hxxps://www[.]google[.]com/search?q=virtual+machine&sca_esv=c238079dbba20b5b&rlz=1CAOUAQ_enUS1211&ei=hUcLav7eN6W3ruEPzaK54Q4&biw=1

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
900s
max time network
899s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/05/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/search?q=virtual+machine&sca_esv=c238079dbba20b5b&rlz=1CAOUAQ_enUS1211&ei=hUcLav7eN6W3ruEPzaK54Q4&biw=1
Sample260518-vzabssaw21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3628	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236206797775310"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{649E6BD2-51FD-4A8B-8F2B-FB44F45E3B7F}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
3524	chrome.exe
3524	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2780	4836	chrome.exe	81
PID 4836 wrote to memory of 1572	4836	chrome.exe	82
PID 4836 wrote to memory of 1572	4836	chrome.exe	82
PID 4836 wrote to memory of 3628	4836	chrome.exe	83
PID 4836 wrote to memory of 3560	4836	chrome.exe	84
PID 4836 wrote to memory of 3560	4836	chrome.exe	84
PID 4836 wrote to memory of 748	4836	chrome.exe	86
PID 4836 wrote to memory of 4736	4836	chrome.exe	87
PID 4836 wrote to memory of 748	4836	chrome.exe	86
PID 4836 wrote to memory of 4736	4836	chrome.exe	87
PID 4836 wrote to memory of 3476	4836	chrome.exe	88
PID 4836 wrote to memory of 3476	4836	chrome.exe	88
PID 4836 wrote to memory of 1136	4836	chrome.exe	89
PID 4836 wrote to memory of 1136	4836	chrome.exe	89
PID 4836 wrote to memory of 3144	4836	chrome.exe	90
PID 4836 wrote to memory of 3144	4836	chrome.exe	90
PID 4836 wrote to memory of 4112	4836	chrome.exe	91
PID 4836 wrote to memory of 2996	4836	chrome.exe	93
PID 4836 wrote to memory of 4544	4836	chrome.exe	92
PID 4836 wrote to memory of 2996	4836	chrome.exe	93
PID 4836 wrote to memory of 2172	4836	chrome.exe	97
PID 4836 wrote to memory of 960	4836	chrome.exe	98
PID 4836 wrote to memory of 2876	4836	chrome.exe	99
PID 4836 wrote to memory of 3524	4836	chrome.exe	100
PID 4836 wrote to memory of 4904	4836	chrome.exe	101
PID 4836 wrote to memory of 4904	4836	chrome.exe	101

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/search?q=virtual+machine&sca_esv=c238079dbba20b5b&rlz=1CAOUAQ_enUS1211&ei=hUcLav7eN6W3ruEPzaK54Q4&biw=1
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb1e65c728,0x7ffb1e65c734,0x7ffb1e65c740
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,7380814375629546872,18403055037959532219,262144 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,17317971313664923693,8414206456968908008,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3119786240605265730,8779748956711532672,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,37151116320338140,11567793535217160072,2097152 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,15496791178787817669,7540848135859995729,2097152 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,3679251802099743723,7089791890865762067,2097152 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4352,i,5559443974011853654,11337349217036338404,2097152 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4876,i,9485355040674487418,6518140448113621673,2097152 