hxxps://gestao[.]merakidigital[.]cloud/login

Analysis

user interaction
yes
max time kernel
84s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gestao.merakidigital.cloud/login
Sample260705-bsvjlsf13x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5980	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276883120672672"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 5820	5796	chrome.exe	89
PID 5796 wrote to memory of 5568	5796	chrome.exe	90
PID 5796 wrote to memory of 5568	5796	chrome.exe	90
PID 5796 wrote to memory of 5980	5796	chrome.exe	92
PID 5796 wrote to memory of 6020	5796	chrome.exe	93
PID 5796 wrote to memory of 6020	5796	chrome.exe	93
PID 5796 wrote to memory of 6920	5796	chrome.exe	94
PID 5796 wrote to memory of 3152	5796	chrome.exe	95
PID 5796 wrote to memory of 6920	5796	chrome.exe	94
PID 5796 wrote to memory of 3152	5796	chrome.exe	95
PID 5796 wrote to memory of 5524	5796	chrome.exe	96
PID 5796 wrote to memory of 5628	5796	chrome.exe	98
PID 5796 wrote to memory of 5628	5796	chrome.exe	98
PID 5796 wrote to memory of 1008	5796	chrome.exe	99
PID 5796 wrote to memory of 1008	5796	chrome.exe	99
PID 5796 wrote to memory of 4272	5796	chrome.exe	100
PID 5796 wrote to memory of 4272	5796	chrome.exe	100
PID 5796 wrote to memory of 4140	5796	chrome.exe	103
PID 5796 wrote to memory of 4140	5796	chrome.exe	103
PID 5796 wrote to memory of 1032	5796	chrome.exe	104
PID 5796 wrote to memory of 1032	5796	chrome.exe	104
PID 5796 wrote to memory of 5924	5796	chrome.exe	105
PID 5796 wrote to memory of 4772	5796	chrome.exe	106
PID 5796 wrote to memory of 5924	5796	chrome.exe	105
PID 5796 wrote to memory of 4772	5796	chrome.exe	106
PID 5796 wrote to memory of 6704	5796	chrome.exe	107
PID 5796 wrote to memory of 6704	5796	chrome.exe	107
PID 5796 wrote to memory of 4276	5796	chrome.exe	108
PID 5796 wrote to memory of 4276	5796	chrome.exe	108
PID 5796 wrote to memory of 3932	5796	chrome.exe	109
PID 5796 wrote to memory of 3932	5796	chrome.exe	109
PID 5796 wrote to memory of 4216	5796	chrome.exe	110
PID 5796 wrote to memory of 4216	5796	chrome.exe	110
PID 5796 wrote to memory of 6272	5796	chrome.exe	112
PID 5796 wrote to memory of 2468	5796	chrome.exe	113
PID 5796 wrote to memory of 6672	5796	chrome.exe	114
PID 5796 wrote to memory of 3360	5796	chrome.exe	115
PID 5796 wrote to memory of 3360	5796	chrome.exe	115
PID 5796 wrote to memory of 4084	5796	chrome.exe	116
PID 5796 wrote to memory of 4084	5796	chrome.exe	116
PID 5796 wrote to memory of 3780	5796	chrome.exe	117
PID 5796 wrote to memory of 3780	5796	chrome.exe	117
PID 5796 wrote to memory of 4696	5796	chrome.exe	118
PID 5796 wrote to memory of 4696	5796	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gestao.merakidigital.cloud/login
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe3df5c728,0x7ffe3df5c734,0x7ffe3df5c740
