hxxp://www[.]totallynotavirus[.]com

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
300s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.totallynotavirus.com
Sample260718-2aphraes7j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288870170659923"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A88A16B3-06E2-4D74-ABC4-66BB2D49E977}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
1592	chrome.exe
1592	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe
Token: SeShutdownPrivilege	4000	chrome.exe
Token: SeCreatePagefilePrivilege	4000	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2500	4000	chrome.exe	87
PID 4000 wrote to memory of 2704	4000	chrome.exe	88
PID 4000 wrote to memory of 2704	4000	chrome.exe	88
PID 4000 wrote to memory of 3744	4000	chrome.exe	89
PID 4000 wrote to memory of 5076	4000	chrome.exe	90
PID 4000 wrote to memory of 5076	4000	chrome.exe	90
PID 4000 wrote to memory of 4344	4000	chrome.exe	92
PID 4000 wrote to memory of 4084	4000	chrome.exe	93
PID 4000 wrote to memory of 4344	4000	chrome.exe	92
PID 4000 wrote to memory of 4084	4000	chrome.exe	93
PID 4000 wrote to memory of 3708	4000	chrome.exe	94
PID 4000 wrote to memory of 3708	4000	chrome.exe	94
PID 4000 wrote to memory of 4960	4000	chrome.exe	95
PID 4000 wrote to memory of 4960	4000	chrome.exe	95
PID 4000 wrote to memory of 4116	4000	chrome.exe	96
PID 4000 wrote to memory of 4116	4000	chrome.exe	96
PID 4000 wrote to memory of 4848	4000	chrome.exe	97
PID 4000 wrote to memory of 3080	4000	chrome.exe	98
PID 4000 wrote to memory of 3080	4000	chrome.exe	98
PID 4000 wrote to memory of 4968	4000	chrome.exe	104
PID 4000 wrote to memory of 4968	4000	chrome.exe	104
PID 4000 wrote to memory of 5016	4000	chrome.exe	105
PID 4000 wrote to memory of 4268	4000	chrome.exe	113
PID 4000 wrote to memory of 3484	4000	chrome.exe	114
PID 4000 wrote to memory of 4892	4000	chrome.exe	115
PID 4000 wrote to memory of 1592	4000	chrome.exe	117
PID 4000 wrote to memory of 4268	4000	chrome.exe	118
PID 4000 wrote to memory of 4268	4000	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.totallynotavirus.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcdc47c728,0x7ffcdc47c734,0x7ffcdc47c740
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,10845813511420753057,274603414492873628,262144 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1552,i,7495115128435641187,15758046073402848214,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,15637341341791394479,6455584856053295913,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,3925910397050232226,1776816709636087719,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,4444697995962610168,8767598225887730584,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,10369022795101794385,952275844801430923,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,12929462424286035765,3778223412641677686,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5236,i,13825947150719286023,16544197170557033142,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,2995080571934442209,7467554466096971516,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,4742973397523062011,13650137089254229338,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4828,i,6046786945774365664,7322543836290796725,2097152 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,17090795021319674351,37617700017953771,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,7611497274690439419,14246778292771165869,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,13235263441389744313,1248782725162281388,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,12612246840223783142,16276697508678363741,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4812,i,5395032581484523180,1583092715304830162,262144 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,2141708290611700584,113329274773299716,524288 --field-trial-handle=1996,i,17594126863571110414,10603502810872870569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1164 /prefetch:8
