hxxp://fire-quip[.]co[.]za

Resubmissions

27/08/2026, 04:32

260827-e6grfsdl6w9

27/08/2026, 04:32

260827-e54vlazanf3

27/08/2026, 02:26

260827-cwzs6scr713

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
122s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://fire-quip.co.za
Sample260827-e6grfsdl6w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5336	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322788174160784"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4888	4608	chrome.exe	87
PID 4608 wrote to memory of 5336	4608	chrome.exe	90
PID 4608 wrote to memory of 3952	4608	chrome.exe	91
PID 4608 wrote to memory of 3952	4608	chrome.exe	91
PID 4608 wrote to memory of 2520	4608	chrome.exe	92
PID 4608 wrote to memory of 2520	4608	chrome.exe	92
PID 4608 wrote to memory of 4100	4608	chrome.exe	93
PID 4608 wrote to memory of 4100	4608	chrome.exe	93
PID 4608 wrote to memory of 3000	4608	chrome.exe	94
PID 4608 wrote to memory of 3000	4608	chrome.exe	94
PID 4608 wrote to memory of 2772	4608	chrome.exe	95
PID 4608 wrote to memory of 5652	4608	chrome.exe	97
PID 4608 wrote to memory of 1540	4608	chrome.exe	96
PID 4608 wrote to memory of 5652	4608	chrome.exe	97
PID 4608 wrote to memory of 1540	4608	chrome.exe	96
PID 4608 wrote to memory of 4628	4608	chrome.exe	99
PID 4608 wrote to memory of 4628	4608	chrome.exe	99
PID 4608 wrote to memory of 4184	4608	chrome.exe	100
PID 4608 wrote to memory of 4184	4608	chrome.exe	100
PID 4608 wrote to memory of 2656	4608	chrome.exe	103
PID 4608 wrote to memory of 2656	4608	chrome.exe	103
PID 4608 wrote to memory of 1532	4608	chrome.exe	104
PID 4608 wrote to memory of 1532	4608	chrome.exe	104
PID 4608 wrote to memory of 5216	4608	chrome.exe	105
PID 4608 wrote to memory of 1424	4608	chrome.exe	106
PID 4608 wrote to memory of 5216	4608	chrome.exe	105
PID 4608 wrote to memory of 1424	4608	chrome.exe	106
PID 4608 wrote to memory of 4112	4608	chrome.exe	107
PID 4608 wrote to memory of 4112	4608	chrome.exe	107
PID 4608 wrote to memory of 4424	4608	chrome.exe	108
PID 4608 wrote to memory of 4424	4608	chrome.exe	108
PID 4608 wrote to memory of 1244	4608	chrome.exe	109
PID 4608 wrote to memory of 1244	4608	chrome.exe	109
PID 4608 wrote to memory of 2908	4608	chrome.exe	111
PID 4608 wrote to memory of 4496	4608	chrome.exe	112
PID 4608 wrote to memory of 4848	4608	chrome.exe	113
PID 4608 wrote to memory of 2532	4608	chrome.exe	114
PID 4608 wrote to memory of 2532	4608	chrome.exe	114
PID 4608 wrote to memory of 1384	4608	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fire-quip.co.za
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff89369c728,0x7ff89369c734,0x7ff89369c740
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,5569082099432672499,5116502440702351414,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,14285368269554383597,4060820663045008985,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,5040504041817122726,15046017889888815533,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3044,i,7377724955832215174,5602624363235371087,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,3756926094924661972,12832370653340558588,262144 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,10555180714815745098,8818823956146734857,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5584,i,3557176203636173616,6483914700741675367,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5604,i,8427910049330031439,10243176653384996352,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,10905306221343192602,831173709930762958,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,13785583284703303385,1092828169131677650,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,4470779219584121626,6488957338595041293,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6060,i,207958607926194626,9456582338795886483,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5696,i,13421369652423326369,1189124282107108597,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5904,i,3076347252073352167,15531460613562727759,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3156,i,13330343244780682673,16106525559538378566,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3160,i,13757680432217722874,11830452203332133581,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5300,i,10969774907904428321,9121272107417957450,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,11449198415430559236,10030319215773152992,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,8004131820330240652,2564616631426534884,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,10389970787938113768,16659846273194553891,524288 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3180,i,14632650144100309063,5383415922761055527,2097152 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5584,i,3335955433869098275,1014460033577097455,262144 --field-trial-handle=2420,i,3043568167797550411,3470230021292064139,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:10
  2⤵
  PID:1384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

