81aae87aa8691616a1e077696f29cbdfa1ac20d1cd0ba1b6356119312d2ff741

Analysis

max time kernel
900s
max time network
892s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Katarina_Launcher.exe.html
Size 38KB
Sample260908-t5azvagg32
SHA256 81aae87aa8691616a1e077696f29cbdfa1ac20d1cd0ba1b6356119312d2ff741
MD5 1e1483941270b063b2d6b595b0292e48
SHA1 c48b50184475707971ee108873b8d0a3177dc48d
SHA512 ac8905f8bf6a5477e589fa26c9a2ae01e5558db4fd063eca0983adc030f5b1e14a388ed58f5e5bd5ad8103b10ff07f66c7b1f88dc7d2069eee52aaf6db85d466
SSDEEP 768:63++3DZVtXYcw6EGJGDFsqFGORAgA6FSGLE/aA:A++3DZVtvFNgA6FSGLrA
TLSH
T1C4032B8968F31026A99359DC37630B5D76458643CA12DD677BDD02B0DFCEFA268A334C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333592839436253"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
6664	chrome.exe
6664	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 6480	984	chrome.exe	87
PID 984 wrote to memory of 4220	984	chrome.exe	89
PID 984 wrote to memory of 5116	984	chrome.exe	90
PID 984 wrote to memory of 4220	984	chrome.exe	89
PID 984 wrote to memory of 3564	984	chrome.exe	92
PID 984 wrote to memory of 3564	984	chrome.exe	92
PID 984 wrote to memory of 5124	984	chrome.exe	93
PID 984 wrote to memory of 1616	984	chrome.exe	94
PID 984 wrote to memory of 5124	984	chrome.exe	93
PID 984 wrote to memory of 1616	984	chrome.exe	94
PID 984 wrote to memory of 4320	984	chrome.exe	97
PID 984 wrote to memory of 3064	984	chrome.exe	98
PID 984 wrote to memory of 4356	984	chrome.exe	99
PID 984 wrote to memory of 6664	984	chrome.exe	100
PID 984 wrote to memory of 3416	984	chrome.exe	101
PID 984 wrote to memory of 3416	984	chrome.exe	101
PID 984 wrote to memory of 4852	984	chrome.exe	102
PID 984 wrote to memory of 6568	984	chrome.exe	104
PID 984 wrote to memory of 6568	984	chrome.exe	104
PID 984 wrote to memory of 6992	984	chrome.exe	105
PID 984 wrote to memory of 6992	984	chrome.exe	105
PID 984 wrote to memory of 4504	984	chrome.exe	108
PID 984 wrote to memory of 5876	984	chrome.exe	109
PID 984 wrote to memory of 4504	984	chrome.exe	108
PID 984 wrote to memory of 5876	984	chrome.exe	109
PID 984 wrote to memory of 6696	984	chrome.exe	110
PID 984 wrote to memory of 2724	984	chrome.exe	111
PID 984 wrote to memory of 6696	984	chrome.exe	110
PID 984 wrote to memory of 2724	984	chrome.exe	111
PID 984 wrote to memory of 472	984	chrome.exe	112
PID 984 wrote to memory of 6412	984	chrome.exe	113
PID 984 wrote to memory of 472	984	chrome.exe	112
PID 984 wrote to memory of 6412	984	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Katarina_Launcher.exe.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf9cbc728,0x7ffcf9cbc734,0x7ffcf9cbc740
  2⤵
  PID:6480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17826857838368858876,14607907886157896438,262144 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,16025646436187876432,6746570753504290411,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,14971138107295212397,1434605628478704189,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,5631641046064953896,16943756909105439001,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,11649100455208651492,10811208417370959797,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3896,i,7622592890704876996,5147597201410360979,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,8449414622908365538,6991133165581851544,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,9285445572494587500,3190567957525036887,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4968,i,8068824950118930880,14567560659665667379,262144 