hxxps://www3[.]thunaitech[.]com/r/c3e0ddd8-90e8-5494-951f-22e63f889966

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www3.thunaitech.com/r/c3e0ddd8-90e8-5494-951f-22e63f889966
Sample260723-smfa6sbf79

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3980	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292932716507346"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{7F232F63-530C-4AA3-9330-0EB89929C0BB}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
2056	chrome.exe
2056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe
4256	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4400	4256	chrome.exe	86
PID 4256 wrote to memory of 3992	4256	chrome.exe	87
PID 4256 wrote to memory of 3980	4256	chrome.exe	88
PID 4256 wrote to memory of 3992	4256	chrome.exe	87
PID 4256 wrote to memory of 1128	4256	chrome.exe	89
PID 4256 wrote to memory of 1128	4256	chrome.exe	89
PID 4256 wrote to memory of 4616	4256	chrome.exe	91
PID 4256 wrote to memory of 1208	4256	chrome.exe	92
PID 4256 wrote to memory of 4616	4256	chrome.exe	91
PID 4256 wrote to memory of 1208	4256	chrome.exe	92
PID 4256 wrote to memory of 1776	4256	chrome.exe	93
PID 4256 wrote to memory of 1776	4256	chrome.exe	93
PID 4256 wrote to memory of 4660	4256	chrome.exe	97
PID 4256 wrote to memory of 4056	4256	chrome.exe	103
PID 4256 wrote to memory of 4056	4256	chrome.exe	103
PID 4256 wrote to memory of 4856	4256	chrome.exe	104
PID 4256 wrote to memory of 4856	4256	chrome.exe	104
PID 4256 wrote to memory of 4324	4256	chrome.exe	106
PID 4256 wrote to memory of 2764	4256	chrome.exe	107
PID 4256 wrote to memory of 4124	4256	chrome.exe	108
PID 4256 wrote to memory of 812	4256	chrome.exe	110
PID 4256 wrote to memory of 3380	4256	chrome.exe	109
PID 4256 wrote to memory of 3380	4256	chrome.exe	109
PID 4256 wrote to memory of 2924	4256	chrome.exe	111
PID 4256 wrote to memory of 2924	4256	chrome.exe	111
PID 4256 wrote to memory of 2056	4256	chrome.exe	113
PID 4256 wrote to memory of 176	4256	chrome.exe	114
PID 4256 wrote to memory of 176	4256	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www3.thunaitech.com/r/c3e0ddd8-90e8-5494-951f-22e63f889966
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ff80d50c728,0x7ff80d50c734,0x7ff80d50c740
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,14007020331292941473,9567246224357960777,262144 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,141404792539629168,14277589242552965778,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,1733002272489739684,3885734419682089665,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,3351520705937805343,6445438815015255634,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,3177147333640038228,8916184222052109801,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,5779588587579080749,17734660680042663189,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,17846658908824207519,3457784823821516331,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,2977964887251899153,11698107043465872786,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3920,i,15747066304605506829,11695557203089643053,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,17530120393529982293,6136848691946305703,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3392,i,17317568247208113916,2974019857330071618,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,4861464997654326916,14115695948295152904,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,16422954106212735435,573796351504310958,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,6660584209518624771,17258617035742105985,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  - Modifies registry class
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5804,i,16966895651983107003,15760882719364066580,2097152 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3244,i,16663093822738404581,2599488744624789099,262144 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,16056764851390032159,15175316497822348480,524288 --field-trial-handle=2032,i,14692891305381737362,7205871792937280927,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3488a194762e2f62ecfac988fbab9ed3681a0b7a0ad3425cb5bbde02ca254437
MD5 f8801d1db4c8fa395b6b9b92c143d9a9
SHA1 e6228b57a289c0539c5bd466d6d08cea0b0021ca
SHA512 79b195b2d3b342c8e6b284a349517cbd0d8bff97b8d5635098595009ff326aac700facd272e4e268fd1a5d6d3d2e0f53bc52ac9a71a242dd3d9e57dcbf316461
TLSH
T1CFE02B69C962DC6B14F90718B0501742D755139B2A81C94F7A3C811CCFB56378A85D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 604a626ca5e8b67df812ccb6d16fe91384015ef26839fa7355aebed9c4d139d3
MD5 803de619886425b90877167577991438
SHA1 30570c91f952c6f174d2d51eea1173441ec5eedb
SHA512 9733957352336c95094d950ba75b4e890b93b1305bfefebf1e73848c647b2e7ea061db7f0d2548d05d5cb3bd069683b5c4cfbc811d4d86078973b9961709b081
TLSH
T13411A59832E07047EF580C7E27D43F407E270DF3C3075B26A2A105B4A93BBD064725AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 25b7c998c687ad93ed040c338f64bcdf3dc14a50945824b402e7cbdf325b1f97
MD5 581924fe7e754ce8ddf4f1029b8d4d7f
SHA1 04d01182af7139c9531651d7951e9ed896b8dfd0
SHA512 8d28ff348b7615113970fa2f376ca25e4fb6ede82f84b8b6c4874402e7a0e5ef4f68d63f25d3a20dc48a16a775a49033a91ad567beebd85e2ec3b2b85eb65d43
SSDEEP 192:DOauOkOXOlQOUOROUOjOcODODOCOxO/aIaEdQTNCOYNOGOlrOGuO8OuQOGzKO4O6:DHuj8IