hxxps://getexec[.]app/r/pK6wV

Analysis

user interaction
yes
max time kernel
300s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getexec.app/r/pK6wV
Sample260628-m1jb4agy2q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1528	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271177591459797"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3156	chrome.exe
3156	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 2280	3608	chrome.exe	80
PID 3608 wrote to memory of 5884	3608	chrome.exe	81
PID 3608 wrote to memory of 5884	3608	chrome.exe	81
PID 3608 wrote to memory of 1528	3608	chrome.exe	82
PID 3608 wrote to memory of 2620	3608	chrome.exe	84
PID 3608 wrote to memory of 2620	3608	chrome.exe	84
PID 3608 wrote to memory of 5528	3608	chrome.exe	85
PID 3608 wrote to memory of 5528	3608	chrome.exe	85
PID 3608 wrote to memory of 5160	3608	chrome.exe	86
PID 3608 wrote to memory of 5160	3608	chrome.exe	86
PID 3608 wrote to memory of 4496	3608	chrome.exe	87
PID 3608 wrote to memory of 4496	3608	chrome.exe	87
PID 3608 wrote to memory of 5400	3608	chrome.exe	89
PID 3608 wrote to memory of 5400	3608	chrome.exe	89
PID 3608 wrote to memory of 3808	3608	chrome.exe	90
PID 3608 wrote to memory of 3808	3608	chrome.exe	90
PID 3608 wrote to memory of 6024	3608	chrome.exe	91
PID 3608 wrote to memory of 6024	3608	chrome.exe	91
PID 3608 wrote to memory of 772	3608	chrome.exe	92
PID 3608 wrote to memory of 5536	3608	chrome.exe	94
PID 3608 wrote to memory of 3356	3608	chrome.exe	95
PID 3608 wrote to memory of 3432	3608	chrome.exe	96
PID 3608 wrote to memory of 3156	3608	chrome.exe	97
PID 3608 wrote to memory of 5460	3608	chrome.exe	98
PID 3608 wrote to memory of 5460	3608	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getexec.app/r/pK6wV
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbfe1c728,0x7ffcbfe1c734,0x7ffcbfe1c740
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,9686808484266664893,7997388696827506636,262144 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,15195778201423282082,10797947201641305383,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,16173665136308486393,17090471587470021446,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11727760915245065915,16345128174269971285,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,2909333807372525695,10865699093798138462,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,17949584728841753593,10627252839363299690,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,10835037498046760938,10124875639487648473,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4908,i,5764195722310431076,4463169966902013609,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4868,i,8508055261633224047,12311195507034884852,2097152 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,16307150371968251978,9393559671323143791,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,10589857796928633515,14153162537227632976,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,11477883843579214969,11033391283615586371,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,10749061426925659574,11982555930719014658,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6108,i,3269420169274816317,16699321312328408044,262144 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,6123251241011552616,9768857614688344467,524288 --field-trial-handle=2028,i,5040531318700097196,15795653534251790897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4076 /prefetch:14
  2⤵
  PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 07c0923fcccb3a4aa49520e0cf03896eff8442532dff259fb4362a11ebbf34b5