268359a2-bcdb-443e-9cab-3f7833f0f599.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\268359a2-bcdb-443e-9cab-3f7833f0f599.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 435fc698bd22601fa552c33c403c5bbd97c652cb6089ffce5a46e118df248337
MD5 dcaa396dde6a1d6907c6fcc5e652fc2c
SHA1 57111e423fffb978ca634d4923b8fa0d63776247
SHA512 1ff58daa5ad132d2b1c7a5990fac1d4fec97684445475d9f1b29894458d7231d235b3a9ca1864eebdd761c332a1f359a904f0f953cb6ccf923e0ad26c1b38636
TLSH
T11031AFFB83B4857D8A1192E4DB11AF1FCE6D0524031C3876C8D46E1B83E2972D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b774900bd733da680f60e6d645343ee58a604ef30132cd6e8f558c6b4ab284f
MD5 a497c41e6a7f485afe8ccb8f9bd91e55
SHA1 4b177d8f7add6d0a21b3514ae3b3823e7c091dfe
SHA512 09e4a421eb67e63b90883e6251e1be2a0bc6a0223aa5cd546b35e225f74c4a482e93d32b4cbf913fa5dfb09373045ee1edbd5e03fca00c289ecff2973161c415
SSDEEP 192:yROFAquv7zvdPRpdO59EHB3b+WNnpgR1Im2qI+lfy/u9Wb+VyIsnAUgE:yROFBK/dXkmbmv2qPk2E
TLSH
T15042A62EB9506D7B9CDBC229FD21BB93D7F4102221A42E84E7FC892C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 58fbd4e763797d0d2d0c594313c9fbfa7ece38540d35cb52d65d1d5b50b25672
MD5 2f1aa2e952628769bacefeede044c6aa
SHA1 546b1ee5eaa23c51d2516f7dc0622f2879ab72fa
SHA512 11c6c93d5a27c9d0a1e67b6ac19167ada892b2db423f941e113b0f5adbb8346935b30ecae66e14001b94630d00d26d20d1c910cbca9c8bc1e4ad00b1afedd11d
SSDEEP 192:yROFAqHv7zsAPRp2s9EHBLb+WNnpgPqosfy/u9Wl+VyIsnAUge:yROFBP/NX7mfmPqoGc2e
TLSH
T12F42942EB9506D7B6CDBC22AFD21BB93D7F5102221A42E84E7FC892C15E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ced1336a93bc54827699e430eaf19424e3617982b80f2caad17a1c2bec67bfc1
MD5 4b3dc9b69e0a785b6df95453f609c76b
SHA1 08c95f1897420e639df344475cbc8989ce96ce16
SHA512 2712d44d25f9e32880c154c3a727db4c63c27f3bbd6c693ff0c7745c3821bcac18fe1edbafce3253ff8ced0f8ab9b4bc73e41e8ac6fbbdeee2084d0ebff6f79e
SSDEEP 192:yROFAqHv7zvAPRp2Ob9EHBLb+WNnpgPqosfy/u9Wl+VyIsnAUge:yROFBP/6XZmHmPqoGc2e
TLSH
T1A242A52EB9506D7BACDBC22AFD21B793D7F5102220A42E84E7FC892C15E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c166dc86cd3c9bce0579412e19bd0fc53025216ae353aee7878b134859b84bb6
MD5 f46abf135198f3b11c43174abcac7273
SHA1 911943f5cb71f8bf8b2fdb998e81e1dee728c824
SHA512 bb662911beb4bd5e90bb4da0340088746f38aa00f321a2c8ccf5e48b19daf8bedd2c46a5901734c6c56b8e5e3d6abe558ee3a6bf44e6be9f6b75686bf1912939
