hxxps://qrgo[.]page[.]link/dcp5n

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://qrgo.page.link/dcp5n
Sample260516-1885dadv4p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1056	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236941455775604"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3232	984	chrome.exe	85
PID 984 wrote to memory of 4668	984	chrome.exe	86
PID 984 wrote to memory of 4668	984	chrome.exe	86
PID 984 wrote to memory of 1056	984	chrome.exe	87
PID 984 wrote to memory of 2964	984	chrome.exe	88
PID 984 wrote to memory of 2964	984	chrome.exe	88
PID 984 wrote to memory of 548	984	chrome.exe	89
PID 984 wrote to memory of 4972	984	chrome.exe	90
PID 984 wrote to memory of 548	984	chrome.exe	89
PID 984 wrote to memory of 4972	984	chrome.exe	90
PID 984 wrote to memory of 3860	984	chrome.exe	92
PID 984 wrote to memory of 3860	984	chrome.exe	92
PID 984 wrote to memory of 4004	984	chrome.exe	93
PID 984 wrote to memory of 4004	984	chrome.exe	93
PID 984 wrote to memory of 4316	984	chrome.exe	94
PID 984 wrote to memory of 4316	984	chrome.exe	94
PID 984 wrote to memory of 1284	984	chrome.exe	95
PID 984 wrote to memory of 1284	984	chrome.exe	95
PID 984 wrote to memory of 1664	984	chrome.exe	96
PID 984 wrote to memory of 1664	984	chrome.exe	96
PID 984 wrote to memory of 4348	984	chrome.exe	108
PID 984 wrote to memory of 4348	984	chrome.exe	108
PID 984 wrote to memory of 3892	984	chrome.exe	111
PID 984 wrote to memory of 4788	984	chrome.exe	112
PID 984 wrote to memory of 1984	984	chrome.exe	113
PID 984 wrote to memory of 680	984	chrome.exe	114
PID 984 wrote to memory of 4200	984	chrome.exe	119
PID 984 wrote to memory of 3504	984	chrome.exe	121
PID 984 wrote to memory of 3504	984	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qrgo.page.link/dcp5n
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff0f66c728,0x7fff0f66c734,0x7fff0f66c740
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,9028686575342372063,10130429586548684838,262144 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,11864882230920734205,5193597287565611224,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,8738199301554532769,13935196837684602775,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,1302571802543453785,4700242284699001099,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,5308286578377021227,16695347504975874163,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,6347615934835204045,9589622445370841156,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3544,i,12556000397173339598,16125694724630066724,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4744,i,17801630985184097795,1688605351647788202,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4976,i,8379570202968798024,10798034186457372389,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4900,i,15745298143592671767,7578725900731969926,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5348,i,17889504475436683665,15462263712833080156,2097152 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,8130188116350213449,18175919331294956189,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,6227385967230321828,11710027840294171100,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,7568325394399345493,5716676208116442587,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6616,i,15642172761950872754,2296012177984479732,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5716,i,7624540711651024590,9211931823119110501,262144 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,12528525079627902384,1305856771256140893,524288 --field-trial-handle=2036,i,3135037978360581427,722221123558901698,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f0fd478ce0fe8337d27ff920c9d23d60ee5c44faafdba1506b170e163474a159