MD5 436938e83e417c6c67a56c8b89024c01
SHA1 1ef93ba892a1a65492fc0fd7bbfa013958189466
SHA512 36bb29e7a73c6bb9fb563f6903fb075210b249214ffe04abb8547b043ad891d28f8d94b0be8bba5c17b189c4db9f060d9bb81819087acdbe6a4d724ba739c5a9
TLSH
T19BE02BA6C861DC270CFD5B2D61950345D66003172B805D5F3B3D811D8FB173F454695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 1.4MB
SHA256 9702164ad3eb9ad7765ee676e38063c5e698f3b9a67f0275a4fcc28bdff2d896
MD5 40ccb28b0190b06cbbafc0c8663b2380
SHA1 825431639c213e6d8e9f357f7f7cb0edbd1e5e6f
SHA512 cbcd9f984c36785bc153dd012306e7e9eabd8c84ed7fb46f21e2cd9fee134b9e3c94eca0df99e5e8f86c492208c87d9d80679d38140afaa02a9dfaa2cb156861
SSDEEP 24576:UvPd3WDo5LRt1JIdlh1y7qop9iVZvgNGcj/nDiIGgW6yOzCYXOks7ccrpwsT:YWALRt1cj1y7qvZvqjj/nrt7zC+ODw2b
TLSH
T1976533E3AF784A93C2604FBCC22F44274E987A2155C51EFB68BD56467CB93488D6B30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0ae47e508355cfaee99bada9e9d61e9f24fd2510d74d3987699d139ed8566680
MD5 a18b9bbc04679d706ebdde0f00e16fc3
SHA1 ae4b7c589d136286a597c1b663e091bc3f3353f0
SHA512 f5c6f769f972483d11d955437a765b153519f28d9c96babcba47067af624f6482574c5f9f407fe5eb816f043ce9d3f3e95f5f64bd1e30988780b5bb20c741279
TLSH
T12FB0120842440856CB40033004940825223C5DE0162751128484108850146F14202464
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9d8e456c5bd72b36d70087c60cdf92a3b820d3dd1fc813a3771fe0d23999c711
MD5 92cd9a2f3287c06dcc47451375237edc
SHA1 2a87f175be0ca83fbb94e5febf368e6dd71c6e1b
SHA512 b9a6ae6e62302c37066b06a5c46578cafcecda8ac282f323e70ec70007d32944707d40f140c23f5d8153b4c7562bef9055657f2a149f5e3b9ae60150d1c9295d
SSDEEP 96:DuBuenb1FFcuaIaEdYKuq+uFYp1Nj82qK:DkBnbvFcuaIaEdYK1+soHjbqK
TLSH
T1CDA1C0F7C2E89A6E941192F0AB152E2FCE1D0A29432C3D66C9D5AF4B93E2870D11125F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d364333b84edc3d87bc6255d08ccde3ff3dc71f5453029d1c2dd1717f53d916e
MD5 465ef097dd0311c065176551a1d1adaa
SHA1 b526fe01c046bd9bec125adff8fa82d488500008
SHA512 f8f9d1672620b0ecd4fe6919efa550accffdc7f60903fd7a433f4e0fa1f29b9b22d004b11bbc3bfab9dd39a1ce703e61814d4a7d3e900f0168ee0b23c5fa6314
SSDEEP 384:sRECifAEKhTl0Rn2m+jMrXN40r5wRKTpbnv2Vhi2H2vaojE:5CifAEKhTl0Rn2mEMp40r5wRKlL+VhhR
TLSH
T10552E72EB9106A3B9CDBC329F9657757E7F4502222D01E84EAFC8A2C1AD75DD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 594f61a502bcffe61a092a2160ccf2cc34e8ecbfba919f2bfd9d94326abe2505
MD5 fb2e5962d9bf7b35810cd59e56f36d56
SHA1 68ce0bac00a4be1e2d8fe609da20a99bec113ae8
SHA512 8e0c53732a2d1359dc24bcd3b977e4bc26e74101fc42f55e42b6f402ca818ba1eafd8632987fab013faf09e5f94185ba975f86038897d172fbeafdc7a09c9241
SSDEEP 384:sRECifAEcTl0Rn2t+jUX40V5wRKTpb2Vwi2H2valje:5CifAEcTl0Rn2tEf0V5wRKliVwh2ylq
TLSH
T19442D62EA910693B9CDBC329FA657757E7F9103121D41E84EAFC8A2C0AD75DD321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 424491856b7041a29e5d43e8d48e9844fce11328e58ceb24374027dc0c819b4f
MD5 54e7cdc298a343e9f6a916f5b2b144da
SHA1 e9b8634b2150c6081bdc09a92fa82c731fb0127f
SHA512 92f5126b0b25b0b7d0587178f373f883b1739558322095c60a6915b8386b99033c60da2a2037a55388d083df116563b11d77f253a45d6f848b9777671d2bac8d
SSDEEP 384:sRECifAEcTl0Rn2k+jUX40r5wRKTpbnb2V2i2H2vasjE:5CifAEcTl0Rn2kEf0r5wRKlLyV2h2ysA
TLSH
T18952E72EB9106A3BACDBC329FA557757E7F5102121C41E84EAFC8A2C1AD75DD321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b54144b093746305ab13bf6bfef70bf9b29d6ed0b01a7c49df37d3ecd4eed7b
MD5 130b2a4ecdedf294a4418de4737d7899
SHA1 f9e61568b67792c609d80462ec26eb197e207515
SHA512 edc80705645950b20e1143c17c5ce3610445b60c108a6f79c39abfcff131a5194ec778f382b6877816592cc23e12748f9102d755b9f11a75ac6bf28a50c7694e
