7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b

Analysis

max time kernel
600s
max time network
613s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 5.4MB
Sample261102-blh71aztaw
SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
MD5 3f5d5669497c9d912e5f0412611f992c
SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
TLSH
T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2028	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
5776	chrome.exe
5776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4528	4676	chrome.exe	89
PID 4676 wrote to memory of 4400	4676	chrome.exe	90
PID 4676 wrote to memory of 2028	4676	chrome.exe	91
PID 4676 wrote to memory of 4400	4676	chrome.exe	90
PID 4676 wrote to memory of 4568	4676	chrome.exe	93
PID 4676 wrote to memory of 4568	4676	chrome.exe	93
PID 4676 wrote to memory of 4284	4676	chrome.exe	94
PID 4676 wrote to memory of 2100	4676	chrome.exe	95
PID 4676 wrote to memory of 4284	4676	chrome.exe	94
PID 4676 wrote to memory of 2100	4676	chrome.exe	95
PID 4676 wrote to memory of 1504	4676	chrome.exe	96
PID 4676 wrote to memory of 1776	4676	chrome.exe	98
PID 4676 wrote to memory of 1776	4676	chrome.exe	98
PID 4676 wrote to memory of 1148	4676	chrome.exe	99
PID 4676 wrote to memory of 1148	4676	chrome.exe	99
PID 4676 wrote to memory of 1324	4676	chrome.exe	102
PID 4676 wrote to memory of 1324	4676	chrome.exe	102
PID 4676 wrote to memory of 4884	4676	chrome.exe	103
PID 4676 wrote to memory of 4884	4676	chrome.exe	103
PID 4676 wrote to memory of 5068	4676	chrome.exe	104
PID 4676 wrote to memory of 3216	4676	chrome.exe	105
PID 4676 wrote to memory of 5068	4676	chrome.exe	104
PID 4676 wrote to memory of 3216	4676	chrome.exe	105
PID 4676 wrote to memory of 4796	4676	chrome.exe	106
PID 4676 wrote to memory of 1940	4676	chrome.exe	107
PID 4676 wrote to memory of 4796	4676	chrome.exe	106
PID 4676 wrote to memory of 1940	4676	chrome.exe	107
PID 4676 wrote to memory of 3000	4676	chrome.exe	109
PID 4676 wrote to memory of 6132	4676	chrome.exe	110
PID 4676 wrote to memory of 1156	4676	chrome.exe	111
PID 4676 wrote to memory of 5776	4676	chrome.exe	112
PID 4676 wrote to memory of 1272	4676	chrome.exe	113
PID 4676 wrote to memory of 1272	4676	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc8,0x134,0x7ffe1598c728,0x7ffe1598c734,0x7ffe1598c740
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,13919834193669769151,16856552526495726435,262144 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,4846884446858069373,7492693618815337291,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,4145345295092356723,6974600015924835248,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,12522925115895771617,1976335589632876265,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,6509425175336476299,10493846003276759171,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,12132996048426005849,558747015590131875,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5264,i,8698010040121653330,11024254973544476523,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,17662709776667878545,16108658406338625317,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,15015698192485989605,4377878911271955637,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5884,i,6644176201876216685,3986860584141713662,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5640,i,2694874538872429967,16029176079182623949,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5600,i,3585444697834795122,13844369096383987642,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5736,i,12989457519130469869,15106316112102142922,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5752,i,11699367292678680735,6859973574534277430,2097152 