F
MD5 SHA1 SHA512 TLSH

Submit Download

b299c2c6-2a85-4242-82e4-af595a632225.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b299c2c6-2a85-4242-82e4-af595a632225.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f9c11692-c8d9-4102-adfe-e254c07296fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f9c11692-c8d9-4102-adfe-e254c07296fc.tmp
Size 12KB
SHA256 21a533ad2da0757821e592ec692ceb16cc52fe13f158236c45083ad7e99b27db
MD5 90d7b969ae2f74ac4a66b6b5790f76cb
SHA1 21105a46acab1fbdfd4f4788e85aed85731d5977
SHA512 99e041bcc59f5a6957846725e90084f8e8faf07e1df0da1fb2bf76480de67f276d8beee26c6a0bc0c585a05e9170c88c717268f0b67c3f9630acd54205418fb3
SSDEEP 192:SR9d3EFv7E/vO9PRpQRa97Hsb+WNnf2P0pZUkwgLQsVyIsnAUgE:SR9d01q2lXVVwOPIZUeE
TLSH
T13F42D62AFE10397B9CDAD219F965BBA3D2F5102221912F84E6FC893C25E79CD2127007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5a3958a-c681-4e1a-8347-90b1b3268a05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d5a3958a-c681-4e1a-8347-90b1b3268a05.tmp
Size 5KB
SHA256 1e3e60fe6f21826e986d70e2a2244ecd0b707b0e2bd5fbfe20f5a56d9914f9fd
MD5 25da6f9cbae6c093e323d8f0e53ae465
SHA1 a64317d4736503fa139f3876c517187d41a7cfe3
SHA512 bde425cf1ca1cc39746361b6d19012ef5dc279d687392df6d2d64d0f0235592ada604ee53a84742b2404516ee470e39fa243118c047749593eb95d5316a23005
SSDEEP 96:eYbJ0d+pK242KafJf1Ob5NSl8h4otop5ezD/B6qGyv+msQxwzmRFbB0X2Qc50j9m:Pt0bt8OdiU26JS0HxbR30X2Qc5UJE
TLSH
T147C11871B8BC587358F2E550B1023E87DEF422DB52619F94EEDE8E2800E71FC1382612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd587d20-0abe-4c78-bbdc-7cb87ed20324.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dd587d20-0abe-4c78-bbdc-7cb87ed20324.tmp
Size 5KB
SHA256 9787109d8b6a2db0452ab5d0141c72a593d8a1d470a64362a6e49bb1dd6f10db
MD5 8ff17cef5f358d630aa124b611a74477
SHA1 02ddcd09908dfb84ba307ac7101974ce96dc6c6b
SHA512 c2ba36a48a73fd4fc799cad8088556835ad7ecf2d308fd1c13c25be9d7a4a706bd8022fc12a36b93a1b818f03c41f1b9e60695d286222b2bcf5e62b814c1ddd9
SSDEEP 96:eYbJod+pK242KafJf1Ob5NSl8h4otop5ezD/B6qGyv+mbyB0XcQcFRNC39ISyVN8:Ptobt8OdiU26JS0b40XcQcFuCOcRNY
TLSH
T19CC1F8B1E8AC58775CF2E455B1032E47DEF8219B65657E98EDDD9E1800D70EC0382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download