hxxps://theleadershipboard[.]co/

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://theleadershipboard.co/
Sample260427-hn4eaads4y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217466648422242"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
5636	chrome.exe
5636	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe
Token: SeShutdownPrivilege	4780	chrome.exe
Token: SeCreatePagefilePrivilege	4780	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4892	4780	chrome.exe	84
PID 4780 wrote to memory of 3984	4780	chrome.exe	85
PID 4780 wrote to memory of 3984	4780	chrome.exe	85
PID 4780 wrote to memory of 1736	4780	chrome.exe	86
PID 4780 wrote to memory of 5048	4780	chrome.exe	87
PID 4780 wrote to memory of 5048	4780	chrome.exe	87
PID 4780 wrote to memory of 5992	4780	chrome.exe	89
PID 4780 wrote to memory of 1856	4780	chrome.exe	90
PID 4780 wrote to memory of 5992	4780	chrome.exe	89
PID 4780 wrote to memory of 1856	4780	chrome.exe	90
PID 4780 wrote to memory of 3524	4780	chrome.exe	91
PID 4780 wrote to memory of 3524	4780	chrome.exe	91
PID 4780 wrote to memory of 3924	4780	chrome.exe	92
PID 4780 wrote to memory of 3924	4780	chrome.exe	92
PID 4780 wrote to memory of 4368	4780	chrome.exe	93
PID 4780 wrote to memory of 4368	4780	chrome.exe	93
PID 4780 wrote to memory of 400	4780	chrome.exe	94
PID 4780 wrote to memory of 400	4780	chrome.exe	94
PID 4780 wrote to memory of 2648	4780	chrome.exe	95
PID 4780 wrote to memory of 5552	4780	chrome.exe	105
PID 4780 wrote to memory of 1600	4780	chrome.exe	106
PID 4780 wrote to memory of 6100	4780	chrome.exe	107
PID 4780 wrote to memory of 872	4780	chrome.exe	108
PID 4780 wrote to memory of 872	4780	chrome.exe	108
PID 4780 wrote to memory of 5640	4780	chrome.exe	109
PID 4780 wrote to memory of 5640	4780	chrome.exe	109
PID 4780 wrote to memory of 816	4780	chrome.exe	110
PID 4780 wrote to memory of 816	4780	chrome.exe	110
PID 4780 wrote to memory of 5636	4780	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://theleadershipboard.co/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa33dec728,0x7ffa33dec734,0x7ffa33dec740
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,6919457179150611403,3571374633373878955,262144 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,17162700879190893836,11790101897713295761,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5003535830196569902,13566317754539590141,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,10511852269784265308,18143514690592002959,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15586607158514446272,13517097151673451636,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,11342289098889395042,8446910219976150589,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,1870326181251355612,4162028574050600108,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3448,i,11023694631259082091,14401535229524283157,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3444,i,15110700481038281737,12719796201850663040,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,2638205780802084856,4416554443533373240,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,4036767728075572665,15425720946166830391,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,10659968929037197215,298615394928770832,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,10029142754279640815,5509528195704725764,524288 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3292,i,4333688927761216789,13259066805568008144,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5772,i,16016570614565222546,11737824879822915439,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3236,i,13018640194876770573,7429787430343132368,2097152 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4492,i,5681903013547402896,8118659978792088662,262144 --field-trial-handle=2096,i,7703455944140787004,15418160754680968007,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7ca32ab3716573f61ed48d14f497d5cbf58c756fe736a96cd4bab5a4d7547e8a
