hxxp://links[.]notifications[.]fileforms[.]com/ls/click?upn=u001[.]FllkJtf8wKSGa6RAZAEOBF0urbCGEZ27aaH33FQ61IxMXTSVX3Xf0mkuEF3ukEtb2XT2_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qnK3lsJHeKc-2FSkwcQY-2Bq4E2dcrbgXKeYji0eoQKjwLucFHf-2FloNn4PtD-2BOT9TakO0NPwcJudqGKuXxj-2FBvJbC1l8fhLEx460EBO-2FDg4a5cshSG6X1ryOZbrPYdWgulr4JeE-2B5tyyh7brepGtIWhrY5gQgOidrMKLQxl3K18rAbgdlJeDbde9qQN8s1-2Fu-2BUtvClPHAHeWtPcO3e4ukJMtrQ49ZqOdgaFfWbS0uNSavhAs-3D

Analysis

max time kernel
299s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://links.notifications.fileforms.com/ls/click?upn=u001.FllkJtf8wKSGa6RAZAEOBF0urbCGEZ27aaH33FQ61IxMXTSVX3Xf0mkuEF3ukEtb2XT2_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qnK3lsJHeKc-2FSkwcQY-2Bq4E2dcrbgXKeYji0eoQKjwLucFHf-2FloNn4PtD-2BOT9TakO0NPwcJudqGKuXxj-2FBvJbC1l8fhLEx460EBO-2FDg4a5cshSG6X1ryOZbrPYdWgulr4JeE-2B5tyyh7brepGtIWhrY5gQgOidrMKLQxl3K18rAbgdlJeDbde9qQN8s1-2Fu-2BUtvClPHAHeWtPcO3e4ukJMtrQ49ZqOdgaFfWbS0uNSavhAs-3D
Sample260622-psep2sct4w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266053209444173"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
904	chrome.exe
904	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4204	2960	chrome.exe	86
PID 2960 wrote to memory of 1572	2960	chrome.exe	87
PID 2960 wrote to memory of 1572	2960	chrome.exe	87
PID 2960 wrote to memory of 4540	2960	chrome.exe	88
PID 2960 wrote to memory of 2044	2960	chrome.exe	89
PID 2960 wrote to memory of 2044	2960	chrome.exe	89
PID 2960 wrote to memory of 1312	2960	chrome.exe	90
PID 2960 wrote to memory of 1288	2960	chrome.exe	91
PID 2960 wrote to memory of 1312	2960	chrome.exe	90
PID 2960 wrote to memory of 1288	2960	chrome.exe	91
PID 2960 wrote to memory of 1468	2960	chrome.exe	94
PID 2960 wrote to memory of 1468	2960	chrome.exe	94
PID 2960 wrote to memory of 448	2960	chrome.exe	97
PID 2960 wrote to memory of 448	2960	chrome.exe	97
PID 2960 wrote to memory of 4632	2960	chrome.exe	99
PID 2960 wrote to memory of 3516	2960	chrome.exe	104
PID 2960 wrote to memory of 1372	2960	chrome.exe	105
PID 2960 wrote to memory of 5008	2960	chrome.exe	106
PID 2960 wrote to memory of 904	2960	chrome.exe	114
PID 2960 wrote to memory of 1536	2960	chrome.exe	115
PID 2960 wrote to memory of 1536	2960	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.notifications.fileforms.com/ls/click?upn=u001.FllkJtf8wKSGa6RAZAEOBF0urbCGEZ27aaH33FQ61IxMXTSVX3Xf0mkuEF3ukEtb2XT2_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qnK3lsJHeKc-2FSkwcQY-2Bq4E2dcrbgXKeYji0eoQKjwLucFHf-2FloNn4PtD-2BOT9TakO0NPwcJudqGKuXxj-2FBvJbC1l8fhLEx460EBO-2FDg4a5cshSG6X1ryOZbrPYdWgulr4JeE-2B5tyyh7brepGtIWhrY5gQgOidrMKLQxl3K18rAbgdlJeDbde9qQN8s1-2Fu-2BUtvClPHAHeWtPcO3e4ukJMtrQ49ZqOdgaFfWbS0uNSavhAs-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff4645c728,0x7fff4645c734,0x7fff4645c740
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,17969379992042682338,7638865488454710604,262144 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,18358166935918570710,5602677368352035792,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,7505140293246549880,14131415399977647620,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,8138270653865802785,9309428441549192405,2097152 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,215402145403322048,6828196859688610393,2097152 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,4269530507006355437,2957170380216972308,2097152 