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,7189241302612022820,1410828631185845731,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5652591165439018431,15478728678201547841,524288 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5700,i,9923033123932631692,12005348858789977719,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5756,i,5000337684941130022,12782457924098892264,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,6032699024068983849,5536651162679086533,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5988,i,8632955777419105608,17200026192561891651,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5968,i,13837043385108538708,11001460012867472962,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5708,i,10730771107038330740,11616085492356599455,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5740,i,16357746060777142255,12611351945182030299,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5800,i,9372027128458983300,4570241704422225509,2097152 --field-trial-handle=1924,i,3410529104171815213,16049749675396808911,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:6412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4804

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2717d88b180edbff4d74fe21f5d375b8181e55c353d2a18d4e67095f013e6337
MD5 f2ee4a8977b5575363330b2d15ee59ec
SHA1 83b6a705c7d47d6d7d3c77b1b3e53193521469fe
SHA512 17d41bec70b66589d336946d7ca4a0d2a68da2f71dfa9e509f6fad2b398f15ee75d57fa2a49c8ae9299045138e9a85e0a6efa4523623ad77b5f1f5253fdfdd88
TLSH
T1785181FBC3E4867E890151F4AB156E1FCD2E0516432C3CA7C9E46E1B63E2571E24169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c1971f10b80461787f7a9076e3ca8db18329f4bf84ebf91fe40b6530b7293554
MD5 503594611e01673700bfcbac6b95dae1
SHA1 6aa7df2e0044a812be65e7defa418f8aeded1866
SHA512 d591c3646a84427825e2799b2fdb0c8aa28e0f762398ae120d5bd4fedf01eb68a822b4f242fb1f764bec57437975f5858ebd5b11c6beb0e4511a5e54f3099de0
TLSH
T1C5517EFBC3D4967E890192F4AB256E1ACD1E4516432C3C5B88F46E5B63E28B1E20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0a37936d95224aff3d3d3a5bde587b1817b82c0022661493d6b02e1e07bc3dbb
MD5 029ee8a52053e3a71e8f016fe07a791a
SHA1 f0874bfd53bc8d0e38974275daa83668c2bf5847
SHA512 9b7d7cd20117aad709e9fe0f514ab92c234e1767ce966be734241597dd21506f65cffbbe4b102b2d1f861983ab1ced6b4149ae31358d65b43cc84db5ad50874b
TLSH
T1C051A0FBC3D4867E891152F4AB256E1FCD2E0516432C3C5B88E46E5F63E2971E20169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 f1bc25734e259178a2510bdf4180a7ec47c847424311646d4feb9ff80ae46073
MD5 7eed9a2ee40714926dcb8ec4b29c375a
SHA1 385d3c236aa4a0c87fd54438f9fc8514933ffdda
SHA512 1003988af9fdbe8f1a0abcce763bddac878a3bec02dd654087b767bac3b5d044e6560d85ab2845e4a8ab8c7649127105b0cded9232be604ca50354b7d146dd46
TLSH
T1F3118E63E77DB4BF117D1DAB5D81B8011BBABC3106516CE8DE66426DB0C05F30E16413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 626987d10ba83ced0ca88c872a716a7891a04ece6b8c1b7553eb05596c40ce59
MD5 24725058f148b8b92b0200cf4f46c8da
SHA1 c797c54a0a6972b1d5e404883c2a5a713cb451a2
SHA512 dceb89e218e3984c0730069d582ef8e0244686714897a86035d1b870b1a803bb547e9cada6e192f482aaf0bfa1833fc892d8a117e90590e2fcc1721cfdf132e2
SSDEEP 192:+R8xRNav7FTvAPRp2CH9CHsb+WNnH+yPgeeCkwAEN/W+VyIsnAUgR:+R8xj25T6XzkweyPg1CgmW2R
TLSH
T16B32B72EBA50287B9DCAD21AF9117B93E7F5202672D43E84EBFC892C10D75DC2127407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b7ac991bf3fb79b3ec6fedae5aedca4d20a3409da7b89f5fc8fa1f60684153e0
MD5 bf013a04e3d42af5c8c675814a3a1dc8
