hxxps://api[.]redbullmobile[.]om/play/scratches/?auto_login_key=%22%3C/a%3E%3Cimg[//][//][//]src=x%20oNlY=1%20oNerror=alert(document[.]cookie)%3E

Analysis

max time kernel
900s
max time network
862s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api.redbullmobile.om/play/scratches/?auto_login_key=%22%3C/a%3E%3Cimg//////src=x%20oNlY=1%20oNerror=alert(document.cookie)%3E
Sample260721-e8nmsae16p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
776	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290823990525933"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5384	chrome.exe
5384	chrome.exe
2872	chrome.exe
2872	chrome.exe
5384	chrome.exe
5384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe
Token: SeShutdownPrivilege	5384	chrome.exe
Token: SeCreatePagefilePrivilege	5384	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe
5384	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 4224	5384	chrome.exe	89
PID 5384 wrote to memory of 7112	5384	chrome.exe	91
PID 5384 wrote to memory of 776	5384	chrome.exe	93
PID 5384 wrote to memory of 7112	5384	chrome.exe	91
PID 5384 wrote to memory of 3216	5384	chrome.exe	94
PID 5384 wrote to memory of 3216	5384	chrome.exe	94
PID 5384 wrote to memory of 4392	5384	chrome.exe	95
PID 5384 wrote to memory of 4392	5384	chrome.exe	95
PID 5384 wrote to memory of 5896	5384	chrome.exe	96
PID 5384 wrote to memory of 5896	5384	chrome.exe	96
PID 5384 wrote to memory of 4332	5384	chrome.exe	98
PID 5384 wrote to memory of 3316	5384	chrome.exe	99
PID 5384 wrote to memory of 5984	5384	chrome.exe	100
PID 5384 wrote to memory of 2872	5384	chrome.exe	101
PID 5384 wrote to memory of 3292	5384	chrome.exe	102
PID 5384 wrote to memory of 3292	5384	chrome.exe	102
PID 5384 wrote to memory of 4316	5384	chrome.exe	103
PID 5384 wrote to memory of 1584	5384	chrome.exe	104
PID 5384 wrote to memory of 2992	5384	chrome.exe	106
PID 5384 wrote to memory of 2992	5384	chrome.exe	106
PID 5384 wrote to memory of 1520	5384	chrome.exe	107
PID 5384 wrote to memory of 1520	5384	chrome.exe	107
PID 5384 wrote to memory of 1528	5384	chrome.exe	111
PID 5384 wrote to memory of 928	5384	chrome.exe	110
PID 5384 wrote to memory of 1528	5384	chrome.exe	111
PID 5384 wrote to memory of 928	5384	chrome.exe	110
PID 5384 wrote to memory of 920	5384	chrome.exe	112
PID 5384 wrote to memory of 920	5384	chrome.exe	112
PID 5384 wrote to memory of 2520	5384	chrome.exe	114
PID 5384 wrote to memory of 4648	5384	chrome.exe	113
PID 5384 wrote to memory of 2520	5384	chrome.exe	114
PID 5384 wrote to memory of 4648	5384	chrome.exe	113
PID 5384 wrote to memory of 5816	5384	chrome.exe	115
PID 5384 wrote to memory of 5816	5384	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://api.redbullmobile.om/play/scratches/?auto_login_key=%22%3C/a%3E%3Cimg//////src=x%20oNlY=1%20oNerror=alert(document.cookie)%3E
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8b715c728,0x7ff8b715c734,0x7ff8b715c740
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1056129498849284027,15412634902733869430,262144 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:7112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,93634770457635211,11998624909644947387,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
  2⤵
  - System Time Discovery
