hxxp://triggerfyre[.]com

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
31s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://triggerfyre.com
Sample261020-28b1baxtaw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2472	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4368	3448	chrome.exe	89
PID 3448 wrote to memory of 2472	3448	chrome.exe	90
PID 3448 wrote to memory of 1812	3448	chrome.exe	91
PID 3448 wrote to memory of 1812	3448	chrome.exe	91
PID 3448 wrote to memory of 6100	3448	chrome.exe	92
PID 3448 wrote to memory of 6100	3448	chrome.exe	92
PID 3448 wrote to memory of 3372	3448	chrome.exe	95
PID 3448 wrote to memory of 5064	3448	chrome.exe	94
PID 3448 wrote to memory of 3372	3448	chrome.exe	95
PID 3448 wrote to memory of 5064	3448	chrome.exe	94
PID 3448 wrote to memory of 3572	3448	chrome.exe	96
PID 3448 wrote to memory of 3572	3448	chrome.exe	96
PID 3448 wrote to memory of 1172	3448	chrome.exe	97
PID 3448 wrote to memory of 1172	3448	chrome.exe	97
PID 3448 wrote to memory of 1312	3448	chrome.exe	98
PID 3448 wrote to memory of 1312	3448	chrome.exe	98
PID 3448 wrote to memory of 5060	3448	chrome.exe	99
PID 3448 wrote to memory of 2892	3448	chrome.exe	100
PID 3448 wrote to memory of 2892	3448	chrome.exe	100
PID 3448 wrote to memory of 5660	3448	chrome.exe	101
PID 3448 wrote to memory of 5660	3448	chrome.exe	101
PID 3448 wrote to memory of 2776	3448	chrome.exe	103
PID 3448 wrote to memory of 2776	3448	chrome.exe	103
PID 3448 wrote to memory of 4232	3448	chrome.exe	104
PID 3448 wrote to memory of 4232	3448	chrome.exe	104
PID 3448 wrote to memory of 3028	3448	chrome.exe	105
PID 3448 wrote to memory of 3028	3448	chrome.exe	105
PID 3448 wrote to memory of 4488	3448	chrome.exe	106
PID 3448 wrote to memory of 4488	3448	chrome.exe	106
PID 3448 wrote to memory of 5388	3448	chrome.exe	107
PID 3448 wrote to memory of 5388	3448	chrome.exe	107
PID 3448 wrote to memory of 5012	3448	chrome.exe	110
PID 3448 wrote to memory of 5012	3448	chrome.exe	110
PID 3448 wrote to memory of 3716	3448	chrome.exe	111
PID 3448 wrote to memory of 3716	3448	chrome.exe	111
PID 3448 wrote to memory of 1084	3448	chrome.exe	112
PID 3448 wrote to memory of 1084	3448	chrome.exe	112
PID 3448 wrote to memory of 820	3448	chrome.exe	114
PID 3448 wrote to memory of 4416	3448	chrome.exe	115
PID 3448 wrote to memory of 988	3448	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://triggerfyre.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff923eec728,0x7ff923eec734,0x7ff923eec740
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,14973464876663445775,15944235407649730068,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1941926410915440466,14220269903791662790,262144 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,1679518694209891735,7144584460801924761,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3012,i,12565295684613436873,10706213898044387644,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3020,i,17492736655090547960,15449331669837395793,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,16688953434222137228,10463069584315569080,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2956,i,10941954547976795770,12305077100828943084,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4828,i,18378190816855340875,14897471255944890738,