325ec6374ca94978cd9b22dac9f7a4abd9cdfd0ec942a1a46305f76b4467be81

Analysis

user interaction
yes
max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tiktok-Booster-2.14.3.zip
Size 3.6MB
Sample260807-13c5ravbmd
SHA256 325ec6374ca94978cd9b22dac9f7a4abd9cdfd0ec942a1a46305f76b4467be81
MD5 b9a60f3394e45be5af6bf8c149cac837
SHA1 ea190425c9464af7d8ce3ca97fd9d0d8ff0ce746
SHA512 c2eda09d4845c75913f7c395170e907e7a6ddafd98100ab7c59b632badd9b4b417314a0f91a73fb940a3fbd6476d0ac4b23935ebd64025419303fcd9080f7e02
SSDEEP 98304:EdjU01r146pOWLTrkzi9xt7UZwpdkFkFBrS6EOKh2:2jUOZ46pVTrk+V7rm36EOKh2
TLSH
T1BF0633021BB005FDD2D3C530F7147A2CD996DBCFAF21E802A530AAE0B6E58865BBC55D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306142987490711"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2828	3264	chrome.exe	96
PID 3264 wrote to memory of 3824	3264	chrome.exe	97
PID 3264 wrote to memory of 3824	3264	chrome.exe	97
PID 3264 wrote to memory of 1584	3264	chrome.exe	98
PID 3264 wrote to memory of 5000	3264	chrome.exe	99
PID 3264 wrote to memory of 5000	3264	chrome.exe	99
PID 3264 wrote to memory of 3400	3264	chrome.exe	101
PID 3264 wrote to memory of 5068	3264	chrome.exe	102
PID 3264 wrote to memory of 3400	3264	chrome.exe	101
PID 3264 wrote to memory of 5068	3264	chrome.exe	102
PID 3264 wrote to memory of 2080	3264	chrome.exe	103
PID 3264 wrote to memory of 2080	3264	chrome.exe	103
PID 3264 wrote to memory of 5104	3264	chrome.exe	105
PID 3264 wrote to memory of 5104	3264	chrome.exe	105
PID 3264 wrote to memory of 5128	3264	chrome.exe	106
PID 3264 wrote to memory of 5128	3264	chrome.exe	106
PID 3264 wrote to memory of 2060	3264	chrome.exe	107
PID 3264 wrote to memory of 2060	3264	chrome.exe	107
PID 3264 wrote to memory of 3560	3264	chrome.exe	108
PID 3264 wrote to memory of 3560	3264	chrome.exe	108
PID 3264 wrote to memory of 2584	3264	chrome.exe	109
PID 3264 wrote to memory of 5164	3264	chrome.exe	118
PID 3264 wrote to memory of 2428	3264	chrome.exe	119
PID 3264 wrote to memory of 4188	3264	chrome.exe	120
PID 3264 wrote to memory of 4944	3264	chrome.exe	121
PID 3264 wrote to memory of 4944	3264	chrome.exe	121
PID 3264 wrote to memory of 2620	3264	chrome.exe	122
PID 3264 wrote to memory of 2620	3264	chrome.exe	122

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Tiktok-Booster-2.14.3.zip
1⤵
PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8ccd9c728,0x7ff8ccd9c734,0x7ff8ccd9c740
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17650938799679671465,17518810099210802682,262144 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,14803183951122392690,2946593650410997144,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1365918879043799216,1613460282216052682,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,8178721856800362069,87210888192534846,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,18130858341482587340,10534743967279536900,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,16057339979510206485,8431202512581126774,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,9450397575946588075,2190991993890051070,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5004,i,16650225339334475463,6803486456322917860,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3484,i,1691390059669001142,1438347165867519056,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3444,i,11741319780011926209,4067154377657704326,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,14911860488173246390,8641033028269350808,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=244,i,6886387894166622580,14819140493765909441,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,10982853114463120556,5607943536142113647,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,8237035645794346822,1154102059018853145,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5988,i,10168107422125483245,16070654614507387693,2097152 