hxxps://script[.]google[.]com/macros/s/AKfycbxtccsl87Xp_RVfvAhzw4sMn-wcfa3C8u04EwDXaUEiT2Px2YmmNY-dzzn3XNMSVshg/exec

Analysis

user interaction
yes
max time kernel
58s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://script.google.com/macros/s/AKfycbxtccsl87Xp_RVfvAhzw4sMn-wcfa3C8u04EwDXaUEiT2Px2YmmNY-dzzn3XNMSVshg/exec
Sample260706-tsglvsdt2p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
53	drive.google.com
54	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278283732544192"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1696	3324	chrome.exe	85
PID 3324 wrote to memory of 2860	3324	chrome.exe	87
PID 3324 wrote to memory of 3612	3324	chrome.exe	86
PID 3324 wrote to memory of 3612	3324	chrome.exe	86
PID 3324 wrote to memory of 5044	3324	chrome.exe	89
PID 3324 wrote to memory of 5044	3324	chrome.exe	89
PID 3324 wrote to memory of 3900	3324	chrome.exe	90
PID 3324 wrote to memory of 4196	3324	chrome.exe	91
PID 3324 wrote to memory of 3900	3324	chrome.exe	90
PID 3324 wrote to memory of 4196	3324	chrome.exe	91
PID 3324 wrote to memory of 4548	3324	chrome.exe	92
PID 3324 wrote to memory of 4548	3324	chrome.exe	92
PID 3324 wrote to memory of 2644	3324	chrome.exe	93
PID 3324 wrote to memory of 2644	3324	chrome.exe	93
PID 3324 wrote to memory of 4808	3324	chrome.exe	94
PID 3324 wrote to memory of 408	3324	chrome.exe	97
PID 3324 wrote to memory of 408	3324	chrome.exe	97
PID 3324 wrote to memory of 4368	3324	chrome.exe	98
PID 3324 wrote to memory of 4368	3324	chrome.exe	98
PID 3324 wrote to memory of 556	3324	chrome.exe	99
PID 3324 wrote to memory of 556	3324	chrome.exe	99
PID 3324 wrote to memory of 4036	3324	chrome.exe	100
PID 3324 wrote to memory of 4036	3324	chrome.exe	100
PID 3324 wrote to memory of 3096	3324	chrome.exe	101
PID 3324 wrote to memory of 3096	3324	chrome.exe	101
PID 3324 wrote to memory of 3424	3324	chrome.exe	103
PID 3324 wrote to memory of 3752	3324	chrome.exe	104
PID 3324 wrote to memory of 3384	3324	chrome.exe	105
PID 3324 wrote to memory of 3084	3324	chrome.exe	113
PID 3324 wrote to memory of 3084	3324	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://script.google.com/macros/s/AKfycbxtccsl87Xp_RVfvAhzw4sMn-wcfa3C8u04EwDXaUEiT2Px2YmmNY-dzzn3XNMSVshg/exec
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb9399c728,0x7ffb9399c734,0x7ffb9399c740
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,844045893042487559,14953787500377334394,262144 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,852621290327972579,12680553804444450407,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,12033623744820977024,9525615259835635206,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,4684056076104462094,6164985008894714429,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,3829601811938731719,10113931741317833588,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,16813500007662473827,16076554246436305510,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,4293434453497739322,11759740461211010105,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,18233046476371600615,8200808392624843646,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5796,i,2059695481626257012,10213713930404544321,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5904,i,15759331884531585250,18040616630462075851,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6024,i,9168083398885257821,5643612672657816725,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4692,i,3198531617300044582,9251483543176895000,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3356,i,12760374786322936165,9284430796124561264,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,7554923951487808276,3130935729788817134,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,9214125365328614089,4940499590855521694,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,5139219293937200935,17269596274784396335,524288 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6216,i,17440975256822324871,6609503581595231044,2097152 --field-trial-handle=2004,i,2931645140959254749,6874474386797591137,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

