hxxps://links[.]lootlabs[.]gg/s?yIk9vLC4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
85s
max time network
87s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.lootlabs.gg/s?yIk9vLC4
Sample260506-1apyvae19k

Score

4^/10

discovery execution

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225764438852608"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000_Classes\Local Settings	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir5480_763507030\script.js\:Zone.Identifier:$DATA	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Blooket Hacks (1).user.js:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 1844	5480	chrome.exe	79
PID 5480 wrote to memory of 1372	5480	chrome.exe	80
PID 5480 wrote to memory of 1372	5480	chrome.exe	80
PID 5480 wrote to memory of 2232	5480	chrome.exe	81
PID 5480 wrote to memory of 2296	5480	chrome.exe	82
PID 5480 wrote to memory of 2296	5480	chrome.exe	82
PID 5480 wrote to memory of 4844	5480	chrome.exe	83
PID 5480 wrote to memory of 4844	5480	chrome.exe	83
PID 5480 wrote to memory of 4996	5480	chrome.exe	84
PID 5480 wrote to memory of 4996	5480	chrome.exe	84
PID 5480 wrote to memory of 3636	5480	chrome.exe	85
PID 5480 wrote to memory of 3636	5480	chrome.exe	85
PID 5480 wrote to memory of 4408	5480	chrome.exe	88
PID 5480 wrote to memory of 1448	5480	chrome.exe	90
PID 5480 wrote to memory of 1448	5480	chrome.exe	90
PID 5480 wrote to memory of 4664	5480	chrome.exe	91
PID 5480 wrote to memory of 4664	5480	chrome.exe	91
PID 5480 wrote to memory of 2772	5480	chrome.exe	92
PID 5480 wrote to memory of 2772	5480	chrome.exe	92
PID 5480 wrote to memory of 2108	5480	chrome.exe	93
PID 5480 wrote to memory of 2108	5480	chrome.exe	93
PID 5480 wrote to memory of 2104	5480	chrome.exe	94
PID 5480 wrote to memory of 2104	5480	chrome.exe	94
PID 5480 wrote to memory of 1132	5480	chrome.exe	95
PID 5480 wrote to memory of 2512	5480	chrome.exe	96
PID 5480 wrote to memory of 4420	5480	chrome.exe	97
PID 5480 wrote to memory of 5656	5480	chrome.exe	98
PID 5480 wrote to memory of 5656	5480	chrome.exe	98
PID 5480 wrote to memory of 5204	5480	chrome.exe	99
PID 5480 wrote to memory of 5204	5480	chrome.exe	99
PID 5480 wrote to memory of 1964	5480	chrome.exe	100
PID 5480 wrote to memory of 1964	5480	chrome.exe	100
PID 5480 wrote to memory of 2252	5480	chrome.exe	101
PID 5480 wrote to memory of 2252	5480	chrome.exe	101
PID 5480 wrote to memory of 2304	5480	chrome.exe	102
PID 5480 wrote to memory of 4228	5480	chrome.exe	103

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.lootlabs.gg/s?yIk9vLC4
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb199edcf8,0x7ffb199edd04,0x7ffb199edd10
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1948,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2192,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2268 /prefetch:13
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4160,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4188 /prefetch:9
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5496,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5044,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5616,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3208,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5684,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3784,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5676,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5832,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5708,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5792,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4672,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3364 /prefetch:9
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3332,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4188,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5356,i,11798433205280411742,14865311135740054077,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Blooket Hacks (1).user.js"
  2⤵
  PID:4228

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dbd71bedab964834c403ff84b3a62a6a1522a896420fc11b033af770ccc69ad9
MD5 38967834f13b1565d8cf909d59c5b759
SHA1 f41b84116c6f6cacda3e8409a4538b0fa5d6ae77
SHA512 4e4b2088c5263dc7510629c371cc9ae39f7cbdf8f7946426624b1ff4fc1aca787181e94b4ce9815afd69454a8940ade0db43f5344c40bbd3280f9c8e6f5a25a1
TLSH
T154E02BAACC22EC2B1AFD1718A0900746EB5113571B504D0F763D820D8FB563609C782C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055
Size 100KB
SHA256 1612ba9b45896783e67ff0421120e16215cb84d6874c5a23d27ee0de058d057d
MD5 da02aa867f81f529a03fa6b85c99e40c
SHA1 ab54f2f268af090293cc65aaa10df8bc52301f1f
SHA512 eff2d27f780006d1b6072027887d97b0dc991100cf2bc485421cad9bd6a3d1b4127867782ad2210b7ccaeae09bdf92500774d8b5391a20db2306a0851e88bff3
SSDEEP 1536:RAoV3Pez7FqC6fVPqF32w4tYNVpBDRchoiNlSGcqpvBHcdLoW:2oVfezV69P22F+n/e2iltptW
TLSH
T1F5A3F07A3385FB87D2482B78C302441B6C737E19543ED984EDD694B284763A8BD71CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1c6872c610a38ab84340761d430d9332d2feae7d3848d0f3ac319020be1d7d8e
MD5 43e282f46c98e92a79c6d3e1ec5518fb
SHA1 ee21c6ab6e1fc4a0e290db966cc9d45426abb5e3
SHA512 b073b47f38f619f73f056805b34333708ca896ac94c14052cf75fa764b1bb244095f1b25cba7473bbf7dcd684abe79c8ef55f434dec11fdb7368ced225ae6400
TLSH
T1D941FB9D90C63B0BEF7B7CB65CE02D9AF22145460D928F27C1A4923740E7BA0B54398F
MD5 SHA1 SHA512 TLSH