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,5968558064477341775,8805036557254647062,524288 --field-trial-handle=1892,i,14981800545852946555,7623644853486647879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:2620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 09ce5462729de22e82490960ed62660e6dfc30df9fffdec9d50320607ea96b29
MD5 af3e54cd322afc8afb2dd12a6d80466d
SHA1 fae6c6ecfcacbaeb95dbde9cd8940cf952454135
SHA512 feb37f80ec97c5744b4bda84fe5cc22e77a6fc20455aa2863603fdf65352d368f3b6c08c7f2ff4f2fe7f8300887856ff0fe5e18d50b1ee74e0afccf1a3b69571
TLSH
T18AE02BB9CA61EC770CFD175D9050074DE75513473A40848B3A3D99194FB463B468685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b2b0b2afc2fa4850960c0ad95055bf21de360d445b60ae9c8ba0a665db9fcd43
MD5 44379b679a86b00ff6c84486a983c85f
SHA1 f6b5a1d899f14c36f6bdd1df14554d68f4608f9d
SHA512 4e1905f82674fc6ca5ed5443233a5b7f1ec9fef6fc123f2dd6a998997a572cd228811f187fe13e256c7255833e535ae759f9f6da1685b535de54b40cb77cc9e3
TLSH
T1878153C8A2E5F480D7B268777CEE9D2AB5B46A3541038F4D4F0C2E756C813E20194EC9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 27cc811900d63f10969421170490e8bbb2da80f0595d8c61e814d2eb2ce561b8
MD5 622676b7839337b05065b9c04da82299
SHA1 8c87935dd766f162e39c013574340491e2f545a6
SHA512 3d01e2c85c30f3107c796abbf67e238bbdd05103900e4c57e28f1737b65a938a02830421985a57ee18392c8adf17f26bb519bfbd5fe02d7703a859952c8e4c5f
SSDEEP 192:DNMDEcOgmcPmIaaVm/WnHVOpANPTTbGtmKmDmtmzmH:DNMDEcOgmcPmIaaVm/WnHVOpANrTbGtl
TLSH
T1EED18AF7C3E9862DC91156F4AB15AF1FCE290A18432D3C26C8D4BE5B93E2871D25139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 117f5f3d849de5dc1d55707b4486d69cb928d0f8951a6ad70cedb33a59bd2a6f
MD5 c9ffa0e387500acd12356630981a1f94
SHA1 b801d121c8ca3df2958fb2ec8c731057baa0b1f8
SHA512 094e7ce65c8635a92fa9a4f85d3ad866190fdafbc21e3499a17f5fcbf6fe1e3eee1e23f7d013c9c8f778ff4c6258846bf17c35c9d9071b9df981772353780165
SSDEEP 192:ZRBcBzjIgnNE7Mev71hpAPRp2FZG92Hsb+WNnwzcsBIX2Kvkh/kwlVyIsnAUgtaJ:ZRBmzj57aBhUXfQw4+2rBz8
TLSH
T1B352C42EA910797BACDBD22AFD117B57D7F1102221A51E84EBFD892C18D76CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e9059c145234082032b5b76a6fd0be949aca378fe4156aba76f30e51688686b6
MD5 1bc39dd84ac0b650ee99d9d85b4ee988
SHA1 3f92e8fccdbce1e054cea493057de6ef3700d8cc
SHA512 8049dc39bad1a1269181b878b0a3e095e6aec55cb653dc880151aa8185494387dc1e07b31e9e2928c0454181ec07538f10def4b008c801c8c8703efd27b0c3f6
SSDEEP 192:ZRBcBzjIgnNE7MBv71hpvPRp3Xsp2G92Hsb+WNZuwzcs+k7+FieAkh/kwF8yIsnB:ZRBmzj57RBh9XMQwLp9eBBye
TLSH
T17F62D66BA8102977ACDBD26AFD11BB17D7F1102261E11E84E7FE893C24D76CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f7fd4d280e67dffc31b7238d93a53b00fd7ae19c905040f3a76953ec79219d7
MD5 ccbd1fb343a210b3cf2ee3c1fbd180bc
SHA1 422f7bdb7488bbc53a69f170a0a579cd8848d470
SHA512 c8485b3d807b2d29f2639546cded2bbb4c881c8244adaa77bb6a6992e929f273b8e25a1796bb661d80c8df1a669084ebfd1a5392b1bb67d62a477943d3e752bd
SSDEEP 192:ZRdjIgnNE7Mev71hpAPRp2Fwi92Hsb+WNnwzcsBIX2Kvkh/kwlVyIsnAUgtaJ:ZRdj57aBhUXAQw4+2rBz8
