hxxp://35[.]227[.]193[.]242

Analysis

user interaction
yes
max time kernel
77s
max time network
77s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://35.227.193.242
Sample261002-ttdllaxejf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeCreatePagefilePrivilege	2964	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 5740	2964	chrome.exe	89
PID 2964 wrote to memory of 5836	2964	chrome.exe	90
PID 2964 wrote to memory of 5836	2964	chrome.exe	90
PID 2964 wrote to memory of 2692	2964	chrome.exe	91
PID 2964 wrote to memory of 1176	2964	chrome.exe	92
PID 2964 wrote to memory of 1176	2964	chrome.exe	92
PID 2964 wrote to memory of 4068	2964	chrome.exe	94
PID 2964 wrote to memory of 4272	2964	chrome.exe	95
PID 2964 wrote to memory of 4068	2964	chrome.exe	94
PID 2964 wrote to memory of 4272	2964	chrome.exe	95
PID 2964 wrote to memory of 5712	2964	chrome.exe	97
PID 2964 wrote to memory of 5712	2964	chrome.exe	97
PID 2964 wrote to memory of 2788	2964	chrome.exe	98
PID 2964 wrote to memory of 3116	2964	chrome.exe	99
PID 2964 wrote to memory of 3116	2964	chrome.exe	99
PID 2964 wrote to memory of 5384	2964	chrome.exe	100
PID 2964 wrote to memory of 5384	2964	chrome.exe	100
PID 2964 wrote to memory of 6112	2964	chrome.exe	101
PID 2964 wrote to memory of 6112	2964	chrome.exe	101
PID 2964 wrote to memory of 3204	2964	chrome.exe	103
PID 2964 wrote to memory of 3204	2964	chrome.exe	103
PID 2964 wrote to memory of 3532	2964	chrome.exe	104
PID 2964 wrote to memory of 3532	2964	chrome.exe	104
PID 2964 wrote to memory of 2000	2964	chrome.exe	106
PID 2964 wrote to memory of 2000	2964	chrome.exe	106
PID 2964 wrote to memory of 2592	2964	chrome.exe	107
PID 2964 wrote to memory of 2592	2964	chrome.exe	107
PID 2964 wrote to memory of 1644	2964	chrome.exe	108
PID 2964 wrote to memory of 1644	2964	chrome.exe	108
PID 2964 wrote to memory of 4272	2964	chrome.exe	109
PID 2964 wrote to memory of 4272	2964	chrome.exe	109
PID 2964 wrote to memory of 2036	2964	chrome.exe	111
PID 2964 wrote to memory of 1544	2964	chrome.exe	112
PID 2964 wrote to memory of 4280	2964	chrome.exe	113
PID 2964 wrote to memory of 2368	2964	chrome.exe	114
PID 2964 wrote to memory of 2368	2964	chrome.exe	114
PID 2964 wrote to memory of 4080	2964	chrome.exe	115
PID 2964 wrote to memory of 4080	2964	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://35.227.193.242
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb5587c728,0x7ffb5587c734,0x7ffb5587c740
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,10888532990588247289,603971567915822941,262144 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,1295751120162275383,2560531515012333760,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,15863709786517451734,12011003813712255810,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,11754847109664018155,9693394792328459602,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,17557132579058396676,3226792107937940303,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4616,i,7732400332822035016,9548861585904174522,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,11847632230037256626,1882517347253875569,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5248,i,6166677657083417346,10189027983245662580,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5292,i,13953684726307605340,2952988484138807118,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5448,i,12402123536119692356,6948455325012402022,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,17153756657323800511,14782481909170665749,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5444,i,8483901018445816067,17740361118026604613,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6136,i,17290