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,11741621122236854502,2289055172026520636,262144 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,380168181988264887,4350654184008333,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,15709315137743190338,10775689303304308405,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,15050577808237313421,8280889615726400826,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,11948009740248653161,11888885676309659016,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,14811789854926846146,13952184391610581642,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5584,i,4721438275251429914,16710720373661630648,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5628,i,4547069855109114935,4242258572319953527,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,4203442989631176240,8236776220425772115,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6080,i,6296735291817826720,6382695564529956039,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5624,i,6863802738611006874,7392974322808104736,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5736,i,10127359943770182619,2672331006902709640,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4764,i,16905147542688828721,8002615501980735580,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5676,i,406056001426740414,15254284218554585894,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5368,i,10085592841664720225,10563370850303748480,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3268,i,13655307432149611488,16233211339468255779,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6016,i,3544424523104015212,15817288811430906948,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7291137969127339601,8408217436080842604,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:6272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,657346576743102393,3915110336727526381,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,2334982970745103480,4065395825582218661,524288 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:6672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3764,i,10078175271694432992,11859858447803337,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3156,i,11987695643746811052,9449112457265267471,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3200,i,3956034885864411830,5422822566271219105,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4836,i,13443706554419268705,6953027067232764815,2097152 --field-trial-handle=1892,i,17913648416370386142,17240872984339775587,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b22c2c48fa48ba054a7a8e827af1e57fbdad84a493285cdc6b3f1157004e2efa
MD5 0dde59b7ac439475317df94c99bdbf11
SHA1 c1bd00afa4e5ee1fdb8a36e1e931f8524b41549a
SHA512 18c1605869a6914eba1a47293d40841afa897d8c06983972473e5c64591b0d567abdd1accbcf4264c567f724e3d73111310ac8a559344dcb4983428fec74bf36
TLSH
T1DE419BBBC7D88A7D885152F8AB156F1BCD3A0A14431C3C56C8E4AF5F57E2872D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 72796e1b09a25c83e3a6fa8db21b2c00ca1cb947c08953f5d7c956e1bcc04035
MD5 6c65e8c110bc2bb702c2f9428a6f947d
SHA1 bea330899fc9b8d58c0132263120b513bf951d30
SHA512 687fe28d1c45da79d8a0f147328fc9f6ffe43d320888dd038fceb9f2db6f6a6151f4a267911c9b9a52d0c779941b3ff7c61841df8540f2d91a7cac0a42baa99a
SSDEEP 192:eRMUBIJYv78vAPRp2+9gHsb+WNnVFPfYeiVyIsnAUge:eRMUkEw6Xt+wPP4e
TLSH
T18A32A62EAE10757B5CCFD259FA257B63D2F5102135A42E84EAFC8A2C16EB5CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 45e7649b04fa95d23a0e1350a8570c5d45af616cf588c790329912b1a2248a94
MD5 295690c777561294be2a26f02e402825
SHA1 b234537a88b5525527aac4581cc9a78283644f19
SHA512 199bbc22f8938fbaa3d1dcbb49e965b7dbe186a89650fc7543b32e02cdb310d80d1fed43a0697f8229976e374a561d258b17a63dfa02aaa1c7d8779999ca8b39