  2⤵
  PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d2e03101a13b80e4b97b5c5c8d08e5035723c2ece18fa4902d1341fdc95ea447
MD5 e3f8da9f81e1a5a033672b3c09da72ea
SHA1 ad6d072ac5d71b273b7175bc6edf9c442cf16cd8
SHA512 600ff7ff7b5eda52f11b856d040b03a9f5ad920379869aa6f720749940551078df4b7a0199813ac3ca9eed3107004db8d137abd59a6ff8cea98b4ce7e877f237
TLSH
T187E02BAAC973DC3B1CF9171868654745EA4123676740994F773D510C4FB477A418685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 1cc167ebd8404bbe2627e84476e9d61d16c9fddf66f2435b5f8510567b9c610e
MD5 d552171c81543e807bf85779cf61fc9b
SHA1 ba42c8a0a57179b62ade62feb35fb60e3f8adde7
SHA512 d5842fe32e5373d0a535b3a50580d5bff8f0c7655970a10cd00ef5841177c5fdd550818d81fc7218a23a93a16af0c41788e8e89c46301e222ce1cfa4271d406d
TLSH
T16EE0C75C87C23062DF268E3A09A02F857620EC8417337B23DB80086380E39D95202C66
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 083004ac39dbe9ae2a8c0fea42d82985099cddc22afc68fbe20a7c826286670e
MD5 f79b94edeaf2ae7866340e02ac618ca6
SHA1 cf39442a29c91d4dbc400aa2fbbe9e6130d4b26a
SHA512 cd63a7d5dede33ee5291ddbb736bb14d90d6c3b9151bec345eff3c7bf0b01228b865880907c0c48f9eda9061dce7ac54a063d69d232ec2b437687ce60e386ee1
TLSH
T13A518DF783B5853D8A1196F4EA156E1FCF6D0524032C78A689E4AE2B93F29B1D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b88bcf30d3d2048fc0a218c9a4cee4841e1b4299e2910a31d1705a77b9dfbe67
MD5 ee4a8b02479e1cdbe5567fe7915dedf7
SHA1 bf0e39037b8026d9918fac1ac4e30809142da796
SHA512 9e372eedf909a539bf0b8ffaa879161220cb5be238bd1c16e57c459345b8f863f84adde7430bf61a36a1eb6733958df47c20c903c9dacd70e467df8c51fd55bd
TLSH
T1EA518DF783B5857D8A1196F4EA156E1FCF6D0620032C78B689E46E1B93F2971D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d3661e0a8de2a2f17d9721b4856a816ab36e97abb5b0d7abf1e256a469cf0867
MD5 548a9b4e3d3a6626e83be23d2a195113
SHA1 ef7a8cfc42f90d46042479b51e234de6dec87ea9
SHA512 e580e685dcf2369eed8bf998c28dc25a58a0e68d64e12640263c88e0f80f404a060df788d0b6001d052f16ebdd28f063d62e50347e3e2a3eeed96ab97deee5b7
SSDEEP 192:FRUjui7kGov7kF+pAPRp2QJx9HHsb+WNyM27cMz2KZN7wkwjVyIsnAUge:FRUjp04oUXT1wyr2c0le
TLSH
T1E152D76BAE152DBB6CCBD229FD22BB53D3F5102261D51E84EAFD8A1C10E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 acbd055cb79dcdf0582ea4b93c65ab708b24d7ab55961b6347bfd8a5dc4c1757
MD5 e83ccc825819c9363eb5ed1ae17c4812
SHA1 7bfd7031ac8fb9d133aef05377cae873b111e93c
SHA512 dc608e4a6d120e423f2daecfd02010bb34c9c15959c8dfe27d023d48c892e7ca7847be303c01bcec62b8c99eaf4d0beab11c20456e663d3c0157c36a5b098b7a
SSDEEP 192:FRUjui7kGcv7kF+pAPRp2QJx9HHsb+WNyM27cMz2QZN7wkwuVyIsnAUgE:FRUjpI4oUXT1wyr260GE
TLSH
T1B552B56BAE152DBB6CDAD229FD22BB53D3F5102261D51E84EAFDCA1C10E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1a8c59497bddaffce1c50d1fea7203d461668d07f0ce5358afdf6808dbe81725
MD5 a3cee990c4f85826eae260c0b39dda88
SHA1 98062f98b43e3d12c6e4ec7e751acd833f998061
SHA512 343520ca06cb7e3a1c081dbac845f86d8c8a3ce5f5227f1e0a87e63f354ff3a0ece1a19f1de1694a7ba9a96aa2f428b59b8046989236349ade5370456f8358c2
SSDEEP 192:FRUjui7kGPv7kF+pUPRpqQJx9HHsb+WNyM27cMz2dZN7wkwcVyIsnAUgE:FRUjpH4oEX31wyr2l0YE
TLSH
T1D552B66BAA152DBB6CDAD229FD22BB53D3F5102261941E84EBFC8A1C10E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dc0a062b103f61d5edd8bda6baf859b4d83201c1131bbbe12e5989e9532c073b
MD5 e274d9e144e38311c8d993a657460953
SHA1 7f3032853bff72a7b05d07bcf02bf91fde4fa764