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,2731507016910653972,10178506198804993437,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5556,i,16524588630353283131,1337710370437051476,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,2441228357318635420,7489473775848104511,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5736,i,4395595030492306770,9293073850151770802,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5992,i,4405817957913285478,11981638277081095143,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6136,i,8698922849867205045,1115615299529948965,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5984,i,12156136761949942195,5648180522842726146,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6432,i,15518628720681819608,12277758216211939414,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5796,i,8808304957208854238,11126313960787227285,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6036,i,6803802666281199394,10723753904782428870,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6480,i,4740027564915789729,12243754652525662554,2097152 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,10954064199889941987,7661645817673248114,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,9764970976232092891,12821340521547495969,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,4440922872714017656,8002661315981853221,524288 --field-trial-handle=1908,i,13736002485060832351,9939405050038122062,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6272ae37-faa8-4697-8fb0-aa8c22520a92.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6272ae37-faa8-4697-8fb0-aa8c22520a92.tmp
Size 5KB
SHA256 98a36de09510b405e32b82eac5da33d3e92d3c1393d211299329cf25c67aa2e7
MD5 edb70d8ab5f25272edd91640ca05f6ee
SHA1 63290445478bbaefd19c19710ac0dcaba68b5c8b
SHA512 7a2dbff43e7dce07886e9f3f9c575488c7876bf144b31b9a157d98224278f3376b1edc325526a607394d57e6aff99196faf8ffbecf8d2a1326d8da998e03c812
SSDEEP 96:NMC0d+U7D/u1i5WFtfvuvsjsSl8h4otop5TqDRB61GyvutKRevO0AoHUAasq0j9G:WC0z7q134vpiU2AnZ7KR2HUAasqULq
TLSH
T137C11A70A86D68B79AF6E545F1031D47CFF062ABA801AE90D9D90F1D01D71FC2343A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

224fa813-987d-42a7-903b-bb06ea7b98d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\224fa813-987d-42a7-903b-bb06ea7b98d7.tmp
Size 12KB
SHA256 8e0c3ce728fd10e490b2324f086a42dfd81a496bc06a1ecad13d78502253d5d5
MD5 7930939c3abb8586eeac26dc13cd1004
SHA1 07dc697a20bde6a4270fe11bbf5bc671003ca410
SHA512 74ed657b4a27f4e9104ec9134f67e270744017a1ce6f7324fe01cb7a4b46f58e1ff4493da66bcab01645687f52bdf7b371d27480fd80f14dadb840e01aff09ed
SSDEEP 192:SRFBnDWv7AvAPRp2AoOq9THy0b+WN5RBKl1nT74WJkvprasIro+VyIsnAUge:SRFBDis6Xy9FG54Wuvlam2e
TLSH
T11E42A42EAD20797F9CEEC629F961BA17D3F5203168D52E84E6FC892C15D36DC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29385932-4bc8-4426-b63f-31846eafa204.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29385932-4bc8-4426-b63f-31846eafa204.tmp
Size 414B
SHA256 03960c023e00e290999653bd5f2fa0c5c56395344fdd93abbaa7f75afea7b0c3
MD5 cd8e22d352755082ed35c9d4e2073ce3
SHA1 ce747c3adb90395a4fb81bc2912987518b427b0b
SHA512 bdb3a729cd7bec06a856c837a6c32b6814dc0ef5e6664618322ebfc3f1ba029f01e3422b9bd15cdf5afbb8414aae51e8b4659dc84033738b4302fef191ed0917
TLSH