193e757b-b9d3-453e-9b1f-76a2b450cdf8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\193e757b-b9d3-453e-9b1f-76a2b450cdf8.tmp
Size 414B
SHA256 ea61625bebc7f359880e8e41597ac5a286627f5877244c188cdd248a6edc3a67
MD5 2ce9fe8c3e3653ad5d68d33f6150da04
SHA1 33782524fdf42d14997bf4062240508afbb29190
SHA512 506e073750c87ffdc5932b191c7482b5f07e0dfbecff1b2361805794a5cece978b83eed2531ac884de8c85625765684ee6fb5786e1129c4e2722e5992068c1ad
TLSH
T1F9E022A6CC719C772CFE475820964B49FA55131B2F90895F3A3CC20C8FB5A2A4186CDC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 778419362a492f4dbd1ea7f4dfb1a9757ab81ed52cd5185cfceabc51986c8acf
MD5 6dc7d8fd24d1f17ba9ed9c2fc6dfd134
SHA1 b68470c590c0eb6aa7bd57d8c76711c2bd1b9887
SHA512 d9aea3164d3b65d5fcf2c3a73b7cdc768a60f37998a6e2a2f636006194293a2f97b27c35a8b9fa882e7d666d2d7a69c8108979050dfe78715ca4195a45860ac6
SSDEEP 192:LREQL/hCwlQv7hpAPRp2EJ95Hsb+WNnfaV9628W2He9UBnVyIsnAUge:LREubM9UXZrwSC2n2soBe
TLSH
T1CB42E82EB910697B5CCBC219F9277B57D7F6142226E02E44EAFC896C15EF9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9c79382c69da8d497eef90b7b21cb0a23d7c9772e3639fd24d773fe4400a7ead
MD5 382f836779fef32b2bd9f3e2a4cacbbd
SHA1 e32fe2da8188ce39a249580725e8ec3641cd1ebb
SHA512 6c12bc205fa1a615ba9baea2c8666bff7a8ad8cf60bf62f7bef0963513c05f6273f65a9988689b73d6032c22db34c7b178b6a5bae2e28e675ae9bae66fe91029
SSDEEP 192:LREQL/hCwlqv7hpAPRp2OwJ95Hsb+WNnfaVlaYEW2He9UBnVyIsnAUge:LREubm9UXMrwSOYf2soBe
TLSH
T12C42D92FB910697B5CCAC219F9277757D7F6142226E02E44EAFC896C15EF9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3cf6a1cb55f67860c77e8a7cc2bdc68c2d169d08b7793354b7da2c5c55e3aec7
MD5 ec6b33ac6dea47f24ba749bda42364d3
SHA1 18019eaee13dc10f962c4b2b77ae9167773947d4
SHA512 b2b6c800009613cf969b8b072e057e3b659024ecc26ccd2d84d7ad1926e96dc913c6b554bb3552920cfce4e13b1a6f12849884d16f84fc8e6e5d82fcfbb89463
TLSH
T14AB0124185415681C04302F82142148C7124EF15D60A270183F1A93298251908224151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585d2e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585d2e.TMP
Size 96B
SHA256 a8ffb31fbcb4b4ff5a62c89f38b4efd7c39fa2999f5e60cdfac2a418baaa1c47
MD5 26cdbe5df33d8a7fad703c52ef044540
SHA1 652ccdad7e6f8b91a6deff38347f4fd59f6f5312
SHA512 c9373c0e3baa9784e741af80ab806015e9546df79fabd95b159e6b3e30330634a3029e7ef46a81704c113d4335558470a1d17f31f1ef66f41017ef46065cfd6d
TLSH
T17AB0025AC6026332C06303B02DA5D5EC7168DF26DB43121696E42F66DF656608625B60
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 325ee77eb9c010a7077710c94fd734e002f0415bce2b7e15e48aa419fa29545c
MD5 fd75eed0c5d4d6d3e992a54f740e7865
SHA1 f95284bd595993215e404735243cb99091cd0e27
SHA512 fd0e760844c0e22c5f8c073492ccccf18690a59ec729d20fc6a6856edc6070538721d718332de1cbaf12676417faea896c63dbc01d3970af5798f6d17c7ca473
SSDEEP 1536:6HyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:wqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1BDC30237EBC25F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f5a78948ef6dfb69ac217f0d84503c21ee2f7f247fe49dacad661e4c2d194165
MD5 f013ffd058c28896bbdf14b48534caa0
SHA1 c28a4aa7b1a30cccf121ef0feabaaa7c3855f549
SHA512 e2489540b8482fcf093cadb5f36bbf51bfaa4523c6f2abf885be85897e8125e548b8a4c4ca8a9a69689c1cee7f0bd8da23df8f0e4ca398ec1a8b3fee28dbb19f
SSDEEP 1536:7NAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:5Cqfd7NtZL8cHQRZEQ6Sps9
TLSH
T17DC30237ABC21E335DC2DB70B9130FD797B644A99034D3019BBD2BFB698345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6a93865fb41c06996887e5a5d153eb90a99be059b0010aeee555695941a6ac45
MD5 0cc5845b6112c323f9a333d0def2a35a
SHA1 40d9fc5089829752ec5dfc3e910ae325ee88919a
SHA512 039bad6a0e59675c892e683da47f088a074eb21eae82d3c0300b9acaf35581eaacc5b3caf31ca32b12dbddb0b6013b1cdc8e96af6d6c7eba1245e20997173545
SSDEEP 1536:6yAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:7Cqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1B3C30237ABC25E335DC2CB70B9130FDB97B644A99034D301ABBD2BFB698345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download