hxxps://u54718438[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]bF0d8J-2BRq5PbR1176gr-2FmiRb8Rh3mThbHBR8Cc9wRP-2Fq1-2FfeHiz93p9dhqHk3xcrCb5IqJYQrLM5FcB4smVhZMMXdicktRctMsi0u1B-2B0CE-3D12Ry_cibA31HqSwAbRBL3FdnywBu8-2FegUjojqunfPgCuKEvq2RRLqzARG6J4o-2BaobhZ9g-2FSA5NNHyybDIN1a7HSuO-2BBtN5HpTzVJAdEwL5GPUn6-2F3XEk0rUXNAg40u4WMVx89raVT5urI124fcEWMvK2Jfg3-2Bae9ctlyUFV-2FgMcX21-2ByKIrO4y7afLFI0BjwKQUzVV0lp2QonOJcQrMp8C5hEp4kBB2gSm13Bq5iWVq7b9nM-3D

Resubmissions

29/06/2026, 10:36

260629-mndabaaz3w4

29/06/2026, 10:36

260629-mncnsaaz3v

29/06/2026, 10:14

260629-l9qbbscw9j3

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/06/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u54718438.ct.sendgrid.net/ls/click?upn=u001.bF0d8J-2BRq5PbR1176gr-2FmiRb8Rh3mThbHBR8Cc9wRP-2Fq1-2FfeHiz93p9dhqHk3xcrCb5IqJYQrLM5FcB4smVhZMMXdicktRctMsi0u1B-2B0CE-3D12Ry_cibA31HqSwAbRBL3FdnywBu8-2FegUjojqunfPgCuKEvq2RRLqzARG6J4o-2BaobhZ9g-2FSA5NNHyybDIN1a7HSuO-2BBtN5HpTzVJAdEwL5GPUn6-2F3XEk0rUXNAg40u4WMVx89raVT5urI124fcEWMvK2Jfg3-2Bae9ctlyUFV-2FgMcX21-2ByKIrO4y7afLFI0BjwKQUzVV0lp2QonOJcQrMp8C5hEp4kBB2gSm13Bq5iWVq7b9nM-3D
Sample260629-mndabaaz3w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
568	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272030010550063"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
396	chrome.exe
396	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3000	5112	chrome.exe	83
PID 5112 wrote to memory of 1820	5112	chrome.exe	84
PID 5112 wrote to memory of 1820	5112	chrome.exe	84
PID 5112 wrote to memory of 568	5112	chrome.exe	85
PID 5112 wrote to memory of 1712	5112	chrome.exe	86
PID 5112 wrote to memory of 1712	5112	chrome.exe	86
PID 5112 wrote to memory of 1516	5112	chrome.exe	88
PID 5112 wrote to memory of 988	5112	chrome.exe	89
PID 5112 wrote to memory of 1516	5112	chrome.exe	88
PID 5112 wrote to memory of 988	5112	chrome.exe	89
PID 5112 wrote to memory of 4228	5112	chrome.exe	90
PID 5112 wrote to memory of 4228	5112	chrome.exe	90
PID 5112 wrote to memory of 3848	5112	chrome.exe	91
PID 5112 wrote to memory of 3848	5112	chrome.exe	91
PID 5112 wrote to memory of 776	5112	chrome.exe	92
PID 5112 wrote to memory of 776	5112	chrome.exe	92
PID 5112 wrote to memory of 2412	5112	chrome.exe	93
PID 5112 wrote to memory of 4692	5112	chrome.exe	98
PID 5112 wrote to memory of 780	5112	chrome.exe	99
PID 5112 wrote to memory of 1760	5112	chrome.exe	100
PID 5112 wrote to memory of 396	5112	chrome.exe	106
PID 5112 wrote to memory of 1836	5112	chrome.exe	107
PID 5112 wrote to memory of 1836	5112	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u54718438.ct.sendgrid.net/ls/click?upn=u001.bF0d8J-2BRq5PbR1176gr-2FmiRb8Rh3mThbHBR8Cc9wRP-2Fq1-2FfeHiz93p9dhqHk3xcrCb5IqJYQrLM5FcB4smVhZMMXdicktRctMsi0u1B-2B0CE-3D12Ry_cibA31HqSwAbRBL3FdnywBu8-2FegUjojqunfPgCuKEvq2RRLqzARG6J4o-2BaobhZ9g-2FSA5NNHyybDIN1a7HSuO-2BBtN5HpTzVJAdEwL5GPUn6-2F3XEk0rUXNAg40u4WMVx89raVT5urI124fcEWMvK2Jfg3-2Bae9ctlyUFV-2FgMcX21-2ByKIrO4y7afLFI0BjwKQUzVV0lp2QonOJcQrMp8C5hEp4kBB2gSm13Bq5iWVq7b9nM-3D
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff91c7fc728,0x7ff91c7fc734,0x7ff91c7fc740
