hxxps://is[.]gd/xfco

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://is.gd/xfco
Sample261030-3raxcsts2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3496	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2072	4492	chrome.exe	88
PID 4492 wrote to memory of 5004	4492	chrome.exe	90
PID 4492 wrote to memory of 5004	4492	chrome.exe	90
PID 4492 wrote to memory of 3496	4492	chrome.exe	92
PID 4492 wrote to memory of 2564	4492	chrome.exe	93
PID 4492 wrote to memory of 2564	4492	chrome.exe	93
PID 4492 wrote to memory of 3796	4492	chrome.exe	95
PID 4492 wrote to memory of 3560	4492	chrome.exe	94
PID 4492 wrote to memory of 3796	4492	chrome.exe	95
PID 4492 wrote to memory of 3560	4492	chrome.exe	94
PID 4492 wrote to memory of 5356	4492	chrome.exe	96
PID 4492 wrote to memory of 5356	4492	chrome.exe	96
PID 4492 wrote to memory of 4748	4492	chrome.exe	97
PID 4492 wrote to memory of 4748	4492	chrome.exe	97
PID 4492 wrote to memory of 5756	4492	chrome.exe	98
PID 4492 wrote to memory of 2068	4492	chrome.exe	100
PID 4492 wrote to memory of 2068	4492	chrome.exe	100
PID 4492 wrote to memory of 2512	4492	chrome.exe	101
PID 4492 wrote to memory of 2512	4492	chrome.exe	101
PID 4492 wrote to memory of 5708	4492	chrome.exe	104
PID 4492 wrote to memory of 3584	4492	chrome.exe	105
PID 4492 wrote to memory of 5708	4492	chrome.exe	104
PID 4492 wrote to memory of 3584	4492	chrome.exe	105
PID 4492 wrote to memory of 2664	4492	chrome.exe	106
PID 4492 wrote to memory of 2664	4492	chrome.exe	106
PID 4492 wrote to memory of 1152	4492	chrome.exe	107
PID 4492 wrote to memory of 2700	4492	chrome.exe	108
PID 4492 wrote to memory of 1152	4492	chrome.exe	107
PID 4492 wrote to memory of 2700	4492	chrome.exe	108
PID 4492 wrote to memory of 1340	4492	chrome.exe	109
PID 4492 wrote to memory of 1340	4492	chrome.exe	109
PID 4492 wrote to memory of 664	4492	chrome.exe	110
PID 4492 wrote to memory of 664	4492	chrome.exe	110
PID 4492 wrote to memory of 5140	4492	chrome.exe	112
PID 4492 wrote to memory of 424	4492	chrome.exe	113
PID 4492 wrote to memory of 5580	4492	chrome.exe	114
PID 4492 wrote to memory of 4760	4492	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://is.gd/xfco
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9b63ec728,0x7ff9b63ec734,0x7ff9b63ec740
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,17921952693844855350,10907121860884633088,262144 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,10350947870085841012,14392359952154885037,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,9823358584155776989,372452690032123576,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3064,i,1157103127829780199,6050023043546146953,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,4863853525552067670,3311438046607549109,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,7037861082012063398,17300848381699197734,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4864,i,11522986422749150644,3341112381131839808,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,13364887154752357299,11343393426629147104,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5572,i,874582091551306541,11753672175892941797,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5612,i,5469953825309968665,11848920098882664071,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5540,i,15890451772692517831,5165397095650265321,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5596,i,10003177718415448856,2483737297567948449,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5688,i,6681241714739341333,4846372401267703273,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5052,i,5313951027704143051,1899192771073793375,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5080,i,13101360119144712266,615182589132807080,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5072,i,11480930181061615065,11172418841275419586,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5748,i,9070958615888303373,13680930446800518116,2097152 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,9386125255925502111,16837815756881355893,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3868,i,4059082490559112247,13057794828677403151,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,7141911708857589624,4727969859861574518,524288 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5700,i,7714275882984106456,1807759279359980440,262144 --field-trial-handle=1904,i,10394358861854647491,9144237213016718179,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33047dab-1f3d-47f4-90f9-5c8a167547aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\33047dab-1f3d-47f4-90f9-5c8a167547aa.tmp
Size 40KB
SHA256 821f508e390b72603b978e84d2d2439b8aef6e00187e3164e1b6883a46480651
MD5 74560add821b67b2d8308c78277cb08b
SHA1 4ffc158de14bf31cfc7632fd974af5f5fe4c763f
SHA512 11e69b29f59824fee6cd1d623f84ff25ed55503c14cc43308e9d7168bfd079ab48d2d47ba5ffbf83e9fafd2ec61c8d33d21473f9e5f4c3ec5ea6d8b9a69c49ab
SSDEEP 768:huRPNjN+26SHfeavzdbRsojrU6V2bbQqbH1MKRTRdL9RlJjUOP/8+gG3i:4bNjfeaNP0VtR9h3jUo/xi
TLSH
T15313E1B0242C4D564574D595F01FAA0BCEF8B087E579BE84EE77AE4A01332C9A2C713B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

