hxxp://119[.]242[.]104[.]9

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://119.242.104.9
Sample260903-rt2bjsvyfx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4656	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329194113750369"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1236	1240	chrome.exe	86
PID 1240 wrote to memory of 4632	1240	chrome.exe	87
PID 1240 wrote to memory of 4632	1240	chrome.exe	87
PID 1240 wrote to memory of 4656	1240	chrome.exe	88
PID 1240 wrote to memory of 3180	1240	chrome.exe	89
PID 1240 wrote to memory of 3180	1240	chrome.exe	89
PID 1240 wrote to memory of 1428	1240	chrome.exe	91
PID 1240 wrote to memory of 1728	1240	chrome.exe	92
PID 1240 wrote to memory of 1428	1240	chrome.exe	91
PID 1240 wrote to memory of 1728	1240	chrome.exe	92
PID 1240 wrote to memory of 1120	1240	chrome.exe	93
PID 1240 wrote to memory of 1120	1240	chrome.exe	93
PID 1240 wrote to memory of 3444	1240	chrome.exe	94
PID 1240 wrote to memory of 4276	1240	chrome.exe	104
PID 1240 wrote to memory of 4276	1240	chrome.exe	104
PID 1240 wrote to memory of 2852	1240	chrome.exe	105
PID 1240 wrote to memory of 2012	1240	chrome.exe	106
PID 1240 wrote to memory of 3684	1240	chrome.exe	107
PID 1240 wrote to memory of 1696	1240	chrome.exe	108
PID 1240 wrote to memory of 1696	1240	chrome.exe	108
PID 1240 wrote to memory of 4596	1240	chrome.exe	111
PID 1240 wrote to memory of 4596	1240	chrome.exe	111
PID 1240 wrote to memory of 4308	1240	chrome.exe	113
PID 1240 wrote to memory of 4308	1240	chrome.exe	113
PID 1240 wrote to memory of 2824	1240	chrome.exe	114
PID 1240 wrote to memory of 2824	1240	chrome.exe	114
PID 1240 wrote to memory of 1196	1240	chrome.exe	115
PID 1240 wrote to memory of 1196	1240	chrome.exe	115
PID 1240 wrote to memory of 2236	1240	chrome.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://119.242.104.9
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4ed8c728,0x7fff4ed8c734,0x7fff4ed8c740
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,1575351334006266219,2445774238846898801,262144 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,10099125627803831049,17757686809836458921,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,9175004859670618066,10531076725267280096,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,3455119359946973662,3708465679337704829,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,5920220321567311606,790701817951574620,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,1160226127421738669,1032901512474444549,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,9749369930376729520,15886198540515455285,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,16428596106888952168,16384415131777274749,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,11625256356799542155,5166076463880062956,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,7037123676412203817,1627213654540452631,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,16275247471641401853,11343356011793461247,524288 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3288,i,15065448944165653445,1089600321430867681,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5604,i,8628695726229825381,7487072723594356806,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5868,i,13760046737386186807,8633647486511400281,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5872,i,17792786147835063007,2621842777414014517,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5816,i,8230647496832830822,11568955795381816723,2097152 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3676,i,2753652819906076763,3840430378878684732,262144 --field-trial-handle=2000,i,936937217899443284,12405517017700279269,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d332b5a6b95cc82fd8be2d988908ad100371b017b91e4bac9b4e955b20674c03