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,1288709096110464342,2777424541540922241,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,2444039692018657976,12819221460642318562,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,3435330707613048120,9737930285099930967,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=796,i,16200693836349154958,3738510195057540530,262144 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,4165860116860554849,16950809293515593995,524288 --field-trial-handle=1916,i,7469030224535361635,2495450724503874055,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:1272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12b5991e-9895-4c3f-9d78-859da71583e0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\12b5991e-9895-4c3f-9d78-859da71583e0.tmp
Size 5KB
SHA256 17561b06c826a5f3bb62b60fd139a63b37259552c27128f423b5cbc739fb5c3c
MD5 3f905ff911e7e155882380bc0f2af2a1
SHA1 bbbd916e481850d77c766c5f662152ff5c83277e
SHA512 82b49290559084f0da1b565a3464772b1b67d5093c9a765f17a39b2067c028fd01fbb4be829c7473d17bf0f709de5deb2555e01cfeae5bbc5767d7cf145747a3
SSDEEP 96:8bJ0d+qw+CWJKhPPf36vPtLSl8h4otop5tvYDFB6NGyvr7jOcKtTRNC39ISyVNDs:8t0h2WJii7iU2hu7pqjOcKtTuCVs
TLSH
T11BC11972946D5C7B4EF2D981B0032D07CEB822BB69197E54EAED1E0800E75EC5393A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17176cad-9c42-4edd-aa8b-13064e9c7e41.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\17176cad-9c42-4edd-aa8b-13064e9c7e41.tmp
Size 5KB
SHA256 2e2b1f2dd3768f81a7a69174e2de81df796c8733770f8afbd9ce5d254e2b227f
MD5 0861fd714737a9432c3ba3e1c27c73aa
SHA1 be439ab825223ed03b07a223c1d4a035ed0d9587
SHA512 17c9ae850405ebbb2dfb70724491fa3bce824815ca28dc520c671ff36fd0ad6365f7109a0e50f1af4cd8baa976d7b4f7ad8488407884e62e5637722f2bc68a65
SSDEEP 96:8bJod+qw+CWJKhPPf36vPtLSl8h4otop5tvYDFB6NGyvr7jOcKtTRNC39ISyVNDs:8toh2WJii7iU2hu7pqjOcKtTuCVs
TLSH
T188C10971946D5C7B4DF2D585B0032D07CEB4227BA9197E54E9ED1E0801E71EC5393A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ebe625a-9b3e-4565-932c-83faf8c3f6da.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ebe625a-9b3e-4565-932c-83faf8c3f6da.tmp
Size 5KB
SHA256 172d567048cc951e93e2e1ef925c44088b51d99b7a1a109408e4110c1ad248de
MD5 cce04203de04d304d94ee7e78e1652f7
SHA1 7402fb932c8919fcdeb505a28fa77c9162e63ac4
SHA512 6d1d777e84eccec9cf5b0e86df3ca4f91a4989d828b5aa8d4e356aad2756ec97b476ed68196f6522bf774d2fe1bce2f8a690203e729914ebdf533c614f4131a2
SSDEEP 96:8bJ0d+qw+CWJKhPPf36vPtLSl8h4otop5tvYDFB6NGyvr7jAixwzFWm2KtJ0j9IL:8t0h2WJii7iU2hu7pqj9x7m2KtJUW
TLSH
T11EC11C71946D5C3B5AF3D691F4032E07CEB422BB96157F54EADA1F1800E71ED2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89215378-6d58-4a03-8989-8f87ccc6e4e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\89215378-6d58-4a03-8989-8f87ccc6e4e6.tmp
Size 5KB
SHA256 7e59f457832a137457e5c7623b0a92e98209b0270848b5e8a19441dd7b71ffe3
MD5 595d79adb14c17af52f52fcea2f0cf29
SHA1 1cd661b43d9deb0a1e071bbacabc0ba6d63f931e
SHA512 7fe2596f1b24b29b31dbb907390af41c5e98bf6ff2edfc4cc090911e9b495ae8353a02625833fdad15748da004e375254f8fdac73b9f21496e4a3091d79a7cd5
SSDEEP 96:8C0d+qw+CWJKhPPf36vPtLSl8h4otop5tvYDFB6NGyvr7jAixwzFWm2KtJ0j9IAU:8C0h2WJii7iU2hu7pqj9x7m2KtJUW
TLSH
T1A0C12D71946D5C3B5AF3D691F4032E07CEB422BB96047F54E9DA1F1800E71EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3521c537-b796-458a-8272-3323ad726423.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3521c537-b796-458a-8272-3323ad726423.tmp
Size 11KB
SHA256 21e418c05aa3f680bc4fdf83c1cc502e4e8f6a480b0e3c9df63a3b1bc105fb1e
MD5 889b987d8bf74ab972703149a44ccb00
SHA1 69cd074639623d5670717d7ffdec06fb678426d8
SHA512 689cc3634e97c78d3442559d2eecc8c4f0fc299e476ce5373dc19f19fb803a947326d87a50c3a0ce9091a9888b32dc6a008a02ac286a924bbb987a601f6b0b49
SSDEEP 192:xBRRTyAffv7dvAPRp2BP9JHsb+WNncyP1o2MLNkwXEiaj+VyIsnAUge:xBRR2k3p6XKHwNPa2QN3baj2e
TLSH
T17642C62DAE20353BADDEC25AF9617B57D3F9112161852E84EAFC892C21E75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

