hxxp://txelectionops[.]com

Analysis

user interaction
yes
max time kernel
30s
max time network
36s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/10/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://txelectionops.com
Sample261002-serz1asdpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2488	1624	chrome.exe	84
PID 1624 wrote to memory of 1784	1624	chrome.exe	85
PID 1624 wrote to memory of 1216	1624	chrome.exe	86
PID 1624 wrote to memory of 1216	1624	chrome.exe	86
PID 1624 wrote to memory of 4932	1624	chrome.exe	88
PID 1624 wrote to memory of 4932	1624	chrome.exe	88
PID 1624 wrote to memory of 3628	1624	chrome.exe	89
PID 1624 wrote to memory of 4712	1624	chrome.exe	90
PID 1624 wrote to memory of 4712	1624	chrome.exe	90
PID 1624 wrote to memory of 3628	1624	chrome.exe	89
PID 1624 wrote to memory of 3936	1624	chrome.exe	91
PID 1624 wrote to memory of 3936	1624	chrome.exe	91
PID 1624 wrote to memory of 4476	1624	chrome.exe	96

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://txelectionops.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9f8d3c728,0x7ff9f8d3c734,0x7ff9f8d3c740
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,1752009026813677092,16128379002357186896,524288 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1768 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,10204791982845343256,16356552520026691339,262144 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,1688227857998215256,6057813943940427928,524288 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,12823390384308467840,284918461086680700,2097152 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3016,i,3672055907833946813,3020947589418959002,2097152 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,13881752688950529967,16504678428869632562,2097152 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,12897456259020386309,14037197072583194878,524288 --field-trial-handle=1864,i,5602881639128173384,2454229759858927526,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32da2233-48d7-48b9-ae91-76abaee6906d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\32da2233-48d7-48b9-ae91-76abaee6906d.tmp
Size 132KB
SHA256 973993febf5bc8dff40ac6e051927aa1e72ff265d93e1fdb7cbfc1530e24a88e
MD5 08e13c1577e2a6fde647e74a9cf180df
SHA1 cf345ffdb04753be13699ffc803aad24924cfce8
SHA512 f4ae10980d8af0fcd781cf82383ca6bcea738bd62c0ed42f4f95e50cfd8b55cebc4155af54d908d7c954e2be030bb1b0233103afc273d23222e6d9f4c9e88d12
SSDEEP 3072:uIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:uPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T167D312217D01BCB4A9EFDB32A1901A169AF8D94B953D7BE61CDE3F4805E3699C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53a9d693-e2a7-4a56-bb59-54a3ad82a012.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53a9d693-e2a7-4a56-bb59-54a3ad82a012.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

640302e0-0a9b-4976-ad44-5b2b457cf0ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\640302e0-0a9b-4976-ad44-5b2b457cf0ca.tmp
Size 12KB
SHA256 f5cab65ac2fd2fa4e5ccb253c1958bfe9681375b388866291eb3c266740fbf99
MD5 b7524d01d4f4ded0e60148775305fd43
SHA1 06378f6a1a0aa7e9be8cca922bb778e271be483a
SHA512 1191b53dcc7c058f9c3423403e61fd360c1c6962fe3d2f1ed4f121adeeafc31e2dd49969dcc2aff6aa867f662dba1d35e0e21b0f4200ed6978a32ce2eec54af9
SSDEEP 192:VRiuo4l/ylyv7TpAPRp2o9AHcxb+WNnepqP5teei2uZAVyIsnAUge:VRiuh8IfUXbWwJP5g29e
TLSH
T19842C82EAE10797B5CEBD21AFA217B57D6F5102131D42E84EAFC893C20EB6DD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

881fa644-bfe5-4ff4-abdc-833f8f11fc7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\881fa644-bfe5-4ff4-abdc-833f8f11fc7e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 b5648f64bb0a1e631ccf75777df2802428f324a15b6e745dd30eeaf769658234
MD5 bf4734d0030418ffffcac868fcbedf11
SHA1 8edec22d417d24b02fa4a64cbef0cb7eac8b8eb8
SHA512 6b3688065d195bf2890ebd3eb9ea537e5c4e4391cbf5faf02c83668da3d4079c369362180534629cf91619793805daaa1790b0a171c304f50c8e1dcf7687bf88
TLSH
T178B0128C80836B41C40602F4135424893554DF10AA15134183F00E519C36150C11B0D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 8d8e4dfaea5a511a54da20b66e14c1a85473d5560ff9fabc390e4b60be0eb40f
MD5 e0a11d006624b2b1798292204c7a6204
SHA1 3519c76d5f45e71434c0b17926752921f83b9d72
SHA512 d5095100691366e09369df0ee4fcab4d7fdcbe1fb736da1f048d9d61b27d3d2cdf947d89d3f26cec62c250f35cd86c3453407df92bcf7432982f9f3c41404cf7
TLSH
T109B00269C2436623D04207B029A6A9D971B0DF25C6037316E2F09A76EC256A04525970
MD5 SHA1 SHA512 TLSH

Submit Download

a7e94ec4-474a-468f-abae-d6dc11a95392.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7e94ec4-474a-468f-abae-d6dc11a95392.tmp
Size 649B
SHA256 e1c06ed4bd5a49394ed464ee84c35df7bbb847bbf9ce31a280b77138e85af310
MD5 3183b2741057a38858250fde909b78e7
SHA1 6cdf5737aa72b6e51d106511e52a8afcd87df924
SHA512 ae9d037bb6baa00f24955ce1efcec8535c9cc2bfb4c526fbed0e3f5897f28fb79fb49911545130b7b0868c0f475a1557548a5601ea5c34bcf395f63b16a04638
TLSH
T197F0F4A9CC21AC771CFC1B29A0A54B4BEB51135F2681985F3A3D910D8FB5A3B458581C
MD5 SHA1 SHA512 TLSH

Submit Download

eb5a3db6-2179-425e-842f-cfb5dbf72e31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb5a3db6-2179-425e-842f-cfb5dbf72e31.tmp
Size 17KB
SHA256 825e6b89b8469681ab3913d31f35e2ef225e4dc5513297f72a50a392fcb57654
MD5 381c0b6ed66f344b880d905ce8ed5536
SHA1 4bf16119542a559354423ca283da00c408af0cbc
SHA512 1942b61c7e8514242bd139c01e1f9d56d625532940645354120c75465ef401add71389162894b545533493ca83a1253affaca918791848f7e83a4dc824d8bd90
SSDEEP 384:wqjcv7KxkXqKf/pUZNCgVLH2HfgslDj7pLuLceSa7XODcz+ErU3JaHGuC4JVLkLW:w6cv7KxkXqKf/pUZNCgVLH2Hfgsxj7ps
TLSH
T1CD7208676C489A370F94DACCDC17BE4FACB9015B61ED886443FA982603D5BDF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad88ba75-5c39-40fd-8ed6-06abaed0b4b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ad88ba75-5c39-40fd-8ed6-06abaed0b4b2.tmp
Size 131KB
SHA256 67833cf80d4b26278f5b96531d1a9dab12563a21f59990ae3121b9d42653df13
MD5 43b8d40197524a3ebe17050e062e5c55
SHA1 16d8fb7e9837b2c01701db844585f86958f577c6
SHA512 93f2ba12cbaf668287286252662eb6f0d198b6877bee9dea10b2f8ea18b904ffe797c6433f44ca9f65fef492d2d270aaa4d683876b5e1eea34f8001ae6626a86
SSDEEP 3072:iIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:CPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T15AD312217D01BCB8A9EFDB22A1905A15AAB8C94B95397BE61CDE3F4C05E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download