d62fd55ac4789d9911124b047afe7d83265b6c63c312d4c34f44ca0df602e845

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
painel-soc.html
Size 7KB
Sample260804-a3e18sszfx
SHA256 d62fd55ac4789d9911124b047afe7d83265b6c63c312d4c34f44ca0df602e845
MD5 61d9fa7efbe89e1a422827236ff54c61
SHA1 65e6631f7c64ca15102c9082350f9024ec060ab5
SHA512 a992f1a7ef7cd5650375a3a090cfa6f874a43e718081ac39f1c9eae45eed54124ce5465ffe26769d01bb22a50ea202ff529d67fad0b50dabbf9ed592efcfa9a8
SSDEEP 192:ny9s8f/3gjsTd77LWp5rBu1yRDcpQ/oLnVSKgKU7iHptD:6PR6aEhVBM
TLSH
T159F153ABB37714322D33A09977DF534A2550A107D406CA88BBCC66548FCBEE3E99674C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302778752758185"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe
Token: SeShutdownPrivilege	2844	chrome.exe
Token: SeCreatePagefilePrivilege	2844	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe
2844	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1996	2844	chrome.exe	88
PID 2844 wrote to memory of 4580	2844	chrome.exe	90
PID 2844 wrote to memory of 2012	2844	chrome.exe	91
PID 2844 wrote to memory of 4580	2844	chrome.exe	90
PID 2844 wrote to memory of 2904	2844	chrome.exe	93
PID 2844 wrote to memory of 2904	2844	chrome.exe	93
PID 2844 wrote to memory of 2756	2844	chrome.exe	95
PID 2844 wrote to memory of 2752	2844	chrome.exe	94
PID 2844 wrote to memory of 2756	2844	chrome.exe	95
PID 2844 wrote to memory of 2752	2844	chrome.exe	94
PID 2844 wrote to memory of 3808	2844	chrome.exe	96
PID 2844 wrote to memory of 3808	2844	chrome.exe	96
PID 2844 wrote to memory of 2456	2844	chrome.exe	97
PID 2844 wrote to memory of 2456	2844	chrome.exe	97
PID 2844 wrote to memory of 3092	2844	chrome.exe	98
PID 2844 wrote to memory of 3092	2844	chrome.exe	98
PID 2844 wrote to memory of 2552	2844	chrome.exe	99
PID 2844 wrote to memory of 2552	2844	chrome.exe	99
PID 2844 wrote to memory of 5772	2844	chrome.exe	100
PID 2844 wrote to memory of 5036	2844	chrome.exe	103
PID 2844 wrote to memory of 1848	2844	chrome.exe	102
PID 2844 wrote to memory of 5036	2844	chrome.exe	103
PID 2844 wrote to memory of 1848	2844	chrome.exe	102
PID 2844 wrote to memory of 5932	2844	chrome.exe	106
PID 2844 wrote to memory of 5932	2844	chrome.exe	106
PID 2844 wrote to memory of 2684	2844	chrome.exe	107
PID 2844 wrote to memory of 2684	2844	chrome.exe	107
PID 2844 wrote to memory of 3564	2844	chrome.exe	108
PID 2844 wrote to memory of 3564	2844	chrome.exe	108
PID 2844 wrote to memory of 5980	2844	chrome.exe	109
PID 2844 wrote to memory of 5980	2844	chrome.exe	109
PID 2844 wrote to memory of 2328	2844	chrome.exe	110
PID 2844 wrote to memory of 4684	2844	chrome.exe	111
PID 2844 wrote to memory of 2328	2844	chrome.exe	110
PID 2844 wrote to memory of 4684	2844	chrome.exe	111
PID 2844 wrote to memory of 1336	2844	chrome.exe	113
PID 2844 wrote to memory of 4736	2844	chrome.exe	114
PID 2844 wrote to memory of 4720	2844	chrome.exe	115
PID 2844 wrote to memory of 4796	2844	chrome.exe	116
PID 2844 wrote to memory of 5468	2844	chrome.exe	117
PID 2844 wrote to memory of 5468	2844	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\painel-soc.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbdb32c728,0x7ffbdb32c734,0x7ffbdb32c740