999eb222-8340-4794-9999-ab9c6e340aac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\999eb222-8340-4794-9999-ab9c6e340aac.tmp
Size 5KB
SHA256 3aaf2022f8617b672e46dd4f457a2bdecbd2bb5d3daa5b3c221fad0854478ec6
MD5 783aaa145a2c0caea257a206a3eb1d99
SHA1 f781f45ceadc1f1ef090045c5f41236d44a7ecc3
SHA512 f67dba4c09a1bd0276c49c4209fdd56f2b8e9bb003b7d8d210cd6bc2bcead12b64d10fe5070fcc0d6213509686f98826a60894c3312a8294989d03db6e8007e5
SSDEEP 96:TbJ0d+hK2ilc3fBgqho/LysSl8h4otop5jRRDOB60GyvFx/n1QzbtfSKnK/0j9Im:Tt0L2ilYgm0PiU2thusm/WIKnK/U/
TLSH
T1B3C11A71A4ADAD7328E3D651B0033B43CEB860AF59546F94EAE91F1C11E31AC1386937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cb49081-bc75-469e-b115-aa342d369b6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9cb49081-bc75-469e-b115-aa342d369b6e.tmp
Size 4KB
SHA256 e3824aa36391fadb600ab426b76204aad4b8bff7ccd918368ec595638e95d6e4
MD5 95c3f872f67e50d71c2393c0ae94a693
SHA1 38e02858271b5e9cf76efeb0cac0927d5b1fce78
SHA512 ff5d0215f04b8a5a633d5389a23a7a1703cf54c1559f7e9d672e033b114dd3744cd6cd46f96cb0702904dceec7b9bd5664552116cbec2994b5d821ee574e7f03
SSDEEP 96:lC0d+hK2ilc3fBgqho/LyVRDotok5jREDOB6iGyvFrGKFbmWav4a:lC0L2ilYgm0QDUDtyuyeGKFbvE
TLSH
T180A13A31E5A999BB58F39584B0437E43CF68B1AB5572AF84E9DD2E0C11B71F80343927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f2fe33b-13bc-4f93-aba3-bd7842905c3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f2fe33b-13bc-4f93-aba3-bd7842905c3d.tmp
Size 11KB
SHA256 3e042a78069df471785030db0627d5e4ec0994e749287e8e406640d8382af960
MD5 d03eeee26e463e701f7610e108d55593
SHA1 881f5ccf1f946a1ddaa3536c9c5e89f14e25a2b8
SHA512 c4a0c77b83396811b07f862866f64f3ddf5185eb8fcfb4d145a9fa7eadb49105616292ec9885f92aa5f54f43faae9e55e6c74a5b9d41719d0cf10b35818ce1db
SSDEEP 192:hRhbx6Db7Sjv7/vAPRp2iUf9QHsb+WN6/L8FUS2CxIL2kuQgVyIsnAUgR:hRhboDU76X0SwNX2CC2MkR
TLSH
T13F42B62AA910797B9DEBC226FE267713D6F5202224E11FC4E6FC993C24D76DD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ff55ac8-d6bc-468a-aa9c-439650db3700.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ff55ac8-d6bc-468a-aa9c-439650db3700.tmp
Size 11KB
SHA256 a0b2abcde11929c1ec002bf16aadf440f79632a2da7950c3f0eeec69e9d8c8e7
MD5 3199d3067427d1fc305dd8fb75358905
SHA1 d91ad56f2e588b2b9694a2542e908e2fd1c11ada
SHA512 720c52bfc561f5d80005a0533d81abb74fc0b94eae7514455ae6796441121c8fe08a220cb1d2dde7b5fc36d31a38e258bf1052b683d2fadb3629ba0cc9a1299c
SSDEEP 192:eb04K6pV7KxkXqK4I40pUZNCgVLHrKHfFKslEKzdXzKD/a1+ErUkKN9udOGIrv:+0jCV7KxkXqKf/pUZNCgVLH2Hfgsl3dY
TLSH
T1B332D727948DAA7F4FD8D50CCC566F8BADB5015372680D2892FF6C1803E97CA114A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36459124-a673-4d26-ac31-a651907f1e3c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\36459124-a673-4d26-ac31-a651907f1e3c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1008B
SHA256 1f376d24fa423e54d131336034109e19357390818df174fcc79b7c894c01b171
MD5 d172302dbd8eeb5888d1f1dc7f5d6fda
SHA1 448e2e146ee5c6f9bb507a12010ecc79346ffa18
SHA512 518acdb0efb736413850a9774e3a3c227dbf78027491ea8713ba961a323b409b4756c9a57d9b32285d1cbb84649ad114eea0379718ece041f237e10a5dedb3aa
TLSH
T16511474418894C50DFC55BBD46E56F08317B4D54954F5F12EEC098FCB8C37930757696
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

