hxxps://gotbackupjv[.]com/swaggy/en/

Analysis

max time kernel
82s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gotbackupjv.com/swaggy/en/
Sample260809-s9xtqs1cre

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	1540	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307642491770116"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5324	4136	chrome.exe	88
PID 4136 wrote to memory of 1540	4136	chrome.exe	90
PID 4136 wrote to memory of 1900	4136	chrome.exe	91
PID 4136 wrote to memory of 1900	4136	chrome.exe	91
PID 4136 wrote to memory of 3692	4136	chrome.exe	92
PID 4136 wrote to memory of 3692	4136	chrome.exe	92
PID 4136 wrote to memory of 5620	4136	chrome.exe	94
PID 4136 wrote to memory of 1864	4136	chrome.exe	95
PID 4136 wrote to memory of 5620	4136	chrome.exe	94
PID 4136 wrote to memory of 1864	4136	chrome.exe	95
PID 4136 wrote to memory of 1160	4136	chrome.exe	96
PID 4136 wrote to memory of 1160	4136	chrome.exe	96
PID 4136 wrote to memory of 2868	4136	chrome.exe	98
PID 4136 wrote to memory of 4964	4136	chrome.exe	99
PID 4136 wrote to memory of 4424	4136	chrome.exe	100
PID 4136 wrote to memory of 4964	4136	chrome.exe	99
PID 4136 wrote to memory of 4424	4136	chrome.exe	100
PID 4136 wrote to memory of 2888	4136	chrome.exe	102
PID 4136 wrote to memory of 5872	4136	chrome.exe	103
PID 4136 wrote to memory of 5180	4136	chrome.exe	104
PID 4136 wrote to memory of 4944	4136	chrome.exe	107
PID 4136 wrote to memory of 4792	4136	chrome.exe	108
PID 4136 wrote to memory of 4944	4136	chrome.exe	107
PID 4136 wrote to memory of 4792	4136	chrome.exe	108
PID 4136 wrote to memory of 4260	4136	chrome.exe	109
PID 4136 wrote to memory of 5756	4136	chrome.exe	110
PID 4136 wrote to memory of 4260	4136	chrome.exe	109
PID 4136 wrote to memory of 5756	4136	chrome.exe	110
PID 4136 wrote to memory of 1424	4136	chrome.exe	111
PID 4136 wrote to memory of 2744	4136	chrome.exe	112
PID 4136 wrote to memory of 1424	4136	chrome.exe	111
PID 4136 wrote to memory of 2744	4136	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gotbackupjv.com/swaggy/en/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd9d3cc728,0x7ffd9d3cc734,0x7ffd9d3cc740
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,16147623667423942331,10111698884532382425,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,6665015589501748415,13354663690526330658,262144 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,17181275472565255476,13693767986942936553,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,7907133867692361991,10096187535567640620,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,2260860725145962872,9021618785758577131,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5000,i,8837957438584503504,5831180438118139732,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,5831290636745004424,2621442028290486981,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6100,i,16574495809388156152,9422142219159854598,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6096,i,3119530723324160320,2529914322163746852,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,16357198073850749986,706162812843810083,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,13772486094546735786,4505838187943294046,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,1259026069334870384,8253463393920424220,524288 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6156,i,14007764163825372200,17598719048552143566,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6484,i,7052643239676585643,1960039857850721601,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6744,i,9753961429521345321,7488263070914546016,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6168,i,3454221323568002618,2388867698450414177,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6084,i,7169289818614103282,9697712462804877836,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6112,i,3776877413333174735,16123639009308244094,2097152 --field-trial-handle=1892,i,66561261724738812,12781938253673696302,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75664324-ecaa-4373-803d-f3d57fa07708.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\75664324-ecaa-4373-803d-f3d57fa07708.tmp
Size 5KB
SHA256 d3ec96f0f362e93dff6ffd95ac02625e2f9d1689e61edef17c34e43082d97f97
MD5 2076c80995dd2b598898cfe9e559378f
SHA1 5f946bc4609641568c0754ace2eab967f16dede9
SHA512 386d86be71c8bfeb311c5b0427f58c6e73ec16d83cc1ea6cbb3984df6c24d628c23b39e4fe15fabf913b77b8585606939600fb1ca85543d741b77b2713a7de1d