SHA512 4b785b401966d76c127aa820377aa82d7d50da3f879a7f60191c454d3bf6123f2ec4a967526ca190eb1f547840d96d14a3388958aa207a237a858bb67b2d7e60
SSDEEP 192:FRUjHi7kGPv7kF+pUPRpqQJx9HHsb+WNyM27cMz2dZN7wkwcVyIsnAUgE:FRUj4H4oEX31wyr2l0YE
TLSH
T13A52C66BAA152DBB6CDBD229FD22BB53D3F5102261941E84EBFCCA1C10E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7b3acc386a87fc23e2785c59206c3f79aa64b72ab211013437e365ecd475106f
MD5 0631fdd2a89ca6f531ec2ac13e0f27e1
SHA1 9fcee738b2f030b2ac04fc2de267c408e94380de
SHA512 54f0bde75907c2238e20cc9f6f42aa0e1fb253450de056a00220597fd5d8c482cee26555032630476b23cc28d1062074d6fc1a74a8f3dfa59ddf0c99632907af
TLSH
T1FFB01280841161A1C40602F41192249871559F10960E270567E0B9229C295518116070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c493.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c493.TMP
Size 96B
SHA256 87d3bfd02ed7dcfcee8ced20024bd16daa0bce2a3bb0d76b4916ac0131926646
MD5 18e50c395050bfd0b58063147de4efe6
SHA1 dce39c12b5809a2b3a97921a9c74f45909b9246c
SHA512 7a8d55ba420b58947e65f39d197bcb761fa3de9be48208f2a01582c5cbd23df42aab55e2bdb9c88ba63f897a118379815ee9eb2148dceb081f3e728c7c48b8e2
TLSH
T14CB02220C0032222C00323B02E88C0C83230CF30C3032202C2E00B33CC382200028C28
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 744b83507cb972e66090a5287b3a65d55ecb434ce82676000999dd1e8728fbc2
MD5 41cb9921a6ed3398913d085f1a087d53
SHA1 42f195c5afaa37c8555262db0cdeca75b9a186a0
SHA512 b9d2e24f7f3a8bb0446d8d09786ddaee6cfa373abec47f16e949f1e4f52156940b4b8658af8c06eed14d9fda8e7ad03daaffffa7d50fb1ebffbf3825c4342818
SSDEEP 3072:JDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:J6m7Rkm1tYpBeh2BAoM
TLSH
T1D1C3023B5D75AC3758B9BB1EB08E0A1F1EF14AA7D930DA92C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bda37b008e3518e01069e6f63de631af0740d659e7e4c8a0a0bf1a0165503d03
MD5 e6673c892d4271660a8977229531c089
SHA1 fcc81486e7f1bff652bcb2f556c7b3c63fe1015a
SHA512 52a56ceb2814cc708f4b6a248934e1de723785a93a5ea39854524716bb19a6a55d5234d21cbff10969e85ef86eb6f37163e98437ef58b7769c3450e31cd0b916
SSDEEP 3072:S6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Sdm7Rkm1tYpBeh2BAoM
TLSH
T1E8C312275E75EC3758B9B75EB04E0B1F1EF14AA7D820DA92C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 10da1822710c1b67e1b9ec64c6ffb8b3a4af3295a1f3cbe7b15651d4e55d00a4
MD5 d299280dde8ea20c7492a1da2b08cf09
SHA1 d32b5737b82f480c3a24afeec25e9a8ac964e678
SHA512 c51dfb231084d873e8b13a8d7dd12a0cfd5faaede6a3185f5f7a008ef33eb3f507fb70902db62376f63fcc6edc23015fb81f395b972715d119ee4a0ac6bb019c
SSDEEP 3072:NDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:N6m7Rkm1tYpBeh2BAoM
TLSH
T160C3023B5D75AC3758B9BB1EB08E0A1F1EF14AA7D920DA92C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a95b5479236d5ea48103801d6f8ad310aac9e0fcec7b05106f0b1655d08fe215
MD5 3630b31c8531ea369755bdb3b6de37c2
SHA1 11cef0e3398adf53cb7229b1a3236e1f05fea800
SHA512 67ed5a45aa893a226e63f4852b201998727d4cb7877e233ecf7145080b5ec6d1dff87388082b460f250e43e272bb6fb19134cd6cd026310441b7e4c3f18e550b
SSDEEP 3072:/2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Bm7Rkm1tYpBeh2BAoM
TLSH
T18CC312275E75EC375878BB4EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e98d7b45cb5934dec8cb6d97504b159e867fb67b2b47516345aa12c6d0100076
MD5 6b0fe0aa43d45c5b91895cb02bd899ae
SHA1 6b869e4c6a46ae5c770c65bea736e6a67f444198
SHA512 416351441313474af962e3c37d30e02401d0202e0e98c780631b1a0258c2fde9dd9634200f4d553b851ae5a400a0ce6d2a1f26b58a91d2f1330463dbf7b7dc33
SSDEEP 3072:J6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Jdm7Rkm1tYpBeh2BAoM
TLSH
T131C312275E75EC3758B9BB5EB04E0B1F1EF14AA7D820DA92C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download