SHA1 7e2a1d053e6f365b0d42a322da312b785f1a4918
SHA512 ff2ef4f997f75c41866129b367caa42b2e938935f3b01e1cb76877f173c528a67c8ac0119019f9c95ebe8909c5ba954e1ad153a2f4b3c3ab02defe8a765d751f
SSDEEP 192:+R8xRNav7FTvIPRp6CH9CHsb+WNnH+yPgleCkwAEN/R+VyIsnAUgR:+R8xj25TiX3kweyPggCgmR2R
TLSH
T16642A72ABA10287B9DCAD629F9517B93E7F5202272D42E84E7FC892C10D76DC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 98c4bec325d615ff1a1665d059fcdea98807d254ca5127c8d3b014a133299a2d
MD5 82ed8e63a7d8adc2aac5d8a879eeaa0b
SHA1 aa4080f30f949dea7df88a6e5128940537bf221f
SHA512 e1da174036d1090cc42b0142b45b7c06a530695fdfdb84706c82ac40ab6d199188da10ae979c0ee18805a8f69f37d3c522a6f2680034862b79bbe251d4e41e44
SSDEEP 96:MEMbJod+CNkx/Fc5vBh2F8vIfjnNAcrDSl8h4otop5xBDeB6qGyv1fNbwI3lj0jl:Mxto1N2c6A8iU2veywxwI3ljU5t
TLSH
T165B10A32A85DAC7359F3D559B5032A03CE74616BA911BF94EBE90F0C01EB0FC2382913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4c0d2326df3fed625796a1d2100d58f835f46e0763b7bfc9c0d10d34c6e41cf8
MD5 f9e37359d65492c5513c7561145e8dd5
SHA1 4772419f061f0a9f017712be13e8ba73ba75230c
SHA512 f93dfa999607b50e199c8c3206894e5811ede86a672d68771d126bde6817da007a8df306b6f1e43c3323e8dad76a8252b3db83a36999275bb9abb63ac1249250
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5xVDeB6xGyv1T53lqbKv4a:MkC01N2c6AGDDUD3e1U53lqbU
TLSH
T1CCA1F832582D9C7788B2C949B6522E43DEB8712BF921BF94E6ED5A0C11B70FC2381917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6c3012a951041838718712db45a522361c3f36ebd43fa633f2f8aa6db76cd200
MD5 64c37ff63fd07838553cbee503718275
SHA1 553e2ee3481c75aebe4c7b292703bef031d67a59
SHA512 57ac48920afa85a5181a04fe617104187ac533639fc33759295187865925e19455dbfa87bf572e9ead28ff55e1b010d40c85645c9f4a2ea0c65ef33c88decab2
SSDEEP 96:MEuC0d+CNkx/Fc5vBh2F8vIfjnNAcrDSl8h4otop5xBDeB6qGyv1fQBFv1Qzbo6u:MRC01N2c6A8iU2veywQBF+JLI3ljU54
TLSH
T169C10A36A86CBC3358F3D559B5132A43CEB4607BA511BF94FBD95B1C01EB4E82382913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5924f37e77ceebae349b143d3641843b49e7daad7d15df86d52aaa94d411a352
MD5 afc8807d6a1c47eafd29512e0b5a1aaa
SHA1 40f300828fb1c5117264cf022f6027b9912840ef
SHA512 5017f808182e2a9155791f17d8568dc87775f55719f3a67c78ae6bac1eba40673b5e6e98c257bd57457dad7364745e6d8352e1b5dc49712956c15ac92d93463d
SSDEEP 96:MEubJ0d+CNkx/Fc5vBh2F8vIfjnNAcrDSl8h4otop5xBDeB6qGyv1fQBFv1Qzbo/:MRt01N2c6A8iU2veywQBF+JLI3ljU54
TLSH
T179C10A36A86CBC3358F3D559B5032A43CEB4603BA511BF94F7E94B1C01EB4E82382913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 13089f945b91d1565f3496b04826713662185279d9eb65db3ee8467bb1d39f65
MD5 d83b14d21bac3d3e961605ee21e24c25
SHA1 70c9aa30cb0de205afdec5a25e32811aee5f70c4
SHA512 48bd94265131f921775c7d1f99acccb13fd3f3a810ed5880cd67b431a04367a77280c6a671869a69191e08d40ed0f9296c4f7f156881e370cae6a89bdeecc684
SSDEEP 96:MEubJ0d+CNkx/Fc5vBh2F8vIfjnNAcrDSl8h4otop5xBDeB6qGyv1fmLI3lj0j9L:MRt01N2c6A8iU2veywmLI3ljU5t
TLSH
T173B1E932A86DBC3359F3D959B5032A03DEB4616BB511BF94EBE94A1C01EB5FC2342913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c6b67600eae6c7f7c49baa858fcebbc4b8d0843a9a4b83a02ebd0562456ae9b4
MD5 c6c439b87ea8d69046c14aef15464926
SHA1 9a22a133482d852cb94671268eba12cb234fb3a6
SHA512 329544c7f22cbbc48aacec668eb1f719e3b6bc83c7d208e44570de4de5d752c0e87baf762f3efa62b0b3da9d82aaaaca803a9f8cbd5e69d8dd8045b7271f95ef
SSDEEP 96:MEMbJod+CNkx/Fc5vBh2F8vIfjnNAcrDSl8h4otop5xBDeB6qGyv1fNb9I3lkJR3:Mxto1N2c6A8iU2veywx9I3lMu8GjC
TLSH
T18EC1D832981DAC779DF3E54971032E43CD68616BA911BF64FAE95E0C01E74FC6382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download