T1D6E022ADCA21EC2B09FC4B1860780682FB1507176E904F8B363D850D8FB5A2F81A782C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 109KB
SHA256 00dc4da9bddefb9207d68ed91a425ef0286bc601a94bcf66c31949d3a59b16ca
MD5 42691b59447af358b50cf8c1f646249f
SHA1 695f72abc84873386f7bebe88ea4244c52759bcf
SHA512 08f177ff5dabf406fbfbda7b09d9069387ea302f1726189a18862fba934895ee4f7d3f13d78f43185db9efdeecb204cbdc62db11f6f50b0759d594b996a46ef6
SSDEEP 3072:+B0/i7NEHg0BAFEb/VjH+jbbunGxdtXOPs/:lMNEZBAebtjHunuGBss
TLSH
T1E2B312D3595AA3A90F8229C075685DF35885526D3C1BBEE9EEC1F34184F86D7880B2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 47KB
SHA256 16bd11875dc51565c35b366bf81452eef46d2924a148b0ef5adf354a0f722c54
MD5 d14003fb27dad4881d9c538ca37c5e7f
SHA1 5c286ddaade5baa01528bf8f4b986750b282addd
SHA512 35a43880fb3e05f2e3b5ebb79bdeab56b761cf9b843e5bbb00360af7e0c019b29bc0d95e2fb98fbe55e90d8d4de9043c8bc39bbbe8f321369b0ac05f26cc7832
SSDEEP 768:qbaj8+k6L8yud8RX3Ydr3GQwdFm17tD1CE8bavjegeoX8JOYDjlKzPEpblz4i:q28+pLro4uL+F8IbavjesNQJKDE1lz4i
TLSH
T16C23F1BEA0711C1D3CDB4039D30724D3E657A52AB980A55AEF9BB118361BDC2CF95DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

40dc2e90-d432-4108-9e65-11427cb85807.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\40dc2e90-d432-4108-9e65-11427cb85807.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d3feab94-b6ee-4975-bac3-4cf4b852bdfb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d3feab94-b6ee-4975-bac3-4cf4b852bdfb.tmp
Size 11KB
SHA256 61abad0b9ab114a83375fba12357383f0f44f5a04f064051f660c3b759e7ff35
MD5 ccc952b560b4c98ab5765662578e33ba
SHA1 ef2e23b8fe46fb30215fd6971284c9142442448a
SHA512 4eafe8851407d21272dd2a634f7350b1cd5cf2126cbedb8d74ffcada3d56fa8feddb3decff3d35a4e5e06066422427d4966f6e3319faecca9759402da6fbe98a
SSDEEP 192:eYX4K64y7KxkXqK4I40pUZNCgVLHrKHfFKslE2gOXzKD/XW+ErUkKN9cXcYxSgLu:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOe
TLSH
T1E932EA17A48D9E3F0FE8E51DCC426F8B7CB5016227784D24A2FB5C0803A97CA115A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e32d565e-ceda-43a0-b9a7-ae6cc948425f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e32d565e-ceda-43a0-b9a7-ae6cc948425f.tmp
Size 12KB
SHA256 9944419d26e78cf407df917cf32c4dc45c2d2656fd62870f559a5490be85f236
MD5 af0cea0baf5d7ec55ff827bf718fd87a
SHA1 fa711d4242452b0a61bdc9f3f0052609982bc47f
SHA512 c44d71d5725c419c98f20bb5357a2b5c914ea16e0a0edeb0d8aed4b928d7c2c467847ce2c08dedf66e378bb5c40befb5caffc73fef25c46f93a3631583fcdea2
SSDEEP 192:SRFBnP9v7AvAPRp2A82hC9THy8b+WNKOKl1xTq2/kvprasIro+VyIsnAUge:SRFBP9s6XI9tS22Mvlam2e
TLSH
T17042932EED20797F9CDAC229F921BA17D3F5203169D52E84E6FD892C15E36DC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2ef7bcf-01be-4c0d-8ab7-e512eec3653b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f2ef7bcf-01be-4c0d-8ab7-e512eec3653b.tmp
Size 4KB
SHA256 4510518b9be69ddd0c7aba021fffd0bf300c41d61e77ef943324df18043f15c8
MD5 3db73279a1e58093895706e247da6193
SHA1 35608f701c70c3b4fb6d08c38e8febaf96eabf70
SHA512 758fe0312a9e16a2af3d9ad32dfb4c9b0d983299d89be794148c881fb8b7f7a644f2a37c365586167f9e836524c363f3723a6aefcd1f2a45dd30d89b0714a7fc
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5THDRB6jGyvutFDLsmbYLsv4a:pC0z7q134vtDUD/nf7FDLsmbY6
TLSH
T1AFA10970E87D99BB8576C485F5426A43CFB062BFA901BF84D8DD1A1C11EB6EC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download