MD5 8dadf5f83b134977bb32134979292f72
SHA1 c41cae94a9c70d1c7811e3aefcfdc11927b20506
SHA512 c712699d7d98c68184b6b5c6b64e769ac0c35e94a0ab8ece49e2299719be95fa2b2592b2db8ddfcfec2a79216fe06b8ffa5170ca1756b3f002b05add94a7ed8c
TLSH
T119E02BAAE9399C3B2CF9572C60540B86D74013573B50A98F363C810ACFB5B370546C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 40KB
SHA256 6380d520b36f94a2776fb927b36e2cb16afeffecfd0227e83c9c8568cfb307a0
MD5 526a3bdc8ec60c264e4a249e38eb54f7
SHA1 90898de4ba15fef8d3bf7f1ef5abc095e8406cc2
SHA512 398fcfd945ceb177a380d47208833f5a5d116630461985e08a91ca8591cf39d90d878cc86416e062f959457fa1613e4de37461fe787fba18602be18c9416b0c5
SSDEEP 768:xdeOe7eyjhRe+aoNkqmoygJNb1aVnzkDHLgwaiK1cgv5xq63:OOe7ZHXaoNkqmo7psz85aiKHviW
TLSH
T14503F16FE6A1F072ADC093CBC146D676216FF5B84EBAE41ECF32492B451299230C715B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 653ecf5eb276324fdeaf1b7e2d2b3dfbfa752786cffcc1e5c695e4ad2af99de7
MD5 309e71f781d1ac7a27c35cfda6cd4af6
SHA1 5d3b1546eca1b7b51661ff1e9f40f5b96cfb9e11
SHA512 085641d93dbf68dc5504bece2b1def9f647fb3975f99a21b6167b1435d7e3eba80dc4e798fca58f4311cd0d47e836211aa2ec65749bee825b6567e64ef36acb3
TLSH
T1E13197F098E23081CF911672B0C51E2932B9589A1A13EF57AE5D0738BCB7FCC9B38190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e121490c25bed20beb934ca0c25abd89c0248946ec9b02ccc916f34562adafa9
MD5 0db848f9dae4ee085376d9e641ae1835
SHA1 05a463ecfd7c65ff3b48aeb818ba3d09fdeb0d06
SHA512 a8b4e99da5d7f10705e7552cb452c00752e03afa7adfb175b82d8e20289abec0ce2e429b8ff7a21f9297f71f12e40cabff32be686cf27c520442a9c53d19db94
TLSH
T10921BD514CC23180CFE61372B4C90E1973B689AD11036F07AE694838F8B3FCDA334581
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 137ba9bc85fdc49b5d022b90fd91992b34a6b39b4abca73c006d188eae61f3aa
MD5 4e99ddc17853a31921ef95cc0f65ba1b
SHA1 16d2b27c0c350d460472abab4cda234ed0597556
SHA512 0fa3d2a234d7cb4996f2f9c46bb6393d0932bedb320ac5957a367312bd1fac012d4001cf79e0d63c27c44497f2a7e36e6632b55acea3a27858ac3c3d77ae5f76
SSDEEP 384:DAEmdmuOlRX6KTU2s6My8vDtaL00BEtfCguuMHDlND7KGaqPS6l6DcXSbn12mABc:F7VErj
TLSH
T1A0629DF7C6F8CA6E881211F1AA153E2FCE1E0958D31C3D1A8AD6AF4BA3D2471D145D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 5cdedfd18ee87754c0ac1ae0f9254c2ac70bb85ad71d72dc2e41e6920178e334
MD5 1ec8576d5069830184aad405f15b1efd
SHA1 a4803ba899a859b9b6b02c53ba77343b7250387e
SHA512 c461966376e79f9dfd4489c320b3c614618551e2159371dc5866d0ca1271d337a6dca44c7b13a1056df402af967c0ffbf9351dd93aa1e4230c0a5dfa47ba380b
SSDEEP 384:DAEmdmuOlRX6KTU2s6MyTOvDtaL00BEtfCguuMHDlND7KGaqPS6l6DcXSbn12mAp:f7VErs
TLSH
T1A0729EF7C6F8CA6E881211F1AA153E2FCE1E0958D31C3D1A8AD6AF4BA3D2471D145D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 c8727004e1cb39e2404657634125373380be8762ce9a42f30bf08eded13d6a40
MD5 f0d7606dede870c7da685c3087576b2b
SHA1 450834461f766e4a54d39ec578028087e27569f8
SHA512 313009e3874f05e0bc5e3a80f3f1d27068cd03be90784a20004e98d1d473d702403031c50e79ef116bd9ccc5ae12c1530f5e0dd1bf0b27e61fe4a343243e87fa
SSDEEP 384:DAEmdmuOlRX6KTU2s6M9vDtaL00BEEAfCguuMHDlND7KGaqPS6l6DcXSbn12mABd:H7VErw
TLSH
T13F628EF7C6F8CA3E881211F1AA153E2FCE1E0958931C3D1A89D6AF4BA3D2471D145D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4607fbe299e712974da25b302c4bba320ae0050a7c2bb6adbd6365150219cd17
MD5 1598e4c6994a530237b9ff9e81621f98
SHA1 0c6211c7b7b7098eafd0cfb9079d59d764c49da2
SHA512 e48e5482a68ba46f4169e3ab1eab18f311d0bab73753aa68624eb057decaef20fd40bacf1b5902afbb88796045bb73b62c0d5e0cff83b267496d02ee15bca0b2