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,14889602790490843459,18183124241998545896,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,11891374633081824617,8564328938627291526,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,10345611656627940356,6166594829519419044,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,1670604583701158487,6589880021888804495,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,16160124745221027320,15663285957093497960,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,4296572960667721280,7337866189501390258,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1136,i,11811128837152490732,4109302455069461627,262144 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,7634899593254940576,8506253711573324516,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,4610853159662229913,11021201405937720864,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,8520807028853855467,3299364092058337326,524288 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5752,i,4376913449728080859,10955711013031489023,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5764,i,7398068013545559257,5067034978410921949,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4844,i,14958103903329443729,1857646157761348288,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6048,i,8209362666618833572,12169042028214619497,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5928,i,3120194079619799128,5794882356352636512,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6260,i,15586450701221821645,16262914242577483000,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5884,i,11899037458669914976,3384801051662908761,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6132,i,13510528554696206646,12044632513435008523,2097152 --field-trial-handle=1844,i,8656977886054292087,7701528163477955568,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3928

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a198a56984a0da17895555a7646ae63baecced66b4955ba539541e7cf1513bec
MD5 85112865b74d95d41bf82a1cb1ab37f5
SHA1 cd49ac75bf1099145c32f0ac5b8b8c24a7d32a6a
SHA512 1e2504228456eae5836161ff03af9b81a3cade7b8c04792f2ca25f6812549f9ed073b60a102f3ff7404e9a367ae182240457e567ea7fa61e788cc71d10d759f0
TLSH
T1EB419DF7C3E4897D891056F4AB156F1BCE690D18432C3C66C9E8BE1B97E2871D21065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cf98f596b399b6f15797944ed18792460f2aec7e44b28ca9ce83671f952db085
MD5 44d0fa8edcb6031ab3dab6a31715e511
SHA1 97d23e47f1680658952b3d562176a7c42f0895be
SHA512 db659142bcee832d507dc34a89e9efb48abfa5515d4f5b491213c973d11a9a77e579cce2a1700eb9831870dd4ad781398e8498c95079e6c07b5e6a0c0f334893
TLSH
T124217BF7C3D8957D890146F4AB156F1BCE2A0D18532C3C26C8E8AE1B97E2871D10054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b45b23b16e50759d85f341138e73099c220a0b4d2a263be6340bac8d729135d
MD5 06143b228989951890c7587403df0043
SHA1 a12c763e84e9671a19a67df98617c9d75a981a11
SHA512 5ff02d9296738fe55b4c7644711612133fb7e6c3d4d0e32e5202a5b0290229464fe64be43e5b1ac75bda7edac20d4b981a2ba85144454a8a4a12997cc51ff459
TLSH
T14C419EF7C3E4897D891156F4AB156E1BCE6E0D18432C3C66C9E87E1B97E2871D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0634fb4115a446b64d8f8171341d5ee3469b82befcf3cbc2ff7e09c3934bf4c4
MD5 e29a88117c858a9286a89009992b8fe4
SHA1 41ca7983fcc493177528cec8533e217561810714
SHA512 bb7b66b27ec847b41a1ee5b873ba609103b669dfd8a49e879ef8fb8cd7340e1cd283fd418237381e3ad6175d7b2487257eddd6e6b2c53336cd515d4131c5e897
TLSH
T16A419AF7C3E4896D891046F4AB156E1BCE690D18532C3C2BC9E87E1B97E28B1E25064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 30aa1a6ca139502466ffdefc0146518275241f97d6c91c7972575616c597ddc4
MD5 d3c5082935581f6c7ea42a4e7ff04369
SHA1 04e9babae74da71336a1f3bad87338f99575b54b
SHA512 6f1f3cf60b3a31effc8ba6221da15824cd5e39d48f874c66d157cca45004452dfc853be7ac8670fa1e94d7f246f0a038f4a33daba48abd537b6cec46f9a427c3
TLSH
T170017B57F2BEF4E3103858AB1D0578457DFEEC3111426CF8CA69926DA0828F70602412
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9fdc15cfd9b9be086fc5eebb52334122e997979a2e8c145749a3a53456a0ef58
MD5 ef2043ba5f9566ec1d5cb85e97ad6349
SHA1 7f1b4948ef36849bef705f1d74715df4d714e41c
SHA512 1cc5ac98fd8649830d7dd668647433e76da9c56ab9797950713de4ce5062c24466b22672b37205c8d02b90305062d2efb10e2f420fae25a321968fc4d4d65af3