TLSH
T1E8B0121080419101C04207B02146188C711C9F60D70A1B0143E4A923DC2A162821D460
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588122.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588122.TMP
Size 96B
SHA256 c8a8f772157495a6e7106394c76c5a0ce97df3dfcc8ae3c9b219634a92789a65
MD5 aa1119d15264cb940c82f8c5995f34d3
SHA1 a1af3df8088c222888d3a38137d00e072b090145
SHA512 610a72d75c1c7598422b322839771c8cc5aa7cc750eff3a76a8ea523a8251f466832ed47a6934e30cc8dc2a3797a0bc767fb6408ca45bdaed51d9492703dc7aa
TLSH
T166B00255D2066AE3D05303B026D999D8B1ECDFE5C6071216B2E41A66DC257714669170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1f8b0ddac2ceef0f16f5ada76dc0fd4ca0f0d49baade88f5d3ee621ca0792feb
MD5 43b27d3655c8a4cc4d62e70210b512d0
SHA1 a1ba9d06d3c52b04cc5d7186d1d6640c2a6235cb
SHA512 6fa2376a554fafaadf0c69aaa8817327b65bd193720f1910eb4cc2c6f32dc95ce9c017dc2d2ed1bb18c8da0569b43465e3d2442418a5f0177443548755c3b5e6
SSDEEP 3072:O2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:OBm7Rkm1tYpBeh2BAo+
TLSH
T10FC3123B5D75E93A5CB5BB4EB04E0B1F1EF149A7D920DE92C8D86F0423E66CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7d6026fd270421f75be4a01b6c1ad0bb2d0df0d7b72a69ae818d334dcb4ec014
MD5 95cd93667d61833447ca369a971b7db7
SHA1 c7e5e6058c94b57602c0547cd1fa58eed4696b77
SHA512 b94d1017869bf0cf72f8714b75163a30ffd39a8e82b70ede92d0af3cc2155ad32134c9113d3f1306a5b9945ba1085730e4c5396ac58269bf4cfe7b54ddb836cf
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:em7Rkm1tYpBeh2BAo+
TLSH
T1D2C3122B5D75E93658B5BB0EB04E0B1F1EF149A7C920DE92C8D85F0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0df88c1e3cdb43aa494c2f78674d496a6aa0088cc8c0be598e8f243fc5a6d692
MD5 8a3d3b3d15e62b203cb688f0dafef476
SHA1 cd6707b93a93312ec0d81e5dcc48191b94f1a539
SHA512 581e395e9fe909b776a81315803a2cbc131da21750d730c0a4c6402c9503781c60245e6defc5f4f12261a8e7c44f13d7321aca8ba44e520670251fba1891de2e
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:zm7Rkm1tYpBeh2BAo+
TLSH
T15DC312275D75E93658B9BB1EB04E0B1F1EF149A7C920DE92C8D85F0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 ff69c9995452bc1757850348fc8af734a77ee310641182c8506c850383532330
MD5 8dfab1e18dde784df747998731982ad9
SHA1 a68ee42b882599e041ae85001ea6f589476b4d67
SHA512 78f9df3cb4239ad4a2f560b28600bb0f65626414fe16563876bb9b5fa82802e8ed705aeb2850f63e3905b5b8515738ec409b0dc1375b5659ad6709daf7141f1e
SSDEEP 3072:7dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:70m7Rkm1tYpBeh2BAo+
TLSH
T1ADC3123B5D75E93B5CB5BB4EB04E0B1F1EF149A7D920DE92C8D86E0423E66CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2a3e585d3bbc999b156cef7b262d0e33a630b9d76de43b08f4b25fb1b221d996
MD5 6f6e7f4366136f70256fbdb0772e24c1
SHA1 42df1bf17caf9dac006aafe85cfeffd405942a44
SHA512 5b7e6ae5882ba637f09c49394287cb88e0cd2986671b98144c339d8417c2d93220c91b36e3af3e2a7b4883de41ddbcc475372a35d958eda4a084a182d7e1d4b4
SSDEEP 3072:7dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:70m7Rkm1tYpBeh2BAo+
TLSH
T114C3123B5D75E9365CB5BB4EB04E0B1F1EF149A7D920DE92C8D86E0423E66CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 91bcc2d59e278596d8c43cf775200d61d8b30031fff7b9b6a63a10df3315e550
MD5 cbbcd826b0c7cbac47e30892b77ab9ac
SHA1 dfc18c241a5825866dac3217324ae3579ceb1261
SHA512 ebff756deaf64b855a080d6c5888cb81f04785fbbf61e2506cec3eaeb25599526f95779131fbd7c3dda839a15190ce2978e5bf75bc499ac24fb96a75d6d123d2
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:im7Rkm1tYpBeh2BAo+
TLSH
T177C3122B5D71A93658B5B74EB08E0B1F1EF14DA6C930DE82C8D86B0477F67CD1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download