SSDEEP 192:eRMUBIJkv78vdqPRpKhgj9gHsb+WNnVFlxO2DYeJVyIsnAUgE:eRMUkAw1cXK0+wPG2RE
TLSH
T12542B72FAD50767B5CCBD259F9257B63E2F5102135A02E84EAFC8A2C16E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 483e8e75ab62962de65d0e9145a99a64eca05b1ed375a12720fc5c49761f265a
MD5 f5337b929861ba7e3ee1bce08e69ec1a
SHA1 fe18a42f100b25cb34b766967362f451c3ee7a29
SHA512 59974d022254ec569bf6d3f6f80e1a1931b34f671abb20e3454ed94647d5271451e32778cea5f45993588b54800cfe548c0dd2c729a32bee95422ab1a7a53400
SSDEEP 192:eRMUBIJWv78vAPRp2gZ9gHsb+WNnVFPAYeFVyIsnAUgE:eRMUkiw6Xf+wPP+E
TLSH
T1FA32A62EAD50757B5CCBD259FA257B63E3F5102135E02E80EAFC8A2C16EB5CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8d8eb6bae00aee3ae9225bf37c575850f37282511c7084ae3b556d8bba4a9b72
MD5 ddeecc4c4a2d2b5cb00b86b29548e23b
SHA1 6c834c5d606c4db0fa371a3f814d019c19c156a5
SHA512 617a773ba0b1ac9ede091334cc7e995fd456f1c93fb1e74169c261bd9f3a1c3bbac60d8a59f52a9a49d2c5b4a977921b03404ad3543eb23d27450f7d8e341f16
SSDEEP 192:eC94K6KI7KxkXqK4I40pUZNCgVLHrKHfFKslEO86XzKD/FI+ErUkKN94fWeK/ru/:P9jNI7KxkXqKf/pUZNCgVLH2Hfgsls6v
TLSH
T1E532D827A88DAA7F0FD8D50CCC126F4BBDB402526678092496FB9D0803E97CE114E2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 aff27a3df6eef5ca6b86367713807362b6c3b351d3893ab048166f750c772e49
MD5 b2db14484aafc1de837e4f696a927337
SHA1 6bb9183ed5bc02899fb79fa2118537397b4e27c7
SHA512 d41e5455abaa76ac13e95aff9cd40e2d839bbfc30b90cef5e259e04b080b8218a903fcd8328f44ae0d0e3963d6420ddb710df1d7e9b1177869f34585b15ee7ee
SSDEEP 96:d5bJ6iTd+X416PtAWs4cf5oAddmSl8h4otop5pxDpB6RGyvQBzhYnsd2bRNC39Il:3tHI4qDsjl2iU2nvBhzh0sd2buClaXU
TLSH
T1C5C1D671A8AD5D774DF6A486B1072E83CEB4609B65156E98EAE94F0C02E79DC1383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eb30976a31ea706468cf0a3319a403a1a2e6c310cd54461cbb7f5ca4ee7e6e10
MD5 0a7eafcc6012f61cfb6e63b8ad3df082
SHA1 1c86cf855fc99614c8e20270af6a5b745d8a4241
SHA512 48498fd77f9f56b75ad613dc303d8a16ac02130fa50344b18d7bbd931eff253b8ef4c3654a76747354ea33822b35fab5db26a31592c4a22e3d7aaa1e506dfbe8
SSDEEP 96:d5bJ6iTd+X416PtAWs4cf5oAddmSl8h4otop5pxDpB6RGyvQBz9Rsnmd2D0j9Ide:3tHI4qDsjl2iU2nvBhzDomd2DUWe
TLSH
T142C1E93278AD197349E6E596F4072E53CEB0709B65515E98DBEE4F0C02E75E823C6123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e4d89b912d10a4d644f6133efa41ec254b420cd69a052c29b23308af6ac101f4
MD5 9e16c70d76fdf828e8f939edb1ac5b91
SHA1 ef1174b4245a69aa4fa0599da0ead8bc04b453ce
SHA512 5daa8aaf2be21f8f147bdd6808599489af37bc3be3f4d3c532c1e2d7c42ec0ca8a55ad349781f862f7b838e826ba1ca72777baf9da313f558e285f6e78249cf5
SSDEEP 96:d5C6iTd+X416PtAWs4cf5oAPdjRDotok5p8NDpB6NGyvQBvc2Cbc4v4a:zCHI4qDsjl/DUDmVvlhvc2Cbci
TLSH
T1F3A11772A46E0EB789B6D486F5062F92CE74B097E1115FC4DAED0F0C02F74E8138A123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b6dd30d07d126278c6bcd0bc6d2525394f7ce591ce3501fab8e9cb6e1bb1220b
MD5 a3320aac55726caf0f3c34dd99e110e0
SHA1 4c353d0dcd623710e2ba10a92f54084faf937b15
SHA512 400b303b0d0b07bf8e31f9f7ed2e9a9eb6d861bccb7d38179cb2cd6c4a00b430690a8f3fbd990c6eda046172204eef81a222d661eab5db8c5698f3acb0c2b760
SSDEEP 96:d5C6iTd+X416PtAWs4cf5oAddmSl8h4otop5pxDpB6RGyvQBz9Rsnmd2D0j9Idd0:3CHI4qDsjl2iU2nvBhzDomd2DUWe
TLSH
T1D9C1F93278AD297349E6E596F4072E53CEB0709765519E98DBDE4F0C02E75E823C6123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download