SSDEEP 192:yROFAqTv7zvAPRp2O59EHBvb+WNnpgR1Im2q9Cfy/u9WV+VyIsnAUgE:yROFBr/6Xbmrmv2qmw2E
TLSH
T1FA42952AB9506D7BACDFC22AFD21B793D7F5102221942E84E7FC892C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 126fecbc979615da093f5dada127be8476f153dbe5acc612fd975ce864a0af5f
MD5 348ff208c339f18d5bb60120ad33d375
SHA1 3ebee78fe4280e83d519e17199e6bac537044d53
SHA512 3e46102b32c504447d105400538af36ae2795305575749e4d655c7d30d3eb0c38dc122a7e12961c785aafe41ec44a5c808878a4feec196e8e5a08d2fdad77bf5
SSDEEP 96:jbJ0d+EZUAbKFKu0d6aF7QuGJfmb7c3QvSl8h4otop5ZND0B6GGyvnpBkeZmtQ2x:jt0PtbKFKu00UUSbvtiU2v4SMBkSmtQm
TLSH
T154C13BB1E8A98C7349F6E655F8022B03CEB0616B59555F90CACE0F1C01EB1ED1343237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3dd5c65d6115a1336a6aeed07dde0c7c5ddb7ebd96da20df466842d4919e4378
MD5 e6aa89984e569d3f6e069e40a4c97b2e
SHA1 2252593b5d93092d9fa5359f7e0fdc8961ec4eeb
SHA512 fc92fc4ba0fe72a7d036a5ea8234d4676724b6571b25a865d729d8632a5fc1460c2018b624372df950b7aac4b3aa10f01b9a01bf0a9962b5b576b4bf312bb0c6
SSDEEP 96:jC0d+EZUAbKFKu0d6aF7QuGJfmb7c3QvSl8h4otop5ZND0B6GGyvnpBkeZmtQ2OU:jC0PtbKFKu00UUSbvtiU2v4SMBkSmtQm
TLSH
T14FC12BB1E8A89C7349F6D655F8022B03CEB0616B5951AF94CACE0F1C01EB1E91343237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b2f9179475ea940fe914f695f66dc0b447c2e327c742df1644772fc5db02a7a9
MD5 7fbd0fd5abb7cfb4a6c08bccd21613dc
SHA1 4f35ac3499194cd49a6869551c1d1e59b85c13b3
SHA512 76078f4cdd5042b28a5b81598ffec033d7cbf1559af04f4ee1543fd62d82c45ca196490fd8ec5e8c750a0f212592dac391db2f8d441c1d020132b12390c04e76
SSDEEP 96:jbJ0d+EZUAbKFKu0d6aF7QuGJfmb7c3QvSl8h4otop5ZND0B6GGyvnp202OW0j9z:jt0PtbKFKu00UUSbvtiU2v4SM202OWUz
TLSH
T1BFB12B71E4AD9CB359F6E549F8032A03CDB0506B9965AF64CADE0F1C01EB5DC1347123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 68f006a5b36c0ce34b94820bcbe3d87b8d6365d213b29f2d086b5ff90d73c951
MD5 27ed18598d20ae683061614da0572881
SHA1 48e96b94ccd97b9507588b4d27c3f42058938c2e
SHA512 972da1c402137510fd185ded27cadec18ed749fd0716d1c02bea2405eed73cbf8e696367a8941efb5e40d541a488c90b1ac30d57a28edc82cb25a706b4da5ff3
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5ZlD0B60GyvnnXOlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDj4ECXOlbK7
TLSH
T19FA12B72A4698DB359B5D549FD622A03CF75E12BAD229F54D9DD0F0C01FB0D80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download