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,5978144264722822685,3991326229304438910,2097152 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,8656200753189341469,15633752854468685865,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,3040502771454026240,14533049800267292610,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,1519109726817134612,11542702610419633414,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14079157477804659968,17743735239909685878,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5940,i,15880894904073873612,13338085598980805065,262144 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,16304306370064206218,2372364262277386147,524288 --field-trial-handle=2000,i,11107815808668695004,12486453159395811166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a2432ecc52e917e48a17536d857188c16e51493de7734eef70ed9024da777596
MD5 95468d5a8969c3cf57bc1cf0118854d3
SHA1 9f3f3dc030b0aed12b943e8a54ce6099fb9a95e5
SHA512 486c1a3c9eeed37dc50229b9c0b6871fd4c24070041d6a7045c048e5d49a70ce0603976384fc24492d31e685238ad51b45b26bd0560b8c43c8d9bed43029a839
TLSH
T11BE02BAAC921EC371CFD575D50940E4AEB21136727A1855B3B3C8208CFB16A74285C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 0c9355ab7eeecdeb58f03737c62e0f3ad949a99f8cede4763cdb3e3a986d7f72
MD5 7760e3b72c7c67b83d4415f13d2980ff
SHA1 20dafb4283d0f08bb3e7bc888dc7729a2d39add8
SHA512 c4f11ed69c49b09eea464355a3c7b52290e55dff8cfd7bb0879c5c3d27e8061e057f58e9061c9718c023835d4b9e41a17d856a04614c4b2fff4c03cfd50cf896
TLSH
T16DE08C9751DE8251C7D16E3D88F741C2773632C89887BE8286C4A0F8E816B394ADE994
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 42ea7dfcec948c26d80cf94ad7f050116ad16d6578e3378c0a7ecd8ab59ccc7d
MD5 91552bd7c99994bf7870f075ce35645f
SHA1 9f2822e86a96e158e5643f92dd1744dc391d3f96
SHA512 bcbdcfaea7d48a98b91418f1aacc61b2f7bcfd19472c3a9371d3ba18031348dff4d83778f7a113ab64bf90b709d5ac3e03091a7485a3ebd03e1e0f0e295ddc69
TLSH
T158717DF783E48A7E890196F4BB156F1FCE2D0524532C3DA6C8D4AE5B93E2871E24174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 052ecae7ca8de494cbf76f93c6f3de6793596a95cc2545d1be8335b2f4752f29
MD5 adaeb9fceee987bd038c3337d55ae9cc
SHA1 14dc50de679078c7c9ab79682df890b7a3c0c018
SHA512 e26ea2eaf2cef56683be1b625b9c0e0efb3e01ee6a7c89cf9b898fea43e2d11848794f6b13c7e03697bb301313152f68a2181c111d94a6152fa05dbbf687db3e
TLSH
T11B6190F783E48A7D890156F4EB186F1FCE2D0524531C3DA6C8D4AE4B93E2872E24174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f54710198668ca1d71aaf4d18621830972323ccdb4d65fd56452467e59dab3b4
MD5 34d9a960e5f7804c3a1d96bafa385bf6
SHA1 5a736f5f761e61854c3f17b21b2e74aa1a490cbd
SHA512 4962f7acafebafbab791a39d2d4995e311d7eebd195f197c5d6faabf6c886419a2dc1abb9af94b3e615dc4f87d9dcf1bd56120be6a4a08af94db743b7e60afbc
SSDEEP 192:IRuiYLQQ8fUrv7ApAPRp2p4w9qHVjb+WNnj8Mbn2c6ZxkwZaeSVyIsnAUge:IRuiEQyTkUXUkzoo2B5ape
TLSH
T1A342C82EED10693B9CCBC229FA567763D7F5203521D42E84E6FC8A1C25E79CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63d33f4f9e2db1a311b06269b17cd486f8d5292fb999493673692dcc5813947a
MD5 6a39e6a915bf5065d65e2e224263eba8
SHA1 9c28ad90c50fd07c3f451c1207842d1fa795c6ef
SHA512 6037ca6653177b6db0be0a6d55b69164cce424c58e4f4136e8b39fea0c4b2e59eeee33dd4573105f20b2ee2162b3bcb52d8409f1de19f635e33b1bb9dd4d4cad
SSDEEP 192:IRuiiLQQ8fUrv7ApMPRpep4w9qHVjb+WNnj8Mbn2/W6ZxkwZaekVyIsnAUgE:IRuiqQyTkQXckzoo2/f5ahE
TLSH
