hxxps://chikouoffice[.]com[.]com/wp-admin0#?bkb%5C=r1nulknvbxbsawfuy2vac2ludgv4lmlu

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chikouoffice.com.com/wp-admin0#?bkb%5C=r1nulknvbxbsawfuy2vac2ludgv4lmlu
Sample260508-nrdwpagt4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227138740239126"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe
Token: SeShutdownPrivilege	4548	chrome.exe
Token: SeCreatePagefilePrivilege	4548	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe
4548	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4696	4548	chrome.exe	85
PID 4548 wrote to memory of 5616	4548	chrome.exe	86
PID 4548 wrote to memory of 5616	4548	chrome.exe	86
PID 4548 wrote to memory of 2492	4548	chrome.exe	87
PID 4548 wrote to memory of 4196	4548	chrome.exe	88
PID 4548 wrote to memory of 4196	4548	chrome.exe	88
PID 4548 wrote to memory of 748	4548	chrome.exe	90
PID 4548 wrote to memory of 1080	4548	chrome.exe	91
PID 4548 wrote to memory of 748	4548	chrome.exe	90
PID 4548 wrote to memory of 1080	4548	chrome.exe	91
PID 4548 wrote to memory of 6024	4548	chrome.exe	92
PID 4548 wrote to memory of 6024	4548	chrome.exe	92
PID 4548 wrote to memory of 3960	4548	chrome.exe	93
PID 4548 wrote to memory of 3960	4548	chrome.exe	93
PID 4548 wrote to memory of 5552	4548	chrome.exe	94
PID 4548 wrote to memory of 5552	4548	chrome.exe	94
PID 4548 wrote to memory of 668	4548	chrome.exe	95
PID 4548 wrote to memory of 668	4548	chrome.exe	95
PID 4548 wrote to memory of 6076	4548	chrome.exe	96
PID 4548 wrote to memory of 3752	4548	chrome.exe	100
PID 4548 wrote to memory of 3752	4548	chrome.exe	100
PID 4548 wrote to memory of 3460	4548	chrome.exe	117
PID 4548 wrote to memory of 1748	4548	chrome.exe	118
PID 4548 wrote to memory of 3564	4548	chrome.exe	119
PID 4548 wrote to memory of 1456	4548	chrome.exe	121
PID 4548 wrote to memory of 4808	4548	chrome.exe	122
PID 4548 wrote to memory of 4808	4548	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chikouoffice.com.com/wp-admin0#?bkb%5C=r1nulknvbxbsawfuy2vac2ludgv4lmlu
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9ddac728,0x7fff9ddac734,0x7fff9ddac740
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11959711682671511141,10259343752767721378,262144 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=296 /prefetch:2
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6964304877348778319,6335894948363936376,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6494554152797739778,15206883516246698512,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14865419702251245769,11408762621212178378,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,972437622553391997,7299079721457841145,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,15742777094958980465,13459741375160038358,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,16509171338470830417,1186966153362987542,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3500,i,604217910877059732,6061251054537672954,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4860,i,16779931632796425443,15050153815499452711,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,5727647608317777003,246664447859884388,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4740,i,9633426461210580030,3491864826780221111,2097152 