43557a07-85ad-4cc7-a570-fd53195302d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\43557a07-85ad-4cc7-a570-fd53195302d5.tmp
Size 1KB
SHA256 0b1df717190e68366fbf0df1d77723592cc80aea478e8cc32904527892616421
MD5 966a1ef6729d250882f615613fc57edb
SHA1 c476f6d6f285de56cb8a1d03a3b835d26daf02e8
SHA512 324b38b48df50a21214a02dc8940629bc0b6056b32e5188b0c377e8c2f27a4a672f170db9a9eda474108febccd61f3c943cbba0c05004693b3758b7c39f20978
TLSH
T11A416AB3C3D48A7D890166F9A7152E2ACD390914621D3C56D8E8AE1B53E2CF2D68054F
MD5 SHA1 SHA512 TLSH

Submit Download

ab6ee654-b138-4efd-aa0d-941c90858a87.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ab6ee654-b138-4efd-aa0d-941c90858a87.tmp
Size 7KB
SHA256 dcf2c2889c7622f21cf7c4d23f4d065307e3b35872ecafefb02da247bbedba8e
MD5 9c7dc35370a8f2d500566b3421ee07f6
SHA1 e08eb148fa3ab7d540efa5cbd5f747fc3616669d
SHA512 7f1202e6f9d2e9c8ea6a09e5bd0967936ac39d61e74b4102abc649fc82abde1aee3fb56002c8c916a290c78adb2c676d948bc4df20d2725e86c5191107e70259
SSDEEP 192:DaQaxAaIaEd7krNSuI7SGE3/k/jSVRMTes/TcKvXjdp5Q1FlOSMOHq:DaQa+aIaEd7krNSuI7SGE3/k/jSVRMTr
TLSH
T1E5F19BF783F89A7D8A0151F1BA242F1FCF791415571C382A88E4AF4797E38B5D250A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3327296-bd6b-413d-9e44-47a1d68afa54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c3327296-bd6b-413d-9e44-47a1d68afa54.tmp
Size 1KB
SHA256 b4472b7c20eabcb4a36d8c8d4b25d79badd2defa9d9be6318928746d4a63ee85
MD5 c0c117c040aa08aead20dbc740dab1e8
SHA1 07c431dd480ff63399dd131a63e37dc8df76c246
SHA512 b9e7c08f7d947305f3b7a0545d942fd2b3f465631c33ac3b65f0bfe6062e6925802e8a46b12780577c5c50ad5bd9e4813b12cce30cc3e489a59d226fac490e0b
TLSH
T10B416AB3C3D48A7D890166F9AB156E2ACD390914621D3C56D8E8AE1B53E2CB2D68054F
MD5 SHA1 SHA512 TLSH

Submit Download

f9c0e93f-5af3-4509-86bf-07ccb058ba01.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f9c0e93f-5af3-4509-86bf-07ccb058ba01.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e5820c9b-1d5c-46df-873b-72bc9827d071.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5820c9b-1d5c-46df-873b-72bc9827d071.tmp
Size 12KB
SHA256 fc8a12b2b2e40ea2933247f8a9b558bfdd904f4ae4454dae67a9773c64d40270
MD5 5e509956a7b0749f5e8baef8ad637cea
SHA1 6508e07f590c519f59525a9afeec7c7d55ddbf7e
SHA512 98f535724295a99da4c3f56637a81a192beb65472a2bca80db7c7baf2a57829cf1a76ec3e4f784294df17907b805e65ae0dce8c4d8e4c550d41f5ef543e9d300
SSDEEP 192:hRhbx6Db7Sjv7/vYPRphiUf9QHsb+WN6/L8FUS2oTIL2kuCgVyIsnAUgE:hRhboDU7iXdSwNX2j2+kE
TLSH
T16142C72EA910797B9CEAC219FA567723D6F5202220E11FC4E7FC993C25E76DD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d33f2bc5-c9a9-4898-9d06-04431fe0867a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d33f2bc5-c9a9-4898-9d06-04431fe0867a.tmp
Size 5KB
SHA256 927e9c8746e15b9fde6461819b4e9b22651ddd2f906dc1aa6eac9909ce04433f
MD5 c75265cc2caefa99162d2225d54855e0
SHA1 c45f2a2df74ddb1d279930a906d532138531d4b4
SHA512 ac342b34403dae84d40fa629e264353ca10d79dacd615066926775083efa132f346f4d70f019419e365cab3e6391d4009ebab3b608b88226e9d491dda11a5361
SSDEEP 96:TC0d+hK2ilc3fBgqho/LysSl8h4otop5jRRDOB60GyvFx/n1QzbtfWKnK/0j9IF0:TC0L2ilYgm0PiU2thusm/WUKnK/U/
TLSH
T116C10971A4ADAD7328E39651B0033B47CEB860AF5950AF94EAD91F1C11E71AC1386837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download