37fdc4c9-f204-48e2-8f83-7ee73dbcf851.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\37fdc4c9-f204-48e2-8f83-7ee73dbcf851.tmp
Size 1KB
SHA256 245af30c425ff4e9703eb27ccd26dd142e0e140a87da6dce595e2f0ed4063ddb
MD5 01012677a39e71da28357e603444940d
SHA1 32a53162c03b8739034239c48c549bb7985bfdcf
SHA512 68c45ac4902444d83bb7589105ddca209eb38f2e4d723b52111d47182060ea5ff0d79804b3991b7fb9fb979e60be77804fc823d5a099f6e5f9e6c44df56c0731
TLSH
T11F317CF793B4897E861092E4DA15AF1FCE790524031C387289D46E1B43F2972E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 20778449614288c874b9ab8e09c2aafaa290b6772b57150e99c8508024dd9a66
MD5 5d74803193fafc79a779680b1dfa1f11
SHA1 80bd670215c45b126299e8d91c126473a1584cf1
SHA512 d8d3aad4eeac3d05bfdbda36e0829710e5daff1de998ed7c4346f7c9cfdc3b014e82c725b6cb8066e277a8ebd6b53e30c1988cd48a10c0d67b20c19105bd140a
TLSH
T1733188F793B4997E8A1192E4DA15AF1FCE7D0624031C38A289D46E1B93F2972E10439F
MD5 SHA1 SHA512 TLSH

Submit Download

b8f97dbb-9f2a-4267-9a31-545f47f5747c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b8f97dbb-9f2a-4267-9a31-545f47f5747c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 deed69b4238a98d234f14c672e3527125f1d24d0e567c3d1be675c54dda964fe
MD5 c475001d2c4ced60442d04638c063f73
SHA1 e2e736dba2fc72f12ea2f1b77879d9b3c79eaed7
SHA512 2ebae39613a207fe096ef7ac856e7ff4313fae013b4a200144d8edb7737e417f58749eb7dafcfc87060d9c26b3424175c2fb4f95e2ae93920522e8f511688662
SSDEEP 192:xBRRTyAffv7dvQPRp2BP9JHsb+WNncyPGo2MLNkwXEia6+VyIsnAUgE:xBRR2k3p6XKHwNP32QN3ba62E
TLSH
T12942B52DAD20393BADDEC259F9517B57E3F9102161912E84FAFC892C25E75DC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d49b701c-f5c0-4c07-bda9-ff87fbd02953.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d49b701c-f5c0-4c07-bda9-ff87fbd02953.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d97b2b71-b5f3-4b06-934d-3579234220b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d97b2b71-b5f3-4b06-934d-3579234220b6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cad49bea-e0c8-4d31-bc62-df72d2c015b7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cad49bea-e0c8-4d31-bc62-df72d2c015b7.tmp
Size 4KB
SHA256 8907eb80cb61214bd17987616b5e9feb5e39648f05fb0df722995df2b89cc11c
MD5 5c23c9fe537bb3c69a138828e502e568
SHA1 49c58bcc153cf7d22f4d4bf904aa9e50184e4218
SHA512 cd6fc8c5114af579395e351a527e21d08deefffba7e6c4089d3d4d7b36f3346c7b23c80edaa59b0afec6ea8daa0cf73333d3de23c2bbce16bb1e9d1bbdf847dc
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5tvsDFB6WGyvr7w7tsbm3v4a:9C0h2WJiiniDUDh67aqw7tsbC
TLSH
T1BCA1087294695C7B89B7CA85B8432E07CFB4636BA521BF80D5DD1E0811F72EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download