Submit Download

script.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir5480_763507030\script.js
Size 43KB
SHA256 3ffe9d74328ad160cde35d3b104140a20ae23222abf6227cedd1d63680159a7a
MD5 5cf9e2b90fee15fae17dc5588d829237
SHA1 7d428c348b3ce0ff03cf965ebe32e8c6cfcfa144
SHA512 0f3c61a0c5d27c73fa9ad9a7319a6086469984f705b7a07ca2db1a389f96d12c5887f291551af92b1d45ef1ba193541376bd586ab186e6b8f7c4b9590b691d9c
SSDEEP 768:a47c24qOfAAkD8bKnCEXTyT+buYHXvMAV7GbP:a47c24qOfDkua4IXvMAVQ
TLSH
T1AA13821ED1B1152DAA73606D6FFBD18E3224001B5948AF5E3DBCC6282FC893C51E9BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 fac3b269ae5e5e6657b203addc19de04b6cd2b180d9348b01e647e9dd2be6d6d
MD5 5c6382ae4d30d086123a501348ae02e0
SHA1 6ec4f17f9f42209f96205b0013c114dd865de44a
SHA512 59fd4521a00054cfc73352219222c68d230b5ed4dcb7a941956c73f72e8d6914e3ab8fd05dbacb79d35cdfbda514892b61f47b9481d97a1b1ed14fa612fd2ce3
SSDEEP 384:DPwP2PZP8PaPNA3m7F8FwFF9Lqtfcuc2o05ZPLIPLIPLGPWvPHPiPKPUPUFP6PxJ:zekxCwiLWLWL0Iv4g62QJs0qq7UmbOaN
TLSH
T10F92ACF3C3E8862D8A5155F86B256F1FCE2D1924532C3937C9C5AF8B97E1871E210A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d0c2da8362b9efb083de14ddd16528255ea2818d0140e4505ff104fd9eae00f
MD5 2c499462ed24fafd7dc247f136f5df87
SHA1 952fd0d1c965aecb2bf8beae2d3157dc73187e04
SHA512 02a2b6c68bf7fa9e9238e97506309e837ac5cdd90671cd9a8ab50454b8db43424a0018db6b7a4cef90d708aa40e3c074daa8cc20ac906cde6566d88de2fa8370
SSDEEP 192:uYErcBz9eev+QZ8PRpdF61+uHS+WNV0IgY5gYVxNjY+BO+oHoMrdkwGOpQyIsnAb:uYErmz974Xj6cVjzx6t+oBJmoZ4
TLSH
T16642E55AAD64597B4CD7D32AF961771ACBF5202122C42E88FAFDCB0C14EB6ED211341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1998dbe9bf075e3417036d741051c8117e975cc105b03e9153f21fc4697be992
MD5 646c1165dc43696c6586798544cd8e0d
SHA1 63bcf67eae21b88a00804c1e67733600d8785794
SHA512 86c7f3e4b3425e38cf3d1e123fec3c6df796841d563aa08b5640267d49858b014c03381c8ea87528f61121f05fa9bd27ffb6702ffee29fd1974d4ae0a1312f70
SSDEEP 192:uYErcBz9eev+FZ8PRpdF6wh+uHS+WNV0IgYOIYVxNjY+tSmovoMrdkwXOpQyIsnA:uYErmz97HXy6cVjax6pmoZJ3oZ2
TLSH
T17742D55AAD64597B4CD7E716F961771ADBF4202122C02E88FAFDCA0C14EB6DD211341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 75b851d0739298e0ee2a6823bb8ea66b3906e8ba224185027f26a7fe0fafe9ce
MD5 145121f37aec2305e7548c4f5af79f45
SHA1 bbbd016d67984031ed2e704897b67f24970c6812
SHA512 9510dce3cd1132fcc4b7280a7d86f359618cfa8e1561edf2ee82f2c0525ebe05e3168118d5e9497dd8d030d5b94692c0705a0d88ed4b2682356eeb9a9f85a359
SSDEEP 192:uYErcBz9v9qvIFBZ8PRpzNVF6Vh+uHS+WNV0IgYOIYVxNjY+tSmovoMrdkwXOpQx:uYErmz98ZXr6cVjax6pmoZJ3oZ2
TLSH
T1D252D65AAD6019BB4DD7D219F961771ADBF5202222C12E88FAFDCF1C14EB6DC212341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c98e914401e308a49a479a2c28963f761738918f19e18f134055dc4237c5205a
MD5 c09791cff643625b937cd4ddb09f9f90
SHA1 21898992934364c5f53d43c8be66b5ab2044491b
SHA512 4bab8d8060d061ab196f237a613c87cb9d25e3ec8cdfafaa1a50bd163834658eb1bafe35bb877907894f2bf324a5558e3d7ea9c1f41e2196078abd35c75f2704