SSDEEP 192:/R4rCxQev78pkPRpzyeB9DHsb+WNnXBR6A2Wao/e+vVyIsnAUgE:/R4rCCa48Xj5wxP2VoLJE
TLSH
T1E342B72FB910693B5CDBD21AF9657B63D3F6106165E02E94EAFC8A2C10EB5CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b9670d9f86169f6c43c45c1ef307e4b0a5c78e8c8e992cb8bf754a9e6777e319
MD5 a80845f9085992c9f8bc0ca03eac59e6
SHA1 496462540eac887dcc31a24cb42b8422a88c624d
SHA512 febbd5d16308dc23bab0b1698e596b5fa252af2c4fc91d3cee827e171fba30c74abaeb116cdb97b32a9aa513dd495766533c282b0459f4290c71f9b14741184a
SSDEEP 192:/R4rCxQev78pAPRp2yeB9DHsb+WNnXBR6A2tao/e+fVyIsnAUge:/R4rCCa4UXS5wxP2ooL5e
TLSH
T12732A62EB910693B5CDBD22AFD657763D3F6106165E02E90EAFC8A2C10DB5CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 1KB
SHA256 95b8f03fce94e399b6f9e58c2176cbe41f30206840a3ddab675962b491668471
MD5 cdb0914e02b03d2b4c0d4c22e195c31d
SHA1 3ef0ae1c7f59988d5dba9d5e5348a1c07a10513e
SHA512 c83ec721d532066c7e3a4f57e46b8a4aaa62e8a0dc226c8da0878596afcac23d3d7655fa9aa6434d04ce2cd3ffb591dc1cc2d0e28c99692d9b2851a058522e56
TLSH
T1F831639A5BA80213FD0001B76DFB58C0BF709505970A8B1359E45139BD8733D64B8204
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41972c8e2079f50be939f53b9a30b131b5cb13e90eb41d665b88ed952d4236b3
MD5 c4c53e5e445dd1726a3e9bdc7e8482ad
SHA1 c5e7c525080fd05460e25a368d6415f58b848d39
SHA512 2366aa406129a26a0bd3b3d138274c57dd4650ad4d494a6ea32d9e23d592f55f93c5a3cbee63f98e552bd4964414ef3ac9489ec5ca1db0444245379233052788
SSDEEP 3072:SrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Sym7Rkm1tYpBeh2BAoO
TLSH
T169C3123B6D65A93758B9BB1AB04E0B1F1EF149A7C930DE52C8D45B0433FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3fcd5e19cbefd2507095717275adb359f67b0d69bece12ec8cc36674da6df726
MD5 f1eaddabc58922e1dc2c1c0bfddaa593
SHA1 14b15096c8f699986acd5c80f27a246561cb7051
SHA512 94b783fc1d5f1d31eb54795cd190d59a3ea93874dd0fedc4eaf292d86803f8b35e6beb8ef06d009b535d7ad2c387340c4aa3df0002d69bce14eb052d5f879dc3
SSDEEP 3072:ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Ym7Rkm1tYpBeh2BAoO
TLSH
T1DEC3123B6D75E93759B9A70EB44E0B1E1EF249A6C930DE42C8D46B0433FA7CC1905A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 52ef73325d833a8955039255a33fc11cfb52f78f4851a0683a3d83916017c0a5
MD5 4e30c585f4ba162ab0605cdcd209d2f4
SHA1 74633df98b9a982089feaf37b696dc912cc22a61
SHA512 8cdf2543ce65a4a0a5b89e09522acb2e9cf3bfce4efb8dbea3962d3ebabefb1e991d656803068aa8f9ce016f8994980399bc45733d34ac928e43085f6dbd7a9c
SSDEEP 3072:IqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Itm7Rkm1tYpBeh2BAoO
TLSH
T190C312376D75A8375DB9B71AB04E0B1F1EF24AA7C930DE45C8D46A0433FA6CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a2337aaceaa0b7cd9db0a03813b6025fbcdba940e1ac4ab6a55d18cb9fcfd61a
MD5 7482c6f5117a07cb0d99809049b5a40b
SHA1 44a43f60ef94c8cb0de39b206bcf550d5432033e
SHA512 cb4d50fd76f94cabd6274dc36a546fc3e0a28e1edc342ec149701d3f9d7c7029e800662e4d789c53ee72685f6c662956ad5749c3d2ede732a3e3ceb206c1972c
SSDEEP 3072:UqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Utm7Rkm1tYpBeh2BAoO
TLSH
T1DAC3123B6D75A8375DB9BB4AB04E0B1F1EF24AA7C930DE45C8D45A0433FA6CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d293464770201e963d233e3e9ae38ec64e93e98831e17ee05ad5bce63dbf9293
MD5 edc1802594cb9457a7a87d8073272f78
SHA1 cf9192213264fec8cbb2d6c7ae00317e0d3e71dd
SHA512 5e79307e7e5c11f21fd0ac3e56f214ce2dafb602eeb1679dbb83559f27d938240498cf2c23ac8a169150a9a7644848e7b96066e568c66fc1847a0e83e63cc0d6
SSDEEP 3072:rrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:rym7Rkm1tYpBeh2BAoO
TLSH
T168C3123B6D65A93758B9B71AB04E0B1F1EF149A7C930DE52C8D45B0433EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download