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,17829829376563743163,16806110181666804755,262144 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,3536982739257997415,15497352928188161107,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,15913496302922838723,819710679207278345,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,17142791021562094775,13676208215668571510,2097152 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,1520161586410437410,4905476387050586477,2097152 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4252,i,14120922880558007627,3402623597532230369,2097152 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,17979190274803556328,5142146951909395042,2097152 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,18356163419497306105,7779536422885434004,2097152 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1846327733582887960,13093297195579917677,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,1711686991702831691,13214717328886873863,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,11708995824640648601,5850572959961783424,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,17477070206158896117,13705516581110636319,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3236,i,10117193131759685070,6121473080497949952,262144 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4316,i,8739653082568347522,8541572985707190072,524288 --field-trial-handle=1960,i,2138368800771833353,12219685082189350897,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:1836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f9d51cc4cefbe2452fb036e8bfbb0319cebdaff837c7ffaf2c95517d515f6719
MD5 a4132d7a658614a09231c6eb87e4d93f
SHA1 072a361a72d03d04e6bd4f9d23a2985cb1b41d39
SHA512 8787bd6ca6fd16dbe2d89a78b917574dad69b076e899282fe671d3a0839df93b224bfba8bac10f2187595640818145b30a7ea65550f32fafb2aa4cbc964467ba
TLSH
T11AE02B66C821DD270CFD5B1C60549A41E64523671B408A1F3B3D810A8FB67364A9282C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d0c54dffc776b323448659773b7ff38f40dcdff6d53878d2d6ddbba0d624309f
MD5 445f35f847e8f3dcd6c4d833d69acf26
SHA1 bcc4d20fcd4a543816d385404a42c29f025e8a1c
SHA512 6ee875eec9677d6978477ddec71f6575f735192bbdedf58f9e51585138e0cf95ced000e2b9389ad082e7c4288c59cf83b088ee99d4f77f4a73025c2606d7bca9
TLSH
T11181ABF782E8C56EC91156F4EB217E1FCE2C0964832C3C56C9D4AE5B93E2431D24568E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d3e21b1ea69a414c204f94a012c4576e4fc95694e8d50dba324c44069b3a77a5
MD5 88e2005e070a41db46aa2fed4d42196f
SHA1 3c66931b6ffb4c21be9e59fa2cfeff1d978ec591
SHA512 2a46bc36da75acdbe40065c1bf3397cfb69c6c20d0ec6cc28c156d4e1750914f5140339b4d89497e31eaa14e070d3f539707b6236a7c9117556ebe6820c498ed
SSDEEP 192:CRBQk0cP1Iv7bpAPRp2qDf9/HqBb+WNubLKtQlt2F02GePw/jaKVyIsnAUge:CRBQHKUPUXT12q8q2a2DwraKe
TLSH
T1B352A62AB920693B6CDAD21AF922B763D7F5102121D02E84FEFC8B1C06DB5CD711742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cf66174db386329ff453f8f772e8129036477ca6b2077b812b23b26f9a3236aa
MD5 12a6b526fca52026a4161044eee2ffe7
SHA1 829e783793a0d29f9f4debd6e3b3dd7a3f98f436
SHA512 2f7d75b5005c7467b99ce609d954534fa3e823a96fe329107510d02b88b80b0e88ca988b216b77a31344fa4dc14ce196a9abd5d525de57d2988099f31e907c73
SSDEEP 192:CRBQk0cP1uv7bppPRpVqDf9/HqBb+WNubLKtQlt2z602GePw/jaQVyIsnAUgGWP:CRBQHKKPbXi12q8q2zX2DwraUTP
TLSH
T18652962AF920697B6CDAD21AF956BB63D7F5102121902E84FFFC8B1C06DB5CD211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e02be7d08c7e90fc16101feb93f64f0d74cbcaa18f085a696246af5ad66ce254
MD5 52c18db93dbffab2d7465c74f14db1a4
SHA1 99a9fd59471f27ac5b9a84fbce4a79203d4fd625
SHA512 57326962d7ada3c04c5fab568c47b506dc6df3d6f9727e5b7dd0947725d065155fc7afde58e7820cc0d7ac96faf4185444deaad95f25cbe50b434b7a6b15e7d6
SSDEEP 192:CRBQk0cP1lv7bpAPRp2qDf9/HqBb+WNubLKtQlt2vN02GePw/jayVyIsnAUgGWP:CRBQHKVPUXT12q8q2vC2DwrayTP
TLSH