SSDEEP 192:uYErcBz9eev+vZ8PRpdYM+uHS+WNmgvYVxNjY+BO+oHoMrdkwGOpQyIsnA/g4:uYErmz97BXW6cmPx6t+oBJmoZ4
TLSH
T16B32E71AAD64597B4CC7E316FA627B16DBF5102122C42E88FAFCCB1C14E76DD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8b97e6d8d4bd07b32603624eba1c6e690236dbd85ef1c120a198ef82f2d34bc7
MD5 7a45873915ea901f3a3c05a98c6fdb6f
SHA1 327597e38d0ca906e4eb4efd97f01abb57468284
SHA512 0cea49aedcf01de083cacf3161702af494f5e9a39d0777a8515aade168c025ba86fe684dceacd598680a07794c7dff150c735426d0fe7d02e0384fa83c05a767
SSDEEP 192:uYErcBz9v9qvIFMZ8PRpzNVF6Vw+uHS+WNo70IgYOIYVxNjY+tSmoaoMrdkwzOpA:uYErmz98eXW6c4jax6pmosJToZ2
TLSH
T15C52E75A6D6019BB89E7D319F961771ADBF5202212C02E88FAFDCF1C14EB6EC211351B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 26f95a217f539b927f14d0224f40bb17504bc51caa77f128147b5be5a1762589
MD5 3739a55e61bc8cc9f7a0e2ea2966c867
SHA1 e076b538fa8ad1003c7c424ca8b8e32384052023
SHA512 84b713bac4e6f8a7108ed3abe576c06365d245bb80f386d8ef62054a305a5936d541e7ac6b003172330bf14bf24687ede33e4d9277938e7923f6e375051b15f3
SSDEEP 384:NdLx7pLuLceil0XjwPkXqKf/pUZNCgVLH2Hf1ZUrU4SHGjg+M2rV:NRx7pLuL7kmjwPkXqKf/pUZNCgVLH2HU
TLSH
T1DE7208677848897B0F94DACCDC267B4FADF5024B55E9889583FA9C2503E4ACB010A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9c01ca4a87cd9695a30035d344d67a924a4662fd293a80b8adedd75107c99081
MD5 259b7ef2b9594f45e19c72561a17bd9d
SHA1 79bda07be152cb18ad1c1b0a9e48e28b4ae4fb98
SHA512 7847bfac7b8a3b3cc70ed6a00ea8551d4d7b6befc26832f0297d26994c8e64fb78f09cdf9075f3794b7e1f5ec72fe8988a72a1953bef8c45828472ad40bbdfaf
TLSH
T16CA0021801891722C401667121CF61C173605C1221120B4948F0D498AC951E492D3109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe578aac.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578aac.TMP
Size 48B
SHA256 0ee1843e05a0a7f5c1e345da6a60be9e682e92648fe356fbf4f10b14779037eb
MD5 5d2527899d19b4c757e0dbc0ea082bd3
SHA1 755b2f46d3e41651fc5a29ed2fc7567f23ddf0b4
SHA512 a8b412d4093cada98166ee4a9c0dfa5104dc82219ca88d0249b26bb9d18a455219ff2acce3c896f7603eea3bf3168886764a9d0f9b7fb295cf57beb568b67ead
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f183bf42b5c3e07e0bb0459ae7ad6263a3c375a16e08db4cc9bb9bf1a0080e30
MD5 60cc2283eab15d32f0c9aad0bbdf3329
SHA1 3f51fea249b1961541f2c888130bb9b6f9a25be9
SHA512 74d9822c9fe481b42283e23282ac40b69640102b45d510c8749d6cd014d5b628e71cd4c2224b05e8fb8d4c8d6194d41833b2428efc609831f84f63ba28fb959f
TLSH
T156A0026183410055C0033AB26C8F5740731A492142869A4350D05394F964648AA7605C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 3858fcd642e8037eb54e902fb582d0346798df4486082e29a84844d8b7652030
MD5 1f05b1722e8c13def4853b84f1015551
SHA1 1778b7071c8b2a414256a5de5e7b0a4d2f9667e0
SHA512 7c49fd0079f5fdfbbaae8966d2d43a2ac47439d85de385bc51456822c09b6fef2bd8529e83cdb4fdb8be8d7d01ac6b9cece6e291f80f03bb91f648737c2a2348