MD5 841144c644c078d0875a7d7f26ec5dcb
SHA1 6e30b4adc1c8117954ac3eb2be01730f395c5fdc
SHA512 5f1077784128a2c1bfd5cd1fb3140ced6905aa3009154de4926d0592d91001ce43de90c37259441c214db55694ed7c3d3e92fc0b463a3fef9371b3ac05b9ef38
TLSH
T145E02BD9CC62FC271CFD872E90500746DA6113571BA0845F373C910CCFB16670685C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 67095f266ca5b1a522628408a3b4d4ade82e9c3489de5039dde7aab9ba2b8967
MD5 42b425bb71b3448441cce90c57058462
SHA1 a9b1a4269973db8671d082d6e0f7f70f1de0428b
SHA512 9afb33d334354c8e8131cf0478ffe27d5aef3c56c932ce2d66ac42c2ded950db55807b767a50c38a56f8094ece2800ded7e99b85fe7614614533dca9d7c21c11
TLSH
T1EF418CF793B4957E8A1196F4EA156E1FCE690524031C3CA689D4AE1B43E2972E10079E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4e40f6c67ead7452f2df4eee3a42acd6cce291f1ffed46313813fb5d76bffa59
MD5 3365c50f583b46c3f83e6f3e9dc8e1f0
SHA1 6d6d18111d98aee64ce6b5c65a25e0d90e625054
SHA512 2a7013e8b70790d509acf968769b09e6f8c92f8d6352451df223ff517e0fa17eb3fff209d1fb8b04ab6ef95a35477c28806f71ed8d3c05426c72febe10c79de6
TLSH
T125418CF793B4957E8A1196F4EA15AE1FCE690524031C3CA689D4AE1B43E2972E10079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8af4af122c4903d1c3c271e0539365cc891cc27af05d1a4e8f93782e86049e08
MD5 c2ddae07955b6096bddd159dd65f793f
SHA1 fa8054017013a6ee42d9407b8c0ea57946d82a20
SHA512 50eb4f7e5a4f6f6b857fb4ae36363a33f44fb293878968e6f5c9e682ca97cf12278e14f92b26690f18ab910a7533758e43d68e185b14ba89193ad42b8dcd2f46
SSDEEP 192:IR1+2+hnxC8Kgyv7ApAPRp2l9qHBCb+WNn14PX32ZAaYhVyIsnAUge:IR1+VhpekUXmkASP2Sace
TLSH
T17142952EE910793BADDBD22AFA267B53E7F5102520942EC4D6FC8A2C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4b56eabd481f125d36721293270146659fd065480ba7a979b257ac527224265f
MD5 143d9b14334a5e42d6c69014d2a9f629
SHA1 64e688b5679225aa64ed1ae818dd6112363249e4
SHA512 80ae7e9e3515d2d5a335b237fae5559835927144d75bbf89204b01d6e7b25e9ab3ba85d97cbf98846ec9d492372fd5b9cf6be81f6b45f424a2ee595873328f58
SSDEEP 192:IR1+2+hnxC8KhHPv7ApoSPRpfZHR9qHBmb+WN10144UtUdK2t32ZAaYpVyIsnAU3:IR1+Vhqnk3Xbk0HZx2ASaCE
TLSH
T15052C72AB9107A7BACD7D22AF9527763E7F5202520A02EC4E6FCCA2C15D75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0f947481ce823c9a792a9e1232939efe0e53e8d90104272be1e2837de1240274
MD5 7608fe8055a7f226f5d8b715b76061a7
SHA1 f0020ed68ee97e73fc54b2720d56303b25b560ad
SHA512 2236ce85473f49bda7a2ceaac6b3375dade41c12424a4e0b22c9119255909d5764f913f7d88f880acb152428332814b35ccf0bc4894177aa45a85f868deedc55
SSDEEP 192:IR1+2+hnxC8KgHPv7ApoSPRpfZHL9qHBOb+WNn14Pz32ZAaYpVyIsnAUgE:IR1+VhPnk3XRk0SP6SaCE
TLSH
T11B52A62AF911793BACD7D22AF9167B63E7F5102520A42EC4E6FCCA2C15E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b83c11f4c3a36ff2d1a3cfa0cc1bac2109cbf9ec8f6ea35df72247429d37a56
MD5 48de151b14699031fa9141a3d01bb338
SHA1 57b1cc0ae535ca93d0dcb05249fc909636890ec1
SHA512 21997ddf7393ef7dd74616bddb0592da2dc4b039e60550019e83df3e0864a1d96df889816b68bfc914b8162b633a975b2d04e0eb7e62e4ac638adf7aa63af6a5
SSDEEP 192:IR1+2+hnxC8KdHPv7ApoSPRpfZHh9qHBmb+WNn144Ut2o32ZAaYpVyIsnAUgE:IR1+Vhunk3XTk0SZ2xSaCE
TLSH