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,10787071838969087231,1476125376403291703,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,3944220222514976931,13835385265145998870,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,5593383238006748458,3543477617775526820,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3304,i,17069182079766824974,12242558461665629701,262144 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=988,i,11097473698536927082,980184881856915222,524288 --field-trial-handle=1952,i,11205936713652412726,14543595490086103201,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 07033c945cb25369fae8ce604cb08976b99965958e8ff6f0c13d8f5443a299fb
MD5 f5ad77f63b8362a4c30342f7e2975847
SHA1 f8d668393469adc0900759bd2bb22697949638e4
SHA512 22719196cd5f13f68896019272275eec3f603cd56b5d7ff7b74bf2c9762712bc80f1bf78f2e1ab69a382b66f54030803f658570d7a7502a34fb7cc3bbae4a0ce
TLSH
T173E022ABC9A2EC2B09F91B186015470AFF5013572B41A90F7A3C964C8FF663B498296C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 18KB
SHA256 9144b23ca2d18336e13ede1fbf7120fecf9b5068248370b0d37e459d9a915953
MD5 cc200ce588500e57e211e23817049653
SHA1 34fd8a8d7bbf0870cb243878511254759d0b8989
SHA512 2379be62da34371efd9d17cc864ecb9b064bb788d9ebd599a9289711fcbd1f734a34baf137699173ad84fd554e1c8a86cc900f77f001fb548d7df7f86973b95b
SSDEEP 384:p8OX/YI2uHkpehSKSL0QESJZ4YsL7oPsW8HfaZDJFbH/9c1l:p5b2uEpehpxQZ4KsW8Hf+jV+
TLSH
T1C182D0E4295B8D1FD5C5B33F22D871CCE565023CE82B98295D6389BD032E8B6F508C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 528B
SHA256 5746c81dd5d2d0857a6290ffa5c4caf077586fa416f56233e28e2952df5e7e69
MD5 30accce4fe510ba623195361418bc52c
SHA1 b0181fc879aff0fdc856b293520c1be41d18b5ac
SHA512 946487f8277a2d631eb9baf8227a67417be1c8c87a9766fd8ba7f549a69282d0c879be83edec75b75d95ebd0598cd643038078c0ded07411dd7158b593e626af
TLSH
T119F02220BD916F6AC7877F3024E48D696A31CB9EC3131E47A04580747CB2ABEFA01C8D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 69ca77922a01b9515b3b5e964ffb5101df24581aa3a74312195979dfdc942dbe
MD5 54fdb6dd2b92f5d68a54ee24ba9baeac
SHA1 cc837a855221843a800f571d59b04b04d7d9b484
SHA512 8891730be46e204285ba78628f877081b21fc384771fef60d84d84c4e6c8499a8f80018d4ad61a5e9063ca308d69041e41b2ebd763c3c0de0c4705b0cfa2d9d8
TLSH
T15C01245038145F6BC343FE7411D08E59BE31875C82131E5FE155E3397E72BADAA21A8D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 04cb52997345540af967108ca36f7e90004345ee3f5ff469eb4015c2fd52fd49
MD5 3d9da20ac00dba9a902ac0672dd61a1e
SHA1 e5dc71eed996960217e0657d5adbf2e973502807
SHA512 fedc892e4c1a36b48cb4edcf4b94d103b317ff554dc3c0f6d767e5186e7bf4a538ddebed7c80ea8dbc57eddc288daa905cb89364452b647dedbe008834fcf772
SSDEEP 192:D0cR17Z5cid+daaIEgdd9NmDjdGBcW2oiU3/8hflwjh2:D0cR17Z5cid+daaIEgdd9NmDjdGBcW2N
TLSH
T1D9F1EFF3C3E5467DC91252F0AB146F2FCD690A1643A83D4A89E4AF0F93F1872D255A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 158141498a366e7f66c71bf5272d7fde4cf6f979d0de24698b0b3668b921ea78
MD5 8aa4c5fc09a1d2761d15e833edea9528
SHA1 826f81f46fba029cc070e00a75387ea6b9802b4b