SSDEEP 1536:JPXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMDhU:pXjM4rTmN5eWvStRNoV8cWK7XF+TwMK
TLSH
T1D4830232A4DF2BD713649164841B3F934EC405F721D70AE056383EE62B5B89C4B72A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 1d52072430f3814e5515bd19e00fe571d69a43dfc90d42d820a7d340fe2aedaa
MD5 f8063e92e002efd8df9896ca0968c569
SHA1 048195b5a53ab89af54a0f947f692caebffbd730
SHA512 c7cf1dbe1d826d91136ea9615f5106a3fcc9f19447c26b85b486f968de78f6b58d3c5fa9610ae84c8135d76bbff2be5aeb75e3e407b7422b92317c0ca9543ce4
SSDEEP 1536:SviXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMDhU:KiXjM4rTmN5eWvStRNoV8cWK7XF+TwMK
TLSH
T11C830233A8DF3B9713A56164941B3F834D9401F725C60EE057782EEA1B5B8DC4B72A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 729165232ab202eaa033107c3f53d669ce59ac548b1940b8eb40a39291ff5257
MD5 518c4ce0c741c5d185545fa7451ddbbf
SHA1 52470b9ccaa405b255ff69253d0543846183dd54
SHA512 4a6a702170efffa2dcb449f1c85ae0598e757affcb681c9747bf9413b9ee095fc53f0595681860721c958bd63004f4af254a07af073ae2bc7d03be82b8a36722
SSDEEP 1536:SSiXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMDhU:/iXjM4rTmN5eWvStRNoV8cWK7XF+TwMK
TLSH
T1F8830233A8DF3B9713A56164901B3F834D9401F725C60EE057782EEA1B5B8DC4B72A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 85KB
SHA256 14c975aec127c026173cf730380c38d6a71720c92a75acdcd3d914eeca1c7c51
MD5 6eb9f7b513bd6dca22038ef18133b857
SHA1 24404f8303510a90a442cbfaa0b8e0f385443b21
SHA512 2eb2df8272afc3e7a82098c92f32a5d3e480257e5f6b7c095fce583aeca210fc2c487854216b8553e4387abfd9cfd25a2c6a549cc8c12196b8b301f1a7ac385f
SSDEEP 1536:SfSQXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMDhU:ySQXjM4rTmN5eWvStRNoV8cWK7XF+Tw/
TLSH
T1D0831232A89F3B9713A57164801B3F434DD401F755C60AE09A383EE6279F89C5B72A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 2c26faa19bfc71a309b81554977d0de35ff2a8b5665941f738c2aa62e66fd849
MD5 0f157ecbb709283efbd34ed4b9fc708d
SHA1 268f75a17a9c53a3bdfafcdbd2b75c4d2147e281
SHA512 902b2bb9106c2cb358fa9cf0be4631a6407e8860c71d6bb965277ef4d9e9e923461719abbd3a0ddcd7d9f633fad7e3b5772979f30d0b414849a674f06af98c23
SSDEEP 1536:TviXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMDhU:TiXjM4rTmN5eWvStRNoV8cWK7XF+TwMK
TLSH
T127830233A8DE3B9713A56164901B3F834D9401F725C60EE057782EEA1B5B8DC4B72A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blooket Hacks (1).user.js:Zone.Identifier

Path C:\Users\Admin\Downloads\Blooket Hacks (1).user.js:Zone.Identifier
Size 63B
SHA256 6d15bd748bfc798e452e24940789d27029128da248099c71e9fcab47ea6bc6ca
MD5 8b60cb6efe24be9cb1c0f32f37f51604
SHA1 5e4a38f99f0e1b8e1e84928bebe6aa8edac6750b
SHA512 85f3e1a9b502e716468f7f41cf9628ba42f38d4132b5152792cbe5d768f84e38cbc8bc6b5465bcab3f76583892e7c5df3fc175e797e3950c2e64619b40c0059f
TLSH
T1CAA0029B4C0455150310629466BFD65CE18FA6194EB61185E94080E7E890468CAB5A06
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4228-510-0x0000021863530000-0x000002186353C000-memory.dmp

Download