T15652C72AF910793BACDBD22AF9127B63E7F5102520942EC4E6FCCA2C15D75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 edc09c7252d444467f23374add20d8041a658770bd6ba83d51aa9add7d84860d
MD5 bb81b9f57dc1eba0ba4a07da8dad3a98
SHA1 180f223889130e64ef2a09b4fba06063ea06956a
SHA512 0ebd96c3a8b9c7eabc9ded000cb7b3209df930c6429f88b552745281d0493bb5398ab0f4c74e1d9b951f6f31c78d1edda538bc7c5fd4ddee26b949cc32a17189
SSDEEP 192:IR1+2+hnxC8Kggv7ApAPRp2H79qHBGb+WNn14PZ32ZAaYdVyIsnAUgE:IR1+Vhp8kUX6ksSP0Sa8E
TLSH
T11D42A62AF911793BACDBD22AFA167B53E7F5102520942EC4D6FCCA2C25E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2e2d0cbfaa39d4c0ba45668bf168c962e50cda020297d0e3a6d4dc5673f83be0
MD5 c1845c55edf176c3a2da779b96bf6d5c
SHA1 4f1324ca0029cc08f2fa885f492963ee7e6e100a
SHA512 27764e93c0fa0bb1aa7cff9d2f20ae4ba01a69162a698dea6aac8d4f447da1f187dc8488ec1d22ec6e2ba47bf646a26112080465e417a7d4f1142c0311901eb2
TLSH
T154B012D0C801554EC44202F811465888B114AF20E60A170643E1B9268C295D1C015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591265.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591265.TMP
Size 96B
SHA256 e386b1c917b70884c2f60f4491df27ac857b67ff2d20023cbf4dc0c9a1256f90
MD5 37ebbef6d7adf060171278daaf9ee4ef
SHA1 ca8a56a2b44fec8cd40c122b713d0816c152558d
SHA512 d9da5a947af38fca46ab63e72d68c3792f1513d1fc92abe6a6394fcde13aba35725a62b86b87e55a341fea730bbdbb0acbc6946c3ca4ad943dbb14fbc64bc066
TLSH
T1DFB02200C002B283C00B03B028C088E8B020CF22C203020283F00AA2CC20220CA2A2B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1e0036d49ce5a4e2e669784bb8393c5e920b46c31a529900ff566145fb956bd6
MD5 669008cb7990d2b23501f942f94f6855
SHA1 944b9de571554277879f34b1069cc0ef840bf390
SHA512 8d184dba3df6b33daf3fbc691f5788abfe68da69184796d3b782c6c21307c9c1b383f5ddd642ef412f9757a3d9b3cce5920a32675fc085b6a26c09801840dd41
SSDEEP 3072:blGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Im7Rkm1tYpBeh2BAog
TLSH
T100C3023B9D74A83B99B5B70FA04E0B1F2EF249A6C920DE52C8D85A0433F97CD1A44D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41beb4ed5c4ffc84180a9606dd82782bbfc901868f903fe5f4397b591244c071
MD5 273844abfc1e84644c155324c3d0d4a3
SHA1 cb2ab3c2afec685a7611f905e659f1d74aa007e9
SHA512 2f9b8d929de4ab14687a6b92e74384ada773cf2d9cfde6bb11a89a8d9d0c39a22744ee1fe2d53b2950fad580b7d3153cf44ea3afd607bb7023a84ce2e56ef294
SSDEEP 3072:QlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Vm7Rkm1tYpBeh2BAog
TLSH
T155C3023B5D64A8375DB5A71FA08E0B1F1EF149A7C920DA92C8D85B0427E9BCD0A49E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b752fede5c3439523e7028a25c5498d3c2bf6d5c0756b4fd12eba6ae1c2b6a5a
MD5 29791ae94025e0b2e37bf5498839f4a2
SHA1 a559ba2cfa5ec9f91065a3fb1f65d631cc4842c4
SHA512 e62b1dae34b5f8b4947eb51a0c37e33c93807107bb07c65988f60e783a790f23ff7e55a8ef16c5172675316c17b59de34dddac964be9465ef4a4f22ad58c181f
SSDEEP 3072:A4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Mm7Rkm1tYpBeh2BAog
TLSH
T1F5C3022B9D75E83B5CB5A74EB08E0F1F2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b0840a6e01e80bae56147758019ff1fec25cbe4239b3ab52a2cbe173fe6fb0cf
MD5 6b9a58ff2704193cdc3e103206cace98
SHA1 7e04559d833ac667e0063a15f7e3ebdb5326d72f
SHA512 6602994632776fd383f43254a35d540318dd559aa74289740aefcb8e7573afef6781287ce9b0973ae5a136be996fec3b494de7f225f6e7014436b91ee2389834
SSDEEP 3072:blGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:gm7Rkm1tYpBeh2BAog
TLSH
T105C3023B5D64A8375DB5B71FA08E0B1F1EF149A7C920DE92C8D85B0427E9BCD0A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download