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,6963369521738489116,17193018849162672761,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,16035246131011139798,16100318219317690403,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,412003113608213941,16649812075894203594,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,15846790173318192656,15406817302549556765,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,932666771461250725,6489037739490855829,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3916,i,6606709751784352836,13322434505629060466,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5784,i,446249409045575690,11962955802697617262,262144 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,11991997107987270796,341165404844721921,524288 --field-trial-handle=1976,i,11089025500606336851,8063801818996079172,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:4904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e9d2217fd12a63f6d2f01a0f0d7c4f57479e6da1236752135421071a5136b858
MD5 d83c7e9c768ee9f22c2aced8af557520
SHA1 7703f6bc3e763f280166fa0668ba9ca80df6dae8
SHA512 6df0b1f05cb8a1373a85724a3e217d05256cb3123026a815191656039cbb0d80d09f7aa5ce2ab389bb6774127b2665fd04157c63bbea307be459aec6ba66a7e5
TLSH
T15DE02BAAC812DC270CFD0F2968566642E754175F2B81990F7B3C920D4F71A7E854681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5e3ff402fe7582ed3a872258d9f8ea93337da5151628ef81cccf29cc0bb251e0
MD5 034acc9ae6538567a6a8b8aedd76f0d8
SHA1 bef05b302c75228bdd00fb4b7ccfa3825c21c7ce
SHA512 5dbe71390fde69aeb41f9379141f990f491c8bb2cee90287381b14acd0526929cc7c2fc53c66aa31a16ee929eb0138a3ee2c6e4915e57a0c9693e5e2309c01a5
SSDEEP 192:DZutqkd7eBxE659SuyMXlk8ILDiLIoIHIextdmDrRHC0K1RtGjh6E:DZutqkd7eBxE659SuyMXlk8ILDiLIoIQ
TLSH
T12A029DF7C3E8C62D891155F8AB166F1FCE190A18432C3C6AC9D8AE1BD3E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3be37b393869357d0ff190838699979f11c758cfd8b7ab70f2087b4724bb2c3c
MD5 27cf1408eed23119550f8bf4f5f4239c
SHA1 bb750a46de8c61f26e41141c9266c961100051a7
SHA512 f8a30eb661339a8cdfbc3212291452f3fcef35e38470845ec1360544a7103cdf5f702cec1f722b2d43b39eeaf1ec9a066b17fe7dc58a12767d4252747edf5a44
SSDEEP 192:DxKN4xf96eESk59SuyMXl48ILdiLIoIHIex4DtmDrJHCKic1ahnK:DxKN4xf96eESk59SuyMXl48ILdiLIoIZ
TLSH
T156128DF7C3E8C62D881115F8A7256F1FCE190A1853293C6BC9D9AF4B93F1871D211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5dbf481f5483e7112f220067f65c242fc1f555ead21d4f552a998e8ed80eec76
MD5 59bee16ed6a7211b234ea7c3aacb20a0
SHA1 067b96a58ac330ca74ec8e747aaf7ab5bae6caf6
SHA512 a7084b022c9dce778d882216ced103cae01a1d143626b2d9f629d27fbefd5e6e839f56942d41cab98bf6ed41aa3db7daefb4ea3e09fbcddf2a9391fc58b0ab2e
SSDEEP 192:DxKN4xf96eED59SuyMXl48ILdiLIoIHIex4DtmDrJr1PCpqJK:DxKN4xf96eED59SuyMXl48ILdiLIoIHA
TLSH
T14B128EB7C3E8C62D881115F8A7256F2FCE190A18531D3C6BC9D9AF4B93F1871D211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 597082375d73403756be87945004f253220e96ff9ea59285e119f58406e69426
MD5 d5d09f7711f595381fb0723474f01ba5
SHA1 97ec3d9e1056931fdcb905d55779f676411f030f
SHA512 33debb38ea6cf861bd4b4e1f7266e13cc78f41f77afa8baece74f596920d06619b3e5e06f31e3a33fa6c7d593616893281a46cab95cefcd4fbb93d3d7252a25f
SSDEEP 192:DZutqkd7eBxp659SuyMXlk8ILDiLIoIHIextdmDrRHC0K1aaHK:DZutqkd7eBxp659SuyMXlk8ILDiLIoIe
TLSH
T1A3028CF7C3E8C62D891155F8AB156F1FCE190A18432C3C6AC9D8AE1BD3E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 676af0157ccd977846034eaafe9b81c021966ad866f87fa70dbc9c78edd7d5b8