MD5 0d8dddcccccfbe1905ef0026ff79ca4c
SHA1 bef3b3c83e842693c52e35811c1f214e1e4881eb
SHA512 a68c796dfd2fdba07986a0564cbb14a66dc2a4815b3b3ad15cbcbb1aa43e9c46ae1ac92eec0c4b01e805e7c054376428a74d4733e010bc24dcb1d98bed3a5c7e
TLSH
T1BBE022AAD8219C770CF9072861498746EB5513573B80D98F3A3E810C8FB1676929AD6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 fb8b56ab78b0a293c4c7b82febe1890d994c12e0917d37c3bff16d4596bc0ca2
MD5 30df272fbc3a4d98422116ffc318fc52
SHA1 2083decfff6b183d72e80cc4401a687ae78ae103
SHA512 81b22009819a9a2099030144b328ccd16c74b412c831da28814c584593a9eac62be3340f7cbf08742b5a8fad3b8fa70e1730b83b0bb38c02394658592aa44dce
TLSH
T1CDB01201A7B0D5D6CF4201F331900E01A331175C0053073BC6F0209DEA021F18151010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 30fd39d107d973ceb12436d9a2a399a62e30faab997240d7d1d660ff221dc196
MD5 03f3ccfe60832cc0fefb5d15a59dff30
SHA1 5f8d7a3415e55531db5888f219b1e93ad6922cd9
SHA512 0e691987f28423723f6a770656d8e4578f767b51f2e948be24a12ca644116c9277e001fd609dc2e9f7d1ee30efabed64136e3f253dcf9be753dbbd68547379dd
TLSH
T1CC11CC1418F86682CF920E7569490F9F7F354F9C1172A367C31CF46E6B1B2D9007E216
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5e240e206d1165e250a2b91466f606189ea8e4e798a24725e5f5d4604a87024f
MD5 17afbe377ba07686c27ab29722f3bfb6
SHA1 fbf4f862c4092b3a799ad36120c8e9456efcbba2
SHA512 e0da16bd11925d85d23b2837c9a234fd5c642a0c8a5627af1a34e9a2c214f1f505e4c01a399296e6bc9a30e0fa7e710b01fe38fd181dc003f3dded6057c61fe6
SSDEEP 96:D0m590Om5aIaEgdoAiPY19dp+5rvocBdCUDW:D0mn0R5aIaEgdoAiQ9dM50EI3
TLSH
T175A1A9B793F48A2DD91156E0EB127E2ECE790A15531C3CAA89D4AF1F53E24B1D20078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd2956e595f8e4c4f6f29c5c8403a47d92f0c14f4ef1b461d43ea790b67ccc04
MD5 e07cce4d8e8d58cff2b5a7886a4fff57
SHA1 bb9341699f1a246dbe12337f0a19c676c51d16f0
SHA512 cbc99a30dfe882ba4be693d616079d15a74394e429ee66eb9db775c8ce421ddfe75298858df50d1ad153b7662b82b5a219ebb2efeb17991d33d5a31e2a0ef892
SSDEEP 192:sRvCtYVjB3v73pAPRp2Nhg9YHsb+WNnasZKDjeXkC/2yvaLxusVyIsnAUgE:sRvC2fTUXNCwr+eUC/26ajE
TLSH
T15D52E82EA918787B5CCBD22AF9627717D7F5142274D02E84EBFC8A2C15E76CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75cc3582529091a15b145506b266dbf8b342892bb0d47ed27e288c8bcdc2e964
MD5 dd8b3c21b6c08aac931fc5b3778d836a
SHA1 a978a6ca1fbe5b4b8bfba111417d168fa8991518
SHA512 1f891fb8573ec227f23038938b1c9c4b8c52d181ebf0aa739f2b0a0770a08dad1a987d232659d41cb2f5063d5704e38d6c6d0f419efcead80f3598f2a0e98a87
SSDEEP 192:sRvCtYVjBuv73pAPRp2Nhg9YHsb+WNnasZKHX2wkC/2yvaLxudVyIsnAUge:sRvC2KTUXNCwru2JC/26awe
TLSH
T1BB42E92EA918783B5CCBD22AF962771BD7F5142274D02E88EBFC862C14E75CD621700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ee91b5cd757c8ced41a8439b880432334672985ad461b8220acd37f36886cd53
MD5 809285d1d74ca3da03a05fcbb937ac22
SHA1 9450018d159ab984267d42fcc64b18f32e9f6b1d
SHA512 6943cdc8c34a068ff95a258793ec0b74d1b2cc65f9d16b9365284d428915be723fd128a3cf78c5d9e8484a7507d4598793c0b4fe24152fba7bdbb1739eace8e0
SSDEEP 192:sRvCtYVjBUv73pDPRpnNhZ9YHsb+WNnasZKOmY/kC/2yvaLxuGVyIsnAUgE:sRvC2QTJXBCwraYMC/26aHE
TLSH