808002530952397,7878919666765443748,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6108,i,7181990513100834357,8527732791433204923,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6248,i,6874672394054875413,4591919503799305011,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6056,i,5131303086668785689,11929901076427167767,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,12465753203704574074,16563228261818118972,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,10721698740986555544,12131417400187160280,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,13630399318005506264,3113528397363725603,524288 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6284,i,6394778577191009134,5329493661789824732,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5840,i,12614920064477540634,7520123027917090118,2097152 --field-trial-handle=1900,i,15232335995298608652,3262322229216679010,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07d18208-babd-46d3-ae5a-ef20f60ae499.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\07d18208-babd-46d3-ae5a-ef20f60ae499.tmp
Size 5KB
SHA256 9a76947bc0ac912c526eb887ef42493e58de5a8559649cfedbffea46395ed4a2
MD5 d5dc90829e9545558b71c4a363b294b1
SHA1 e9a7875d28579de45e6b2191359cddd6939cafe9
SHA512 9f862cdf2bce17fe37de2b81774fd81c2c53c7aab2320efc1cec4a9e8df71c9563210ed9d0c768ce03118fb4d36b028d0906b310da402bd6314a13829b242f3e
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIQMASl8h4otop5+YDyB6bGyvzecdtvO0A0wW+UHL110jf:u1t0t+W1IeiU21STLcdtaW+UHL11US+
TLSH
T1D7C12B71A46D68B764F6EA96F0033A43CEB5626F64515F94DAF95F1C00E70DD1382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b21b5d2-3d4c-44f2-b962-82b0e93e07a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2b21b5d2-3d4c-44f2-b962-82b0e93e07a7.tmp
Size 5KB
SHA256 48342506786f9376c8a320572722602966664cf806fe6ec30f91c807cd879955
MD5 7319f004811f42f63a81bc575b575ddc
SHA1 61487154cba257170e33e2e2066e0805817babba
SHA512 1eb4c5ce606edd70f7a5e18425626a9595fea181aeac891ec492c34c164c1df3307dade1fb9e6b9add30406a5f794d75c8e95793952c4c587aa512020e8f62c2
SSDEEP 96:u1C0d+qs7PiY+3oDfAIQMASl8h4otop5+YDyB6bGyvzecdtvO0A0wW+UHL110j9p:u1C0t+W1IeiU21STLcdtaW+UHL11US+
TLSH
T10FC13B71A46D68B768F69A86F0033A43CEB562AF68515F94DAE95F1C00E70DC1383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79406031-18ad-4848-a63b-68f3b5208f0b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\79406031-18ad-4848-a63b-68f3b5208f0b.tmp
Size 5KB
SHA256 9246fb741df8ec709bd137d409c1d271add3f8aa332e896bae5cf2329ef4628c
MD5 481f066bd5e264e37768f856531cc368
SHA1 9ccd04b60623bfd92ffd39575608fd2041d75f05
SHA512 53bea5a94c4bf16c0e6d1a70620176cab7cb07cf9126536721ff671fd0e15e46ee9ec265bf4587a4943aed70d6c7aad6bc4ce8ca1495f5b9dd8c7b542e98cef5
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIQMASl8h4otop5+YDyB6bGyvzec89KU1L1cRNC39ISyVm:u1t0t+W1IeiU21STLc89KU1L1cuC8jr
TLSH
T183C10771A46DACBB49FAA986B1033D43C9B9926F68157F58EEE95F1800E74DC0383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04a3ca1a-b7bb-4109-a997-5b907f8bc84a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04a3ca1a-b7bb-4109-a997-5b907f8bc84a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2c9f8654-9f53-4a39-a041-1d6885abfd26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c9f8654-9f53-4a39-a041-1d6885abfd26.tmp
Size 12KB
SHA256 d85ecd00d87b4eeb5a74c73fea33bd6acf56543ce42887d8a9dbb76b3bd6b2da
MD5 7deb94f995218c4a06b7813109ca3ac7
SHA1 b445317389a7062eba433df3f7d4346e81c32bd7
SHA512 4b9a38a769760174eaacfc162754aad270cd6d47ede66d75cd0b5722e8e1e5c2fb0f62f2b36867a9c1c57e85d4a4bc9660ffa928cf676bb74f64208d17b9bc64
SSDEEP 192:7RyuT8ftv7ALvPPRpj5ml09BHqEb+WNnpSx+VfEg1pEkwx+VyIsnAUgE:7RyuofN4PX9DdMecFR2E
