hxxp://tw3ie1zyftqmp6h[.]s3-website-us-east-1[.]amazonaws[.]com/

Analysis

user interaction
yes
max time kernel
300s
max time network
302s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tw3ie1zyftqmp6h.s3-website-us-east-1.amazonaws.com/
Sample260707-seq3psfy5w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5036	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279102033219679"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1468	3924	chrome.exe	83
PID 3924 wrote to memory of 1392	3924	chrome.exe	84
PID 3924 wrote to memory of 1392	3924	chrome.exe	84
PID 3924 wrote to memory of 5036	3924	chrome.exe	85
PID 3924 wrote to memory of 1848	3924	chrome.exe	86
PID 3924 wrote to memory of 1848	3924	chrome.exe	86
PID 3924 wrote to memory of 1592	3924	chrome.exe	88
PID 3924 wrote to memory of 4728	3924	chrome.exe	89
PID 3924 wrote to memory of 1592	3924	chrome.exe	88
PID 3924 wrote to memory of 4728	3924	chrome.exe	89
PID 3924 wrote to memory of 4508	3924	chrome.exe	90
PID 3924 wrote to memory of 4508	3924	chrome.exe	90
PID 3924 wrote to memory of 3240	3924	chrome.exe	92
PID 3924 wrote to memory of 4264	3924	chrome.exe	98
PID 3924 wrote to memory of 4264	3924	chrome.exe	98
PID 3924 wrote to memory of 2896	3924	chrome.exe	100
PID 3924 wrote to memory of 2896	3924	chrome.exe	100
PID 3924 wrote to memory of 1844	3924	chrome.exe	101
PID 3924 wrote to memory of 1844	3924	chrome.exe	101
PID 3924 wrote to memory of 460	3924	chrome.exe	105
PID 3924 wrote to memory of 4424	3924	chrome.exe	106
PID 3924 wrote to memory of 3980	3924	chrome.exe	107
PID 3924 wrote to memory of 4252	3924	chrome.exe	108
PID 3924 wrote to memory of 1044	3924	chrome.exe	109
PID 3924 wrote to memory of 1044	3924	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tw3ie1zyftqmp6h.s3-website-us-east-1.amazonaws.com/
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffad570c728,0x7ffad570c734,0x7ffad570c740
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,18398662309443236536,12920560041796030542,262144 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1640,i,14323536014347401076,9340931586586642305,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1636 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14396527313340533163,10718379193054481964,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3008,i,4211378640888624090,11469884346569558930,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,3075379729493558402,7609346639287612267,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,4855323870917140398,597455917268356427,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,6049045916084613761,15873822130143554596,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5464,i,18147891670537988090,2587275246708274277,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3440,i,18140139771155681197,2666367695057137706,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5668,i,3327328833845885535,15048274178888376527,2097152 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=500,i,3145310572395680846,13562135226850968911,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,18174027594742668879,2840633124699366668,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,15457619921126372800,13190551815720616543,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4508,i,6719938956563016819,15245718834050198566,262144 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,8703181583970791705,11505552262272117522,524288 --field-trial-handle=2024,i,5127944919520966929,4517005283967031488,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 43d8c9b97d75ff64be38afc254892ac4fe350d72aae514a16b15c25c122c9c39