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,18124737800837282311,18160484991800973126,262144 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,7499271980820229221,13356828952752044506,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,16862566047546884305,6912027639814959206,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1538609076925252816,6413791493498716360,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,2265770781229083312,893538335722272554,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,5667249533073793590,11507451568331434743,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4456,i,16030758636431312663,8052566169947876530,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4612,i,10798366770540940531,531157001431094948,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4780,i,2787786692751903059,5585110438380064551,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,9898331738461169257,7348788154502671986,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6656,i,3735211920829652983,4330919123913273209,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6668,i,17263047340805806530,4932981934327483509,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6984,i,3768359896610747427,6791797888425526699,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6972,i,2215062512305646733,1576429329844812742,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=7036,i,14111408457283028184,18106908611671606659,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=7076,i,10215417578120528723,18373843012994836809,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6928,i,16978520860388439839,7438449981166348137,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6724,i,4611607485991968101,12494954335263429265,2097152 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,13677987606232271294,12491515905848182197,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,2629148715473853592,8769370966867981674,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,12200619585945667113,2131489713299302483,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6248,i,17216600472985624766,16390708155858760517,262144 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7048,i,10456519880930509448,4890393535711637889,524288 --field-trial-handle=1916,i,8782742406002193227,5770726027594693601,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:5468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5bbeccdc-c601-467a-9044-95ec2137e698.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5bbeccdc-c601-467a-9044-95ec2137e698.tmp
Size 11KB
SHA256 fa7b96c88ec85df5ac19d3db48d4116b0d8c8230b70a047a23cd346194a532fb
MD5 8e51a353a5b4e7b5220bcc10c2f42041
SHA1 cac489c4f8ca31d2048d494b86a3992f05dda664
SHA512 611435e5d0b37e0d9c8b238e6ab7dd5f736323f477d43677c62d5483aef523c7f922e083ad8f00fa7736afb8322f25c6669807e5266f9baece0bec4b8a1b141f
SSDEEP 192:3RwPEqgfhQVUv7YvAPRp2E79SHsb+WNnxz5P75KeB2l6aVyIsnAUgR:3RwPEThQVQ06XFEwF5P7j21R
TLSH
T19732B72EA954293B6DDBC22AFE257B93D7F6102235903D84E7FC892C25E36CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 21d8eb47e0413186484cbb247359a13c455ca0a5ca5b835d1a3609dbd7a46fe6
MD5 d58eb020e12f26358059a7267215736d
SHA1 d9e5e9beed2275125eacf3ff1f813ee8e3bdd2a1
SHA512 60f4881ca8f3a48d66e7a57e522ae44dac4206af984e112dbd624ce801bc75c9386bb676ca961d6af49880e767f2c7b0275a62d5f7fab009b90ff42a49bd9c04
TLSH
T1CBF04CB5CD25EC3719FD0BA870980B46E750135B3B81889F3B3D910C8FB0A3B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 306aa5b56281db5b38a17325a34a69d5176df17fb25860ed22c8feb8b7cd9d8f
MD5 a6253c7eed70020ce9ac85100dc587ec