TLSH
T12342B62AED14797B9CDBC26BF9267B97E3F0102165901E88E6FC893C24E75CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63895fa7-c479-41df-a505-39432bbf62c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63895fa7-c479-41df-a505-39432bbf62c7.tmp
Size 12KB
SHA256 480c12bff18c7505b517d45d5736b420c6225df16f2cde2fc7f0be214448f556
MD5 8538306e1f584295655803885a451991
SHA1 e4628a03177d004c132015a56ad8a5121df8c103
SHA512 d7efbdedcf3698bea0bd822f788c5d82f75ea2096d95488d2a1355fc785e8cefcef0c6243626e74d639f117e42fa0e2875f6c631109fee7b2c7c0f5b50054c60
SSDEEP 192:7RyuT8flv7ALvAPRp25ml09BHqEb+WNnpSx+VfEW1pEkw7+VyIsnAUgE:7RyuofV46XSDdMecnb2E
TLSH
T11A42A42AE91479BB9CDBC22BF9267797E3F1002165941E88EAFC893C24E75CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 432B
SHA256 d89f57ac8955b418e96188aa35e20f4818db175717f052127bab2bde048520e3
MD5 f2218ae3358d3e03576ac499bcdedb35
SHA1 703ebe6fcb39be69f34c34ffd48a4239963a35f0
SHA512 a3025b80961fe053d05e0b2bfc176f1bfff9dc35afb70654ff62ab9e3d13313e94ad2db660c6559ff10a9276a2c1bedcee02af0960497b47fc930bc97d1f1766
TLSH
T1C7E09AD313B3008AD398223044AADE4B74340D738286086185494DF1BF777822034792
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5e8e366d-ba38-4f6e-ba79-fdb546f05bfd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5e8e366d-ba38-4f6e-ba79-fdb546f05bfd.tmp
Size 4KB
SHA256 e9b813f533be381492c459605f650359cd2f93f3f57cfe613cff83bb89d94bdb
MD5 636952eb1e120ed86a44f3cb8e8b35ad
SHA1 380db58c468eb7b73404532d30160f9042ba0068
SHA512 acbcf6129c654fad7721c9373cffd33702677a4d6d1ffd1acb5cee61166ce10a7dd967285263ebca8748a27031c4097181aa6f9d0e1027beed78f2e18b0b1031
SSDEEP 96:Dtunu+MgA0AbcNn3uluvqu/7WuKuvbquGuXA:Dto1MgA0AbcNn3qWqFzCqtv
TLSH
T11D919DF3C3E8863DC91152F4AB156E2FCE690914832C3C2688E5AE5B67E5DB1E21064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f42d74d-a40f-4662-8568-9ae66d4377f6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8f42d74d-a40f-4662-8568-9ae66d4377f6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 334d337c1426addef8161bdc9ab605fbe54f16852f34a8496a2746e4871a1a31
MD5 d9d684d06150bc15697785e96130e9ef
SHA1 300d2dc8cee51580f1f033694af42a544e457a09
SHA512 e641f721d74fa65950a35e961c65672b571f9cf7f8dfc28641db388a3a62e0d2595217e80f13c81efe06223376220ed9a503c5eb1fcedf59541387678c3e967a
SSDEEP 192:7RyuT4fnv7ALvAPRp25+9BHqEb+WNnpSPr1pEkwx+VyIsnAUge:7Ryu0fv46XRDdMPAR2e
TLSH
T14B32A42EEE14797B9CDAC22AF9267757E3F1102164942E88EAFC883C24E75CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 c0aeb1752aa0a030669b4d0019a8bc9a3bc19bd84f623de3ab6fe2cd01938575
MD5 2d8c8e4fcf012ebb46f7d6f5fdd11fbb
SHA1 013fd6fdc494fb55a6fcf3fc5527e54497f83b47
SHA512 cef3944977bb8f7d662ace8882bbee70b3884ba877de963c5b16eb0ff489fc001f639d669cf17add4fb6ca2b3aa498bd0539d47b81d20b8563cdb7ff7749ad96
SSDEEP 192:e+R4K6v77KxkXqK4I40pUZNCgVLHrKHfFKslEUWgXzKD/Y3+ErUkKN9mZVaC66/G:XRjg77KxkXqKf/pUZNCgVLH2Hfgslwga
TLSH
T1A132E927A48D9A7F0FD8D509CC576F8FACB5029272780D2456FB9C0803A578E124B6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af200147-0761-421d-8af9-d70d652bb8e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\af200147-0761-421d-8af9-d70d652bb8e1.tmp
Size 4KB
SHA256 6ecf4f3797fc778bb7b75f0d4ebe38c57f085bb2d414edac62ca92043660ffef
MD5 7692ce35c4f1285022628732a6109d59
SHA1 549823588ddbb26255425723ae410136af93ae5c
SHA512 5cbc4b9d8fd0ff7ce221cc0f3aeb230214a025258f896552443832d59aedd20bdd2d2db8c8edaed1e57f63234c2cb06ec1948ea3987b0ca77e4187f97b10536b
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5+gNDyB6ndGyvze9a1jbfEv4a:uFC0t+W1I04DUDfS4wL9a1jbu
TLSH
T193A13C31E52D8CFB54BAD989B1533A43CF79A26BA4215F94D9ED6B1C04F70EC0782123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download