MD5 118d607ea10141ec59a905c4e2bec2d0
SHA1 02fc0227c9871be633991906a139a713bbf68d79
SHA512 8669923925615960daf11219ea75b4aa16316a16d79e803aacec9e46bd9415d7f46e26c8c7128aac9b0a132baa4a41bf893323ade09bf8d35df516ef25c13d0f
TLSH
T139E0E56EC8269D7728FD4B6910540A46E6501766AA40896F3B3D820C8FB02364585C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 2035eeb2f98599d9bf2fbb70f9c45e2e41ee2aa5fe192410c7a6419e9c8f718b
MD5 a0612950038d673077745600fc742880
SHA1 a17c73dfaba2e505fc865b0c3e2456dcd09f52b5
SHA512 a2de2c54ba7b37526eead631252d5b69da760dcb6d9cf5b8e24d958d8211374650d666321aab9f8281025e23d3fd6ec4c295d28410eb542422e447b61449c5f5
TLSH
T179B0123407C065E1CB2101FC02817975F2393D8082012BC3D9D5A0C89C237AE013B000
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3d52e3d939afaa79e94f9a89f89ce0eabdde6a02fe6c40c3585112eca9967833
MD5 3c3b6a2b1ef1a40a78095829b01e8e5a
SHA1 ade891b294c739b0c8879e0a9691864588aab876
SHA512 9ea90771ab5fc562fd6e94a281a4362dc8d801b944251f0c5176a6fa6177415344eae9d92178a1e1505361c9438c7eb02d8854991c0ba1e0a65c2e4e7f9b9472
TLSH
T126819FF793F48A6DD92196F4BA146F3FCE290A24431C3C66C9D4AE0B93E28B1D11064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ee6e86a1d1a7c86a2cceffd08e221f0af843fc35b096ede70f933f84b53f2830
MD5 ed3c63b2dec04d0368bd51e2099978f9
SHA1 f4788e24fa72edd0585d00e64691ed183a09a20c
SHA512 aa87d0b5f08a814b9fbadfb71c682b7eeccb70e661582121472f813a45b94fd4a212faf00b52e27381992b4151d3720f001af3fa944f7726e910d63d8851a144
TLSH
T170719FF793F48A6DD91196F4AA146F2FCE290A24431C3C66C9D4AE1F93E28B1D11064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 216e391252cc5ba8e51ca7b453b4135b3d45f335973b57b8c9e4ced84579fe6e
MD5 a69d9060c178307ce799d8c8ec74a44e
SHA1 76221dc1972e1ebd6a38856bb4571b4413c1d8bb
SHA512 1c367f536afa8854d90602a9bd05a36f7729fee7352ba0e896bff57605b7b3b09218a5dcb1cc847afa0bd12acb72a244abb099f45f3f8fe4843215ede922688e
SSDEEP 192:ARZJsbT491v7YnpAPRp2s9oH3BCOb+WNnr3Pg6eIAa29VyIsnAUge:ARZJsQFkUXTuRCSDPga2Le
TLSH
T1EB42C62EAD10A93B5CCBD32AFA627B93D7F5102161D52E84E7FC8A2C11E75DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0359aa05a4e96d51e2bb2c69cb39afd3c248f60b0f1244309548268cc0c38b73
MD5 32c8161a4bea2766b8fe5c40e20f3427
SHA1 14899e4c26c0a559c58e4174b79d0a5de0bc471f
SHA512 7d11bbed684e6b31270420a3e26e0792c6ba4ebece3f355f3d020eb0f22390889b8274c8eb79765d49e140fc51a8ab4fec62ed21d3506abb39dc5962541b1f56
SSDEEP 192:ARZJ+YbT499v7YnpGPRp4gu9oH3BCOb+WNnr38jZEu6eIAa2eVyIsnAUgE:ARZJ+oQ9kqXkuRCSDGE2a2WE
TLSH
T17C52D71EA910697B5CCBD22EFA667B53E7F5102161D02E84E7FC8A2C15EB6DC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
MD5 a8d99a89af5bdc4d36bda0a26f9a1835
SHA1 eb4f61f12dbd8bc006b66b5635e820349ee33d41
SHA512 c99be19c76c0ad1a08682264926ddb11a255acc2f228d7157f1abd1d4a7df9d1f680e336435cd220b8f27397dfc7a98def0531d0590cc20f63719683618de399
SSDEEP 384:GYjax7KxkXqKf/pUZNCgVLH2Hfgslzh7pLuLcSjoJXODap+ErU3+pHG2xw4483G:Gsax7KxkXqKf/pUZNCgVLH2HfgsVh7p2
TLSH
T15272F967AC48DD370F94CA8CDC277F4FADB9024B65ED846442FA982903D5ADA11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4e3b2dad37198ee3fb4da2bf0c825ba297b4fb8e220cbd7a28a5b127b76a5e04
MD5 756a522d7c4114b65b2da311f8682637
SHA1 6ae32459b2b67db8467a6a1ef87339f523b20833