SHA1 ec521293be3fc18c90d6700b94d1d0cb39aee3c4
SHA512 8cd0bfe7db326f56e8478e1916b5e94354282064da2350b6486ee032e3a3280b335f99f7977b7e599641d75a59595b97e2e751acae32cbc4892a92ca38886030
TLSH
T1D84179F7C7D8957D890156F4AB157E2BCE2D0A18432D3C66C8E4AF1BA7E2871D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e21fa0b42ae8631dad447c4e6bda09fa31614f77239c23fc6ad225db51190702
MD5 d5cfb7dba56db1a85789d8392c50d6ee
SHA1 bb7b5e7ee46c391aea1f3cf56953fdfec0182968
SHA512 46ac779829a41f48f0493567cb9f65a661763460e64fd36cf1aa7413978b4b7f176e691484e8ecdfbf1451ecef6b12fc3270257dd07efd6062f2b7529fb0a9eb
SSDEEP 192:3RwPEqgfhQVUv7YvRPRpEE79SHsb+WNnxz5P7/KeB2l66VyIsnAUgE:3RwPEThQVQ0BXzEwF5P7B23E
TLSH
T14042D82EB910393B6DDBC229F9257BA3D7F5102225903E84E7FC8A2C25E76CC6217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6cffe458d502b8a853567abc5a0c0a2020b76b7353066514f83e59dc5d0d9a63
MD5 8d4d7c89df63c3d4fc0acb7cb28e0dc6
SHA1 c6964f3948e7baa8025dcb5a2218a2875b94e9ac
SHA512 b1c6d2e440d061d2bb213cb087bf3d126bc34425a5541e7b096ebdd0514a2f18b7f246f75022752b2c8a55d1eb42cc5f9bb9aa29c3903974c14d3d37152147ad
SSDEEP 96:nMbJ0d+VUJ7oKfVHrSJEYvNVHkSl8h4otop567DzDB6jGyvP/e4eZVOPRNC39Q84:Mt08UR5rYvLIiU2K5rae4eZVOPuHVxdm
TLSH
T112C1F8B6E46D8C7B4DF6A48170032E47CDA9607FA5647D68EEE85E0C02E74EC5342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d10c0fda0d25de80d086a3d1d67fbcd685efd63297d8440107a73ee1921c6f09
MD5 b8df2508a888ebe39869fba0d48e5047
SHA1 77addbc69dd950d074238047edb4ca25ca415fe8
SHA512 244daf915d7358afe099c8c0c3a1cd5e4dd175d49a6825ef8182ff534225bb76f72a31a8d107100a635e9819355d4f95eb7e44745ffa004d044efed82dbc61da
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvNVHkSl8h4otop567DzDB6jGyvP/e4ilp1GiNTRHVOF1:MC08UR5rYvLIiU2K5rae4ilCcTRHVOF1
TLSH
T1C5C109B6A8AD9C7759F29485B0076B47CDB571BFA650ADA4EAD90F0C02E71EC1342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7991fccc41e1e816c77c88618e063b6cad3b33d513968355cb3bbb4943a5f408
MD5 16e6fcdc0fc1867db72b57d1ac7980f2
SHA1 834b1aad3c4b14520a4a7ad6dff7c40269558143
SHA512 454cb9417756db01986de0f096099d416a82c1678cc3f6b19e329f806283f72b2c0026c1e4908801c713dab48c7545b108406bd9f5f7b8790b3610cd575db2d8
SSDEEP 96:nMbJ0d+VUJ7oKfVHrSJEYvNVHkSl8h4otop567DzDB6jGyvP/e4ilp1GiNTSHVOD:Mt08UR5rYvLIiU2K5rae4ilCcTSHVOF1
TLSH
T152C10AB6A4AD9C7759F2D485B0032B47CDB5B17F95509DA4EEE80F0C02D71EC1342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2244ecad8fd84559cbba8a381693a9f2e4965c7ff8757d125c143dc59d1211ec
MD5 bb897d478e86c232c64e3901ff9f22e1
SHA1 12c4781ad4fb45be64f983d2e1614e13ce3aa3df
SHA512 98f180093dc4d77cee053295d4dd8656ce1801aca3b9a652e12da72888873cba5aab76f576adaa11a21637732348a0345c49c289f345c96acfac4da77dc93147
SSDEEP 96:nMbJod+VUJ7oKfVHrSJEYvNVHkSl8h4otop567DzDB6jGyvP/e4eZVOPRNC39Q84:Mto8UR5rYvLIiU2K5rae4eZVOPuHVxdm
TLSH
T1B2C109B2E46D8C7B5DB6A48570032A47CDA9607FA5647D58EDE81E0C01E74EC5343623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d4ad176b97d4dfbdd2b15b6ee15abfd0b5fafa0bcf37986ccf60c012a45a7837
MD5 5d19f6ebf37c75d372d7363a8118d864
SHA1 3313e36ad2631ec70934a286111d180c8dcfefaf
SHA512 ea9ab7dfc4351a6a23a4244cee12041d1e34a11b3368f9ed30f62af6b636e61a7bab830c1b36a5dd5ca6817e9198bd0d13f7b683187fecc48d1d8004875d5ee5
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok569DzDB6EGyvP/e+0OZPEOLv4a:MC08UR5rYv3eDUDA5gae+0OZsOP
TLSH
T1A0A10873E46E8D7BA976C485B1062B53CEB5B07FA521AE90E9EC1F0C02E70EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download