T17852C92FED10697BACCAD225FA567B63D7F5203521D02E84E6FC8A1C25E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 100870d12259c87e425ab49525ac97e02cc739be7880f328bcc9d88c9a778c88
MD5 1158c6e7a68871f5eebc834c6eba323d
SHA1 4c7f016da35d8aed3d42d0f5fd1c526270d1ae51
SHA512 6330204825786ae2720c0a8c7e67ba86f175e36498d6b567b52016b9b0953d6381d15763225fa4ad92bd39209a1f73938ad51cc3e76ef4bd39221edafce49bed
TLSH
T15CB0124080015103C40207F8125214D87114DF14A60A1B0243E5AD6BD8261528414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b205.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b205.TMP
Size 96B
SHA256 e654d077e972cbdbb46bc2163b1b3cbb773ca6401762fd8465165d96c5cf2a55
MD5 71f92191e943bbcd2012191607b019dc
SHA1 a6f954680b2c629b48ffa626cfd131955abdc3b4
SHA512 85f05a48eb10d0269c1d6002eacff246cc73291982a96ef4c72f64633addc4ed345767f17df507789570917504d678e0acb7a72ce10d63d8ddf54617c10a2ddf
TLSH
T1F0B02200E2C22202C03203F028A080C8B020CFA0C203230282E00AF2EC302300828220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e9e7d9371e53866bb147efcc6ed3f390f33e3e4a571a6aeefbc4ce92a174f6b2
MD5 6f7d9abffcd535620ea756e36619bfd1
SHA1 d0c8f52fd241a729db33a754542dc4f07da3681e
SHA512 459ac4f6321bab702e0042b6c43a09e214866dc257e6d655a9d887bf7c0cfa0147ae82dbc82cb99c2cb96d52d6f84d0762ab59764334c8093f2a083ef1ea8623
SSDEEP 3072:BdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Km7Rkm1tYpBeh2BAog
TLSH
T108C3023B5D75A83B99B9B71FB08E0A1F1EF249A6D920DE52C8D85A0433F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d6f712888e4b56983b2d688e2b11b520ffd37b146d7bb7e73e39c32a3a37fbcc
MD5 17449e95f7cd32a288ada6fdf9df6e2c
SHA1 6c82c6fd2461ab5594a70320863fd14c2dfec0ba
SHA512 e299709c90858a8cf799b9e1f49d7b8a3bd3ae06ae588dfed0d43ca0afcace7ab2f8c1618bf0f928b9b5ad6244c967c63dd605e7c7ef73b24baec7a70fbe5ad2
SSDEEP 3072:WbGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:hm7Rkm1tYpBeh2BAog
TLSH
T113C3023B5D64A8375DB5A71EB08E0A1F1EF249A7C924DE92C8D45B0423F9BCD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b51f59a515505c04a1fda56f4a9b25eb8bb1f0bc9f69101a8913e6a0fcf50824
MD5 3b65b1232d602d19dd63a9bd9174a2ac
SHA1 e406ae416bdfb76420ef89d674b51fe3ebef6d43
SHA512 75ddb59c042cce26946f0846ed38efd608fc5a355696a1b88d7683d0933cb41a32d58d07fb1cdc9486828397a2764062fe197cdd3aa4aa5555548c1062942fdf
SSDEEP 3072:AhGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Hm7Rkm1tYpBeh2BAog
TLSH
T19AC3023B5D75E93B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 def6a2d96fcae9ae61458e9dec97e82f7468f96001f0e60dcda32b3088286c10
MD5 28c90a6f775a19ecc6f37f19ae070eb6
SHA1 bacddde7335b90732a5f1e18f48c07f8e8683c29
SHA512 c6a6bc344b478da5e82838410f83bf633709e2e99cf7d2e48ee8eccd6b7c3f88974153ec4a04dbcd0119a7e90eff19cd7763fa459a09fb52b54a91457c033e84
SSDEEP 3072:9bGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Um7Rkm1tYpBeh2BAog
TLSH
T18DC3023B5D64A8375DB5B71EB08E0A1F1EF249A7C924DE92C8D45B0423F9BCD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2d94502861a2e3abc8f94ce5c17f324d7c1a7dd7c9f3761f3a3fb4372b56ef95
MD5 d9ee9931450403b7beba20feaa16c60c
SHA1 fc99ab7ac61a844f6d3b3439ab259f12b6810507
SHA512 1e52aa30718c09e7bffeca2a5ec2b491a4bc67cf80666059f5dcca1d71efc6c1a5c08d24fe856d1345b97553d3029f8fc0364b41abf6dddf4700f40866d951b5
SSDEEP 3072:9dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:2m7Rkm1tYpBeh2BAog
TLSH
T115C3023B5D75A83B58B9BB1FB08E0A1F1EF249A6D920DE52C8D85A0433F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download