MD5 3b7095865978088149c999710677f959
SHA1 a596e0b3de1d87e109e584d28e4ed6c19cf5f22e
SHA512 bc30893c1db4c43fb6c8a96b80dab335f76e62a2b0c5e9ed6c3f5c48e30eeace9dcba5cc078ff36e800f10950332cb62b354f9ae46f516136bd1b63cbeb8af97
SSDEEP 192:DZutqkd7exEnN59SuyMXlk8ILDiLIoIHIextdmDrRHC0K1RijhMkE:DZutqkd7exEnN59SuyMXlk8ILDiLIoI5
TLSH
T164028DF7C3E8C62D891155F8AB156F1FCE190A18432C3C6AC9D8AE1BD3E1871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 d81184106e3281a1a61d9ce0804afeb497d6bf7388be7fb3ebbb4d3d7e6330a8
MD5 20e95eba9c2aca30caa2931dfa780661
SHA1 da653405d575f28bc253afcf1b6fd096c93b85e8
SHA512 a297bea3df8760b8108b86968540b4828fdc23a20f1eb5f50a83a745cf7d680b70812c305a130b6a955dea8822f2063e001b27a1598eb094f65bd9585e9038c7
TLSH
T1B40199A7937FB0271479087B1E08781D58B6B43811C128E8EBB6C13DF0A25F31B03046
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b4d3964b6f961fdd7eab2ef157bb5fdee626134bbd5679929cdfc19f5af5f58
MD5 9ae336af80dc35d346934c3a7366b93a
SHA1 13bf72dd309b5b6687daf3332c3adb5790c96dfc
SHA512 853e834c70f88e10142076edcae2e63701ab9c61cbab6954b3d9c856e6b273d1ca247972c61e7ae878daec6159e53a1c366176d79c849ec67a25852c0ffa010e
SSDEEP 192:ER+cBz4lej3SKS0v7VXpAPRp2c2q99Hsb+WNnMnZM1gP2D7CebVyIsnAUge:ER+mz4a8w1UXvjwIT2Ve
TLSH
T12642C52EAD107A3B5CDBC21AFA617B57D3F5102225D46E88EAFC8A2C25DB5CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b1d280b59de08618a39a20cd4b1bd2f0fc169b81c4669d49edf19409cf1858f
MD5 b729e5fe23afa45c0e99a04238cf59d9
SHA1 833f9ccf81c100d3fe127c730c342a64a671ded5
SHA512 d362fec941723ca7dcbf89d6c1ac1155cf997965c4d7668970fb011726e1e9840e420f8c3aa1a452845898a3207b73aaca976ead040e402b3eaa9b611c4152bb
SSDEEP 192:ER+cBz4Wej3SKS0v7VXpOzPRpj2c2q99Hsb+WNnMnZM1gP2DDCe3VyIsnAUgE:ER+mz4l8w1UrXjvjwIT2ZE
TLSH
T18242C72EA9106A3B5CDBC219FA617B53D3F5102225D06E88EAFC8A2C25EB5DC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 949d1f2f54f6f24b260f444a765da6ae7552d5eeaee31c8e1906f4ef36adce91
MD5 f687f12ef2323696ed4853f72d1330cd
SHA1 76b7f04a32dce8b6dfa03a966139b33df199acc6
SHA512 04ea095b4279072610434d3f504768e9bda1253d9d8dfe3264a0bc91c9269b5b869d7a52a7bbb903136786a2e9dbc91befbc8e9f93fe7684db066d88db8ae87a
TLSH
T1D4B0124080426501C40303F421421898B128EF14DA0E170143E0A9628C3525185140A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585dcb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585dcb.TMP
Size 96B
SHA256 dd01718c55a6622b16b6d9324043d661aeefa62774cc8e345ffc44932ae36de3
MD5 706b4fde9eeb9b97eaca6b42b4903e7e
SHA1 93580cb539cab0394a5d055d20b53dbfcc8c9c26
SHA512 321e5d7e5b5867681b70ab9d576cd2849a375c7d64d137530dbf27c15b4765306ed425f1b0dcf750c630f4bca36a325ecda41d5b4164a607c75d6ffce69b2dc0
TLSH
T1D8B00295D103B252C0430BF269A5A6D8F560EF25C707133693E03A66ED25E7C4665560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 de94205ff4503fc82b7775ac2837e336e86658a019922c8e59017ecf6d983228
MD5 75a71502545abe9887abb1bc9c87b42b
SHA1 7f3a997ea46303965ff3b38d71c2e54f4d5d0713
SHA512 e9a2ffa5d66820e62a13e26a5fff37e8a509832c623884159e46e7a7ce878b188ad425760d0ecc50ecffbdd7cdfdfbbf206ffa1204a0860904281637902326fe
TLSH
T174A0025016C60C02D81407B62A9712E12355E8124301925B95F821898992152626121B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 4a3b362780801b6fc1889e5a9b2cdbaa0dc9993c3cde4aab45a2b49fd679ccc5