T10052E92EA9187D3B5CCBD229F9627B17D7F4142264D02E84EBFC8A2C15E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f4932752829eb745a6fddeb4b4076f8c3114f2c068ce6e1ace866a5987364276
MD5 b3b7e7903d575c5252f4dc08740b4ce7
SHA1 e94ad21b336a45ce910c721bdf33e1129ebe9390
SHA512 755cad0efefde4413de8f84019cd63fbb1c7d0801fad4703bfd318c3a6de97eb23761d04ff8990c58a630b979cfc3b200c3ebb5ca79d4e4dbc3c8847bf249579
SSDEEP 192:sRvCtYVjB5v73pAPRp2NhZ9YHsb+WNnasZKDjeXkC/2yvaLxusVyIsnAUgE:sRvC2ZTUX0Cwr+eUC/26ajE
TLSH
T13C52E82EA918787B5CCBD22AF9627717D7F5142274D02E84EBFC8A2C15E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e1e35a80a49f4029746f6b1ac2e6d19b7f10221f2e0e731b059f65c046d2ecca
MD5 6d080f3e88363e6cc240f3b8fc501bca
SHA1 47e6b13e3f07aa9a71e252764f75452e94ef2f01
SHA512 4d87df373ecbcc8f9af389df88f2011165196b54f3fe7e97d722de301f14be7db1a49ccec07b38fb8d5afbe7190fb376fa8e7c6180ddb6ad64e3feca88d229f3
TLSH
T17FB0126080019515C05303B21592048836286F1187092B4257E07971E8262A14014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587431.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587431.TMP
Size 96B
SHA256 ef0f516433304939fd19f9f85fff1efacf42fb1d4da63cede12b3a30e33a2c57
MD5 103eb282009c63e02162a3265fc7a08a
SHA1 2ddbb028d7cb74856bcdad0a7a75c31a3917cdd4
SHA512 5b2bf133423df4f6b17513f34bc87411b05dd33f592f0e81cc637fcdded4f89fff79084b612ef4ff048e93a3f8cec002fe8e837e7f3aa581b73556b97930d3cb
TLSH
T13CB00255C2426223C04613B06695DAE97174DF35CE03532292E02A66EC25B7145395A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 31c7bcdadd5408f2749356a1ce4aaa5614c90d090c85c6048b4566c43be14124
MD5 d46ea4f02d2073ae49ea06e86f3b6fc7
SHA1 db1b4cad87a423f2db7a28772d289186f4bd5683
SHA512 ddd46f322388564ffd9af924e564593b0c7d52976630d4f74a0e10ac38b43025b01ea7dae747f985c9bb6d9f006df941df65dd1f012ce930435be79164987e25
SSDEEP 1536:ofcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3T:E3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T17D9302B98E1B4AF7997E5A91729A7C09CE12120E715FB88C716C938C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 e8ef9d167d55d06def7a97a0db4e5876e81c5e67e98879a6a6a012ed5bf50586
MD5 eae0c54ee7c4acd53c6aa7686f99c410
SHA1 30db2cf0754cb380bf15ee3f1ab8f5d1bcf1d810
SHA512 f3829444f0aae45d214c6ac255c2a70bac62ffa76bab50f5e7589353ccc783aa8efca44e42d3dfcc780e069a7fb5eb397c4789076408a2fc3236727c2208cbeb
SSDEEP 1536:506cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:t3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1A19312B94E2B46F7957D468276AE7809CE12230D709FA9CC316CA39C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e727ec8ca125de2c30500f86b02f0b0d56bb10451efbc74eb2e82f25ba407123
MD5 cb75aa47c2fe3258dc51738c8610e79b
SHA1 0c1dab164be2af44eb4efa947c7e44d0266c9bb5
SHA512 c2ffbac6a8c4b85cc772f8e8dcd858de4ad4752545860a770eea68dabb33d41a94ca9a5e6b378221146d90bb888055f4c742444e115778f4c468220500c0732c
SSDEEP 1536:xKKxlcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9t:gcl3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1CA9312BA5E1B46F7957E4691729E7C0ACE12120E715FA9CC326C939C21C41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 07ae70ff463d016f49a01e32c3e4492af54eb46b4925e8f012a365870e905c2d
MD5 b21c7d6ed73b106774763976534f5ee4
SHA1 f5ed3e568e6cb5f4bfb0898986fa8600ec6226ca
SHA512 3705644ea0a47629dfbe284b7ff13af2a43ca32236e10c2fc27d6f87b3b626cc5a82e07e8e4a85cd3db34cdd09992bb3527e204608bf8b92b3cabeb93bf83fb8
SSDEEP 1536:oKKxlcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9t:7cl3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1EE9312B95E1B46F7957E4691729E780ACE12120E715FA9CC3268939C21C41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download