SSDEEP 192:+R2rRBFv7FTvAPRp2Yz9CHsb+WNnoqGYB25tef2OsVyIsnAUgR:+R2rL15T6X/kwhf2a29R
TLSH
T1A732832ABA20697BADCAC229F9617B53E6F5102672D42E40E7FC8E2C14D76CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cd7226883df8757f0d5babff18820b6791968a7a6749596da7e426ba19f5a035
MD5 4ec762c873f529e0405aaca930e59ce1
SHA1 ae46dae824987c84c2efffa808ba33a1d0232ead
SHA512 b9e403812671cb5340286b2d647aac9912854ffdbde5555846a812a297f4b29c4940df3fd79f39fa4ca83360d60ef8d719a0a9ce0a3e71aee4070866465b724a
SSDEEP 192:+R2rRBFv7FTvoPRpKYz9CHsb+WNnoqGYB2wtef2OzVyIsnAUgR:+R2rL15TiXrkwhf2d26R
TLSH
T13B42942BB910697BADCAC229F9617B93E6F5102672E02E44E7FC8E2C14D76CD6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fe7b746a9ff1ebe6c22cfb7a40d2e71da611bab2b4b9863ab25820ab87b65337
MD5 dbd812700955b2024517ca31df92fcd8
SHA1 299d42ac24552a7bd3ae929fa60d208579b2b53b
SHA512 26691b45690c5e00d22fc4f6631ef5bb93c62e0d6111870f43184f5a65d047a5d1589f183ec81cd24bb802b8984670ac7d3d666c41ac06d2d924059dab3ca3da
SSDEEP 96:MWbJod+CNkx/Fc5vBh2F8vIfjnNACrGSl8h4otop5VBDzB6nGyv1fHb9IUMRNC3G:MWto1N2c6ARiU2btHw79IUMu8Mo
TLSH
T1EEC1F872A41D9CB749F3E54971032E438DB4616BF911BE68FAE95E0C01E74EC43C2527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 255251adf8123fcd4ed5ec98bdddcb03ec47acf918d4055180a24bed1ba551fd
MD5 3e18bf01b5f22c8aa9abea30d9912cf0
SHA1 2599519d9db03e18191361257e592e1aa77f815c
SHA512 45a3b20fe1dfaa9e5552774cd5cda9be0f27933fcea473109f8e5595563517f97d08db0c1d779cf9073bc4ad2bc7fcd65743d8f80db8f49f0267a86548d91213
SSDEEP 96:MWbJod+CNkx/Fc5vBh2F8vIfjnNACrGSl8h4otop5VBDzB6nGyv1fHbwIULr0j9U:MWto1N2c6ARiU2btHw7wIULrU5y
TLSH
T1F6B11872A86DEC7359F3D549B1032A43DEB4626BEA11BE94EBE90F0C01E71EC1382513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9991cb866cc4afbc5062a2287932faa9c86f59ec20df55abba324c14a292d626
MD5 ce148c4876687765b54128f7108713b9
SHA1 da981275f0390a6ca586f0dc49a2647d245b029c
SHA512 e3dc416957ec50e33732c977a8e65ce4a4d3d3ee4e048755317a173be4e963c164c51816dd75c9c7f9740c05567fc9e0ea7ec6ce9aad84292ed1839161bfec58
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5VVDzB6xGyv1T5UqbKv4a:MkC01N2c6AGDDUDzt1U5UqbU
TLSH
T10AA10932582D9C7788B2C549B5522E43DEB86127F921BF94E6ED4F0C11B70EC1381527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f2151d1a3cfe5b11200ff776a6b2364496b225cfb7ef63a833fdf17c4802d8ec
MD5 3a9b274ea020ec59046f424651a78abf
SHA1 081d7c3224bcb9be75cda39799f70046673623fd
SHA512 45267dc89b5976699f5250cd43f04a76505d2c692b2475969cae55208cae1f1fd9f2bfae7b22639adfd4b4f65b4fb684e70c0a02719a8c4984ffbedbec51fb38
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNACrGSl8h4otop5VBDzB6nGyv1fQBFv1QzbojLM:MkC01N2c6ARiU2btHwQBF+ELIULrU5b
TLSH
T14BC10776B86CAC3348F3D459B1132B43CEB4216BA611AE94EBE94F0C01D75E81382422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 40e2a8e2150ada234f3f362049e3106f0b2f417baea22ad59832cfca04e59270
MD5 32c379bb7d6adb9e82699c5a77f52f22
SHA1 8b0f62074cf7db9757da42a763fa6a6307059ace
SHA512 b24b4aaf790ad1f6c9d19275f6c524cb936bd833a4c7b1254d462a4f61d2035c0957b14b9064ae5b05167694f27d229434cdf0136c3b953f9128e58cca4fd542
SSDEEP 96:MkbJ0d+CNkx/Fc5vBh2F8vIfjnNACrGSl8h4otop5VBDzB6nGyv1fQBFv1QzbojY:Mkt01N2c6ARiU2btHwQBF+ELIULrU5b
TLSH
T109C10876786CAC3348F3D559B5132B43CEB4616BE611AEA4EBE94F0C11D75E81382522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 30697e750b4899af2893599d372b70b049b95e7b733f708ec39456f1466989e6
MD5 952d970268e03a61a50b0ebeda0a6016
SHA1 8142316b25fc1c33b0306ae773dd875f66e0dfb9
SHA512 dedde7322e7389fcc3b948a7bf189453b7faa28ea8b836ec29a80cb983524eb5aef1be058a2fad2dfc09cb912f8417939fd5dec266713ab5f7e9dc392f70d221
SSDEEP 96:MkbJ0d+CNkx/Fc5vBh2F8vIfjnNACrGSl8h4otop5VBDzB6nGyv1fILIULr0j9IZ:Mkt01N2c6ARiU2btHwILIULrU5y
TLSH
T1F7B1F776A86DAC3349F3D949B5032E43DEB4616BEA11BE94EBE94F0C01E75EC1382513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download