TLSH
T17752B32EA910797BACDBD22AFD117B57D7F1002221A11E84EBFD892C18D76CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e85b97531d1eea7f9d447b5cd64d8d9ec702f4710cc59b274d55b18ef435fa6d
MD5 27e4b5bebc278f595aac53372416cdd4
SHA1 22dd8c594688d1aa485b477549d0ddbe5f871954
SHA512 deaa61a4ad94bbffa5f1a9b44524879e9059c27e594392a7669a06705eb2aa39a5bea9cdfd0f6747aa372013a266d3e40503f41fe569a812ea7cb011b5a46e63
TLSH
T1BAB0128081415281C00302F41146158871549F30D60A1701D3F0AA228C2A151C058050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592282.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592282.TMP
Size 96B
SHA256 464f990ecc197968ab508f98151412bdde554652519467a4ebaba38a3dd87192
MD5 7fa723b24d69216205987cce9dcb6b88
SHA1 774e94d8b59f238d2b2e4a17b70f009d7f49f18c
SHA512 68b6e114c236b7a68488aa88a2927ad8eb1beddd9d70cd04f77c2543df795f48b55ecfebf748085e8723f3ace626bd48be720f7466fb9a9cd53faea2d71a1847
TLSH
T142B00269C202F263C04A03B42E999DD8B160DF25C647121796F05F76DC3567146375B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bfb4ad1fd7cbe1fcee283da0b5cabbe8956484610a1dc7301c1762250a0bb2de
MD5 05c9509715bda307f3fbdf8ff5fb52d9
SHA1 4c9053672d22755d3b84cdb34cdbc9565de0330f
SHA512 871f97579a177730e6ca88b5534f96ddfca309a9606e9687e972e5799a1cc1915b1cfd2ea6f86ab96896d9899bba71d20388e6acc7be589ec824c02652ea897d
TLSH
T13FA00295419166E2C8080678358A519436605D650AC3520140F101448C509A05931C18
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 720fc15deaaa8351b0448167d9f76e8f15ef19f047e8df84cd109752fdfcecc9
MD5 2393f6dd47d8aca39b496ee7aae9f775
SHA1 680c4be4af2da7077bba7be17c1886a4dfa0f0ea
SHA512 c172e94fef7e528a2ac1286605edb75cf378a26a3e587eb0c5ddee4fa6eff9db5f2dd0e9bef51a341a599034345261faa49dc1e68baa03036edb3ca2a9a8b00a
SSDEEP 6144:fxKcvfHpY1X0AkL69mn8lN/9n9Jprm7Rkm1tYpBeh2BAoK:pKwPyX0Abk8lNVw9oBGcAoK
TLSH
T1CD3422354C75ED3358E9A32F706F2B1D2FF098A7D918DC86CAC06B486B583946B8D538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cd22a801e499ff49e88f9cf78b4c5246592515518380e29a9338b9e00458339a
MD5 48d8fbbbe1264705ccca901d3c88714b
SHA1 bae42016a528ddbca257cc37de1a9796d19a0e36
SHA512 610a58b7f2c17e309ae7143a3e20f6d74cfcd14bd5f4f16e8e938995e461d5d6fb8472d8bb1ad07719470b318a00687784c06595c481b290864d8e62f9454f94
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Fm7Rkm1tYpBeh2BAo3
TLSH
T120C312275E71E9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D86B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 310384500dce401b1ea181d2e9a7a09171116c1fb11bbbe8c264df4a187128fa
MD5 1ade1f33e11d801cdd8e96582c6b6b7d
SHA1 e632862cb6b49eec8d4e46302626e3c6ab378dd1
SHA512 8d0faf79792be74551a7995447085de5e234a30bea5f796e5b56f23ceb160eef8603c82de73b01c8e66606a84cc50826ef2abe1fffceb977bfaac722924e437d
SSDEEP 6144:CxKcvfHpY1X0AkL69mn8lN/9n9Jprm7Rkm1tYpBeh2BAoK:8KwPyX0Abk8lNVw9oBGcAoK
TLSH
T1FB3423254C75ED775C8CA73FB06F2F1E2FF19866C9189CC2CAC06B486B587946688538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 3216cec955cb7a91df41216fa25c9987fdfd888fecd26920f44873c17feb1acc
MD5 e1b787a053bd3db5ce75b15d4e6607a9
SHA1 884002f2d7dc3973e8f47858f9c18a60ccb857f7
SHA512 460a045505a2e910627dbedab1b4c983db881327958134f5cae542de2c087d6150d36f8d57834eb0112c6a191833d833e6e6260b91065a3dedaae06b77bba862
SSDEEP 6144:VxKcvfHpY1X0AkL69mn8lN/9n9Jprm7Rkm1tYpBeh2BAoK:TKwPyX0Abk8lNVw9oBGcAoK
TLSH
T1E33423254C75ED775C8CA73FB06F2F1E2FF19866C9189CC3CAC06B886B587946688538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download