T1F152952AF920697B6CDAD21AF952B767E7F5102121902E84FEFC8B1C06DB5CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e22ec05c076bece970e81c8625ccbca71eef18362d2d1b81a5b55f31fe89c427
MD5 59d48d75dc515fa7aa323dbcee0c01b6
SHA1 6bfe06bcec03fe92f5d7846eab92fa546eb73094
SHA512 055e22d32e5d3d60ea2625d810dd915d66db420f176f542a04c019b6df22da0cbce80fdab6e483bf739d4673bf6daa025df6e01776554d1e45a07421aa61d62f
TLSH
T1B2B0120080015132C04302B01A561488B3586F30E70E170643E07A22CC2D171C018090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ebe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588ebe.TMP
Size 96B
SHA256 53766138020c4c2dbcdee7b6297b747c58502e9227613aa1f5eb328f5a969230
MD5 2e62bb0f81c15c077a30f7858feffcb0
SHA1 a521be689c292acd3d7b089f3c1c7d0764b86b12
SHA512 52e765e3d16e22990d36659a6afb8e8bb6dd608bc66013305ab23be9ed81cf745b5ee755da0041747e62342b93557d142e2a930c34be7826e74ea7fdc17584f9
TLSH
T182B00265D1026312C0C203F129E599D8B7B1DF39CA471313A3F06A66DC397B145291B1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a5ac215c3cf59415187284eae8ac09ebb3ccade0ac8edc13ed4b2f8267fd8379
MD5 156f6d04b723d603ae968906a6915219
SHA1 22e86965d4e087252c3da25864611beb7d56fd75
SHA512 54ebc00191da48afc63b33ed5f57b6f9fcb02c901ad427d5e67d2e1516ba12f87186b3dde516b889b6a2d22a93b14ae36f61a4ef22f44bbe5f5acd883f5876ff
SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Lm7Rkm1tYpBeh2BAo1
TLSH
T16FC302379D75A8374CB9BB4EB08E0B1F1DF149A7D920EE52C8D85B0823EA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 b71e6f62946a6c0c0412ae50f80498bc6944aae3e0bb0b5b65630b60ac249a4b
MD5 b5a58d8c42a8ec8253299968cec7317a
SHA1 efe5003a0a1a724889f917b60cecec29a9d5f235
SHA512 ff0d1bf1d1ff558f88379eb4eede7af33c42eaba89375f4aef45b85bc311d7f89183f72e324cbaab69f9eab681ce37e60908f6cdc4c65f9f953f64e946f38f73
SSDEEP 3072:YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Tm7Rkm1tYpBeh2BAo1
TLSH
T1A3C302379D75A8374CB9BB0EB08E0B1F1DF149A7D924EE56C8D85B0823EA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3bc5025a00dc36c147cad4027348238ac503b4ecea1b2c2fea1e33a8b6f82d7f
MD5 7f6e4d30045e922e267dc3beeb9d42d8
SHA1 125528ba545bbdb9d4decccf69732a41ea229b7e
SHA512 105e5168504ec0f1a005d3f5f3cbdf89a62f2ec7206c8a5d10ee4ee916590199765fcf96237b668bd37b0bbb4349dedda761f7fb76bc6beaccf1f63316452fd3
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:pm7Rkm1tYpBeh2BAo1
TLSH
T1FBC312379D64E9375CB9BB1EB04E0B2F1EF249A7D920DE52C8D85B0423EA7DC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7078d9bd2dbbd8fe19d1fd5768abd19e33d6e84792d716229d45ea7329db266f
MD5 4f18eb2fe2ea9c6ee7c02e38bbfa930a
SHA1 f14e4add45eaa5b001faa842037c419231c32681
SHA512 a1fcec469d7e48fb814d712606a86a4033da9df5f2d916beee239059d0e218708fbd696df401fabaa4f048f0ddc3143fef959ddd36edb82722646a71bdfb3a79
SSDEEP 3072:STGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Sqm7Rkm1tYpBeh2BAo1
TLSH
T126C312275E71E9375CB9AB4EB08E0B1F1EF149A3D920DE82C8D85B0477FA6CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea04542e-ad38-46d2-abe2-a39a8c63b74b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ea04542e-ad38-46d2-abe2-a39a8c63b74b.tmp
Size 116KB
SHA256 2fcfce7253f1c7f34c058cb900df05ba3d5be37ee3c06b349ddfda5dc6ebd95c
MD5 be43af9a91c1cc268c1dcec765a553ff
SHA1 0be5fb1d4274c35eb6045305a80a73bebea28a58
SHA512 2092d50d8891f945084001ed67cac152cf4c984c41f3afda2b4f98bfad0c90bc204f0cd58863bb013be99bc867ae7926fdb9985661d10fb75e9afc46dcd4d735
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:4m7Rkm1tYpBeh2BAo1
TLSH
T1E6C312379D64E9375CB9BB1EB04E0B2F1EF249A7D920DE52C8D85B0423EA7DC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download