SHA512 c522bdff6aa3ba09d60ec1dbc2feea45ff4a3c27d3ec076971e2bafa5eb396d17c9d164a38487f99f132990b25b84b0267e454522582281892ff76fe41ea4a93
SSDEEP 192:D0cR17Z5cidWaaIEgdd9Nm2RjarGBcW2oiU3/8z:D0cR17Z5cidWaaIEgdd9Nm2RjarGBcW2
TLSH
T169E1CDF3C3E4467DC91252F0AB146F2FCE690A1643A83D5A89E4AF0F93F1872D155A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ae8eb29ba73172af5b2b53987394576de36ed4c1e51596e7d574d0214c7f16a5
MD5 0dc4fefca15b6d5fb93a68bd456baacf
SHA1 0b28d9c730fa54e420af62c6038009da5952a586
SHA512 fa55bbaa883f093faa4b90bb60a11554503f240df5c7f7396ebdbb70edbf365c2baae69831b7a0905c58f802baccc7142aa1685ef2462b4e5ee14994a3a05c2a
SSDEEP 192:KRNdkmD5S8VMv7jap3PRpbnAt9mHsb+WNAaN27fbWlAh1L2eE2yykwrhgdVyIsnv:KRNdRDPYa5XwIwAVkAj2L2yyLerE
TLSH
T17152E76EA914293F8CDBD229F9667B67D7F5102125802E84EAFC8F3C15E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5a7a92ea97184bd9bb4bc4974de8c684648c4ce605c64ae432ff7b022eba9ca4
MD5 617268b76ccd97f2a6485be72c58e4a7
SHA1 9c68475366ae2052e46d86ad47a5f2414054014f
SHA512 26fceb330fcfe79991c158f0dc1472bc1f206aa90e8d9c2a0f0c175304e267ab832d7891604bc6dc201d559db9169e9b999f54109384bd1d10e77ef43be48df8
SSDEEP 192:KRNdnmD5S8Vdv7jap3PRpbnAq9mHsb+WNAae7fbWlAh+V2tE2yykwrhgdVyIsnAI:KRNdmDPda5XrIwA5kAC2K2yyLerE
TLSH
T13752F86EA914293B4CDBD229F9667B67D7F5102125802E84EBFC8F3C15E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62f96fef820a416761054e99ac9ba16519a651b71189b6ae46611f6faeeb2561
MD5 5b6c0aedaec406d919577b870bb47520
SHA1 dd06349593a88538c46ee59a835d0448694a4a3e
SHA512 f1bcdf30f4ef95e8faf4b44368a700dfca467b7a699cff3df1dd7df5403c71fd5e55252b78b874431b236ea7604590bb48c5c59112d68da8c7fb91b41f33e909
SSDEEP 192:KRNdkmD5S8Vipv7jap3PRpbnAq9mHsb+WNAae7fbWlAh+V2tE2yykwrhgdVyIsnv:KRNdRDPipa5XrIwA5kAC2K2yyLerE
TLSH
T1BC52F82EA914693B4CDBD229F9627B67D7F5102125802E84EBFC8F3C15E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 016f364a67c0ab2c79e7840e19f7eb30ebfae576abb95fe5fc73c05aa9498a80
MD5 e83a90d942a690e19e6c308c096f3073
SHA1 518efba851a9e95ebb5186bc484d2f2eddbfd0e0
SHA512 4ebb2bff4218cbcdde7bb6cf5368212bc8961b77d29ac0c83a91cb10772e637df1f066fff4038ff3c4a95f98dda6917a285f4c7d5c9a3c986765cad25de4e21d
SSDEEP 192:KRNdnmD5S8VHv7japAPRp2nAR9mHsb+WNn7fbd62WE2yykwrhwdVyIsnAUge:KRNdmDPPaUXlIwD02z2yyL+re
TLSH
T14B42D82EA914793F4CCBD319FA667B57DBF5102165802E84EAFC8A3C15E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d87506f5eece6c8d26b8699520788943e237e62fb650156a77be9c6da3c6aa66
MD5 cdf85bf988e47c84cc3917af70341ab5
SHA1 7f036876b6e63f3b5525fc4a76390cf6aa5c6c1b
SHA512 90a2e70f04e1d2d8d345339b792e30bbce9f2e7934e4fddc420a6d7ecd30a8578d209373eadabb62c870104144e3df552d48b5f7356fa92f94505fbce0cdc8a7
SSDEEP 192:KRNdnmD5S8Vkv7japAPRp2nAq9mHsb+WNAae7fbWlY0E2yykwrhMdVyIsnAUgE:KRNdmDPAaUXmIwA5kYJ2yyLarE
TLSH
T14B52D82EA914793F4CDBD219FA667B57DBF5102125802E84EAFC8E3C15E7ACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 90837ede42ccf7f06138566e5d86c0faba29112ec6fa5343eee94287f746fd50
MD5 973c52f58fa6a320ca4eaa6571b8829e
SHA1 061107d3c8a10b0fe8898338057301eabfb07716
SHA512 2c2dfd8fcaa34d13b3916773612058329b75bec8e5d22f4e276e7a10d3f977d7976d93a8a6376510045b52c3c0467ce5272d3647903279d90a748694c9eed9d0
TLSH