SSDEEP 96:cC0d+hDK+UyKovbfaNQYftaSl8h4otop5s6DbB6rGyvUgIlG1QzbOQDPfwJ0j9I8:cC0qDHUgvId8iU21lPsIlTLDPfwJUJ
TLSH
T1FAC12935B46CAD7759B3D506F8232E83CEB6206B99627E54C6DA1F1D11D70E81343A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 cfa6907b8abd6997b2b755f0b489fc02164cd6d30111dba4d137c9e796becb1d
MD5 2d8af105da569727cbd88761b447ca2b
SHA1 ad776e4f8e2b1906691fd29dbc0ee3492d01a2b7
SHA512 83ca65c7f91ff982bae7a6325b32befdcea1bf8c3b9bfe669b52cda8fb871be734cc3ff16f10a8ac5a3d98d708b13954a0c813af43708605c2c38ebacc1ba4ad
TLSH
T162B0123424841549CF8043B129C008403A70054017130E8792CE17A64C227F56A6125D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 547b65055434cd8c4677061c4bc7f57712d3f8da8d08ef20fb00fc7cbc70d2bb
MD5 c21123738de70e044b8a54d2c569df58
SHA1 32a379c4542d86171668e980e4839c98bd8c3150
SHA512 57c27b8c90f8825244099c014aadf864eb83a1b38e42e78688e67636349a2af62e2b3f2dd28f389f77b2aea6060bf6e1144725ac6a29ef37bb20581d1495eba1
TLSH
T1DDB0123074C41468DF8013B119810C823B501580031317A7A0CE07DD4C236E16E51245
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ca2525eea234eeb911d6128ba1b12f86a95b4c0163d79b896df3fb6f1bae3d16
MD5 10cbc7b5cba6b000650c8653d955aa34
SHA1 93299a341a521ebb482c8d82db94c21535324ce7
SHA512 7980548d300b9bfd10152318e149e924048bdb3500768411f213292672e7c38c2fd9cda5765d8175bb6d9503eb5e7d5e7e5c0e875490b27b37733c40591c039a
TLSH
T130416BF783F49A7D8A5152E4EB156F1FCE6A0524531C3C6688D46E1B93F28B2E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1d66c86fd70266b962ceade0fdc34e49ee95f1ac7d9cc7ef4dcf917ee156e1f0
MD5 c217c2192e111d6577208956ada1ee87
SHA1 eb4fa33f51bd73af84dc3ebeb7c9b77c168615ea
SHA512 751277699a380531d588b9a0f7f900c226c9105e03eb2d30a2ec3a632ffaf6bc1d4dea844fbb770d0b64e1c1c9d3337ecaed1855d8a5fdd6afae8c1bd7fceb5c
SSDEEP 192:7RxGfabv7KvAPRp2XK9NLHsb+WNni0JQA2CQ22ckw2ra8lVyIsnAUgR:7RxGCju6XB3wTN2v2jUa8TR
TLSH
T1BE32962EBA20293BAECBD61AF9217753DBF9102125D52E84E7FC992C14E75CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b72a103aa6741ccae73d227a4fc35d6b27cca254f5a9adca55d740a4dcb75242
MD5 5bea304d3290ed32cf5661ef48e0937d
SHA1 d084f18680943213af61c426e284ca34444556fc
SHA512 c3f95b2d5115749243173abea4f2cf6d4e35099a2412ff2badc6ab2d779f7024e6dbdeac944b05fce48198682f004989406ff916f4637e148300a1ddaa22df31
SSDEEP 192:7Rxcfabv7KvkPRp6XK9NLHsb+WNni0JQA2KQ22ckw2ra8IVyIsnAUgE:7RxcCjueXd3wTN232jUa8sE
TLSH
T10E42C62EB9102D3BAECBD61AF9257753DBF9102125902E84E7FC992C15EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 283330c13fb1426281ceae4d5e771780ee01b039d24ae4d3e9318eeac7c329e4
MD5 835df81326f59d56822cd01898917ab0
SHA1 018dd5990a13b5215dd3e127279efd8ac6073fa9
SHA512 9cce603fb87176410097a3252b5dde58c6b847aa30713be693ef791e8a712f811d46af887748ade3d9f1b5ed3410afbc5aecc6afad056612e7b7ec04d1f620bb
SSDEEP 192:7Rxcfabv7KvAPRp2XK9NLHsb+WNni0JQA2pQ22ckw2ra8uVyIsnAUgE:7RxcCju6XB3wTN2i2jUa8mE
TLSH
T14742A52EB910293BAECBD61AF9217753DBF9102125912E84E7FC992C15E75CC322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bcaeac8c96b240fac6be6a1cfca5432943c92dbce69164789d5e515dec803214
MD5 b388c1556bb031ec7cc929c6cdcb70fa
SHA1 b492a88ac40e4eae34d26649bfb9f31aaaf87e0e
SHA512 3d6e4c70525f96c7420f1f4b438627d49321fafc8ba53f4345b112759b8d4b0ff1a3fbce962470d1c0433977f9e045583ab5e2c7898a9d963f0cc8b9cff3c690
SSDEEP 96:ubJ0d+hDK+UyKovbfaNQYftaSl8h4otop5s6DbB6rGyvUgIlG1QzbOQtEfwJ0j9J:ut0qDHUgvId8iU21lPsIlTLtEfwJUJ
TLSH
T185C13975B46DAD7769B3E506F8122E83CEF6206B99227E64CADA0F0D11D70DC1343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 965d9332eec2e5b79872708af951675bf7c428c04135a9678d2d75d9abe4d4ef
MD5 b3c1437f76c6c03a62abe35e56007f7f
SHA1 4ccfafa05d2c7bf0c1fc13075640cfef38ea6be2
SHA512 83a941d960e6d1945952030b8e5e35effa0d2b2873c28d6f66d31dc23346026181a01b7ae0c9f326277c231ef8ce2313b5b594ec68f4d52eade686e11ada4ab8
SSDEEP 96:ubJ0d+hDK+UyKovbfaNQYftaSl8h4otop5s6DbB6rGyvUgxKfwVRNC39ISyVN9FH:ut0qDHUgvId8iU21lPsxKfwVuCzbt
TLSH
T1AFC10A71A46D5CBB5EF3E445B4132D43CDB9606BA921BE18EAEA1E0C01E74DC1383663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bee5ac0c1de8ad1703cc053ab15d8574b15b6cdd8314ccb6e43cb3b06ad730c1
MD5 513d0d1bed751c877c2dfc615bf8dc9f
SHA1 af3fc84933a76f4a5494be805a249a4b96e3adff
SHA512 f25d8bbf86e3628ae69233c267b79e42a0c8a9cacc4a33ea4c11239fff599b8935cd359332c7e3e2400d453ec32e3edf0628f4957f243871f3b282242e6b94ed
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5sqDbB6WGyvUU+wsbL/Mmv4a:BC0qDHUgvIdaDUDxlCI+wsbL/N
TLSH
T132A11A32A46D5D776A76D909F8652E43DEB46027E922BE44D9DE0E0C11E70EC1342613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download