MD5 3b81ce395521921b8a1d2ae24f7918ef
SHA1 55e88341310e80c0d8d1087c2e4726ca9ee3de7b
SHA512 16d65661ad0e28f3045041a1038da55b6d0c5426c15157c996f77a09f3bc0ca73bde37f74d5db454a5494bd7b11dc0dd0e0d0e38d9dc79eab513a5a13c97ce18
TLSH
T1B4C02BE329144B9B4F30E9D81028721DD00B818D8CC8CFECF8080113107CD33440163B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5871c0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5871c0.TMP
Size 157B
SHA256 2c9843eca34b155b07b770372e5d3d0d2c4db46fde4248bd68f91cb421a3ccc3
MD5 e7f1e69e80e8c55b1005d55bb421583d
SHA1 a8405bcc64644697d35d7d32f72c8ee65e0c361f
SHA512 03ebd9cb6ea36417846818474eb44b81aece9d37055581e314e46a8088c4b370bc0984dd7b609654b1045cc121a0d888fcd18188f9f3dc902e6cf2af2949eefe
TLSH
T1C2C08CE329240A974B30A8D51028720DD4178C9E8CC4CFE8A80431122078923840062A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3b54567842659555bab2f39bd78d545a8f55541cc748949079c767cb5401ba7c
MD5 44dad9f0f9bfed176252f97a033830a4
SHA1 022d1bb25a7b316c8bf16682de9900079593dfcc
SHA512 99feea2645fad5719ea04d362a61c9a6c4f6f30048bec085c6ae580870d2fe852536508cbc77fb7ad3ec4c5bd2f2891f29c776570c15db12ebcb82d409d1773d
SSDEEP 3072:vxSEw3LffUnBKU/F8enCW3iyVEXGey0cB12:vx+3LfqBZqenbyyVEd1cB12
TLSH
T1E8C31231E4AAFE3762B5573AB50B971A5CD148BB54E1F788443C2F19E0CA388EF98C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c284e700c57a13c5263269d56e3142f25e1945a036d6156838be7f365a6ace20
MD5 ee178f9779719d633cc228680dacebe6
SHA1 72e6c0e74c1eb162b9496fc055129b291bfe70b7
SHA512 35abff54528ab2ac21870d857d9db0739babd0de491d6531fd41ee786768263b02831d102c561ddbd385bb8a39c654723b84f7ba83e2ea1b9e3b40fc06432462
SSDEEP 3072:+xnbw3LffUnBKU/F8enCW3iyVEXGey0cB12:+xn03LfqBZqenbyyVEd1cB12
TLSH
T175C31231E4AAFF2B92B5562A750B971A1CD108BB54E1B78C843C2F18E0CA3CCEF94C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d92893e36e6093a319ae07f9fcc252d96d7a5735634349fbd32b0d2741d0d239
MD5 1981a6ad4538175992d931eb589b4f0e
SHA1 dea9c86b6acb76ba6779210a694ad2ab96509d9a
SHA512 1768111f1bf03006e8f2c3117eb28eca555b1a4a09723e1df77c6a9ab5ecc481852e87c27e35a11cbcb0792611ebf5cd7e4486517fb949c6a89d3056d2aaa849
SSDEEP 3072:vxtw3LffUnBKU/F8enCW3iyVEXGey0cB12:vxq3LfqBZqenbyyVEd1cB12
TLSH
T140B31321E5A6FF7BA275472AB50F93295CD148FB44E1E788443C2F19E0CA388EF98D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9ac679e3ea8d57481332bf1c88a6405181b13edae1d916f917969da8401b2ca2
MD5 1d8504a02bee4a917a759c7cec2827c3
SHA1 23dc45baf761843f0055512919c9962dca622bc3
SHA512 e7bd419134e80a8ce860936f893f70ec35855aee1129cd9212a1b93b2d57b4777524a30e64c552f2fe4ba8d40be553e98ad9e7c49b0e48c02dfc526d7dd9a5d9
SSDEEP 3072:+xSEw3LffUnBKU/F8enCW3iyVEXGey0cB12:+x+3LfqBZqenbyyVEd1cB12
TLSH
T12FC31231E4A6FE3762B55736750B971A5CD148BB54E1F788443C2F19E0CA388EF98C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 027f3674b4c02f09a5834361c8e37d5969c5952e6e12a802c307165f81030117
MD5 9d7d66ff75def1dfa3b7decf67276599
SHA1 7b0e1cb0b4f2c32e5bd1f340bcfaa5fd4c0a74d5
SHA512 062570ebd6baed7afba1ef54f2cd5e458ff5e5ea3f24c4a68b09977d5ea1115c22e45aa0ce2d3f82eb075c494355c2453e2cdd8e7123ed1594217d05b3e246c6
SSDEEP 3072:Kxnbw3LffUnBKU/F8enCW3iyVEXGey0cB12:Kxn03LfqBZqenbyyVEd1cB12
TLSH
T191C31231E4AAFF6B92B5562A750B97195CD148BB54E1B78C843C2F1CA0CA3CCEF94C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download