T132B0121084029D05C04702B111D6048831245F20CB0E131593F06DB9E83A2B18054150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5871b0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5871b0.TMP
Size 96B
SHA256 f4a4d6d315614625a2324339609e2f6979c8163e89851c372dc2abad00f7d61b
MD5 b9b993667aad3dc5e17b7e669c76b495
SHA1 4fd973ff332dfd07a0e001c69f90e5f5401e6716
SHA512 3dadd3e5f09fe3c5c78601ba4ddb30b971a11781b61f846b3d38494686fdda7ef9f9b479c75fe617701711d69e0bbecd514fd7129a1842271abb62e9869d008e
TLSH
T18BB0222CC0032202C08203B028A0C0CCB020CF30CB230203B2E00F23CC2A3B00022030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 ae5213d339d187214009f6171a477ae69af84504c60e11db94fdbeea354649eb
MD5 d1ba3bde48323f6015c4856ee05da0ca
SHA1 e343b7ff8984f2bfac363013065b46861720130d
SHA512 e4503e9826f933106e567e43559364784633f76e6ba73a62eec5aff8dda5ef4cfd1f41816f7e6720f70cccce7bfcde962e73277cc39a8a34a6ed1300fcdaa332
SSDEEP 1536:0EC3cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0L3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1129302FA9E2A46F799BE5691B29E7809CE13130E719F68CC715C538C21D41C82B63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2e05637c78cabd28249e7eac51445db55df03c03df6411ebc9afe9df6fc9b188
MD5 f668a97205021bf730e38b70d8ba4508
SHA1 66483167989e1cde463e3ba1f825b87442226c24
SHA512 633cf06ddc7a7958994322f2281834eb39258c67121700a95f0cb915f994dfb80422c2a778af965ad6ae5777d9b19d1455c67c59598081e8726c77fda17256c3
SSDEEP 1536:0YC3cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0f3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T15E9302FA9E2A45E789BE5691B29E7809CE13130E719FA8CC715C538C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 c90ef6994a31c0ae43695ae398cb5b2abec925f4af69ac81867ff1a9e59ed8f3
MD5 cf46b78eec7018642c50b0484780aa77
SHA1 2a59100af6c7a0b7e6d476aa3e2f68f3f31c5a11
SHA512 e27e12d6e19208fa046915a9f0e7bce5d0ba44b3cf173d0b5eee9511860c87f7053db5b70ab794a1394533cf26e7ab320ebf7c79839dc81499d73d5437115f52
SSDEEP 1536:0cCLcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:033Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1EC9302BA9E2646E7997E468176AE780DCE13130D70AFA8CC715C639C21D41C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 bc75e781f3c0c066106748f67d69cfb81e27c763e0de08e47b46c330baa4d799
MD5 20bb476237a025d38a64aedad3265a3b
SHA1 e4afc510782a76782309a730d960bec81a700db0
SHA512 43f358b8e635220703b014a5b01d988fabfe43b962de331e5cb1a36d92619ebe91127c50bd752619449260c8f175a211207b5a4c806c3a11d2d05e2ae0eb6023
SSDEEP 1536:0rCw7cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0D3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1FF9312BA9E1A45E79ABE4691729E780ACE13130D705FB8CC725C539C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 3640828e7eccfff4012c03fe0a460186ceac95c3d27dddc5153cf5dcbfacdb5c
MD5 093c1582cde97bc940acaba5340d74d3
SHA1 d11722f2a325e0ab0195001a8d9387d25f9b2690
SHA512 f2afd1b22f7ed7367ef9d75ab23b46f338995e5b729ebc9f22ad8e754b358028e54f146b17236a18275b99b5ce98226a13818a62788cb1bb35b2a3e9277c0f49
SSDEEP 1536:0YCw7cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0S3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T15A9312BA9E1B45E799BE4691729E780ACE13130D705FA8CC725C539C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download