SHA512 49aed1435bc48848c4ab2a8a730a59f6272f7777e96be6b7012c5a54cdf5fdf0e3d9a168a89eabab6586486c91d35d74163b3101fc44de927cd23ba2623be21b
TLSH
T1B7B0124181415301C81302F42142148C72149F10DB0E170253F0696698361908814050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d49.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587d49.TMP
Size 96B
SHA256 19907843602ca4701350294fe9f2a6cd88d2250b2048e32669072f5f798dfef3
MD5 64f8144ce0bc191e4fbdadaa6bc39d79
SHA1 1b6ce562b13e76ed6c0109f470d54a6e76623cb8
SHA512 ceba16d7140025bf6f9e6afb7b7ef1e579c49097cd4764787e133398d43ca64edd8aa7664aabc4cf8b0dce62fdbe7b66c07c39022111830cdb2c34ed52afc58d
TLSH
T13DB02220C282BA02C00E03F03ACA80CC30E0CF20C2030222E3E02E33CC282200330820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4903363d854350cd58f54d8cb9abf5d177f86a74401ef917cf5fabddffc73496
MD5 41750ee74bb699d84a2147d7ee11922e
SHA1 47cb8087e7515672fa5f1e86490d8f9c07e385b3
SHA512 b8c53bbb01d08111b3b9c0390d618bee8faec3e11b07ad3b9785261f00ac66d1f2141e122b02f6256674570154dacec40387ba2e39218c358f81e1c3a64b9a19
SSDEEP 3072:6OfJajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:1ojSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1CCC302E0CAF2CC9BC66542CDF0355ECA49D08DA4E945EA8673DA3F5B242B1CE7A43531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 74e042759d477ccebff6ea0a2a629fd62147f43d461070d8c4d1c2731f9e586c
MD5 5b0370a4f65ecc83d881a4c786f746e7
SHA1 51f9fd5480b31e92288e095967a59373085157a2
SHA512 b70a3289c1ffad7c374ae8b3a0de2cd51b6368e9708060957cc2caf519bd3471980b0cddee13c9200c1ec0f3673e9be1e9606304e13f486e9877b9906c895362
SSDEEP 3072:EgajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:sjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1B6C312D1CBF1CC9BC26542DDF0355ACB89D08DA4E945EA8663DA3B6B342F1CA7B43421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a3f5f43fb9ead5a15fb2fe7913f19cc7bd73f00601cb0eef997a56cab11f691c
MD5 58ab8856dbacd386cd7c312b9d56ef3a
SHA1 4bfc962a53d3679fec355ccfda6fbad69e352bab
SHA512 11bf1636fe65a15d0297094a954c768ecc20601b7ceeefcd103e8528028dd14b86ab92af0a5177f502ac23a169b000549b85673f722ac0e362309ddf4c1bdb98
SSDEEP 3072:uOfJajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:RojSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T110C302E0CAF2CC9BC66542CDF0355ECA49D08DA4E945EA8673DA3F5B242B1CE7A43531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7a9d5e2af81ea048c06dc0b967fb56e2ef50271c4b37c50b11a24f20897f6210
MD5 34a0952ae5e70b9dfab67f49976db0b7
SHA1 32e48191965d4b3dad3ca0edb13522423c670773
SHA512 dffe003bceb2643b25be7aa43ce69cfd0d86f0aeafe2de9bf7997b8fba0e7c774ebc2c64c9e3725cf1360e235d8763787214786e54b0aaea9678104f7f6266e7
SSDEEP 3072:vGajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:xjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1AEC302D1CBF2CC9BC22542CDF4355B9649D08DA4E945EA8663DA3B5B382F1CA7E03521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 44aafe342bddaf9b5c69aecd935b885f6e5a295bb66c043dbc8ce62a1dfba1ef
MD5 430870c6c8d34a84bc902be01635974a
SHA1 8e4c4dbfe84ef9c4a4ec820e5e2fc2ebfdf01fae
SHA512 4d5e5d7cfe400cae8e919f20122c30eea35fe10dfef6dc7de9d6aa19482ff12c7b18ba483019e8f4b330449e29ec49c68768fc2f4d8ab037aa0a9a766eff0f26
SSDEEP 3072:/gajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:HjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T16DC312D1CBF1CC9BC26582DDF0355ACB89D08DA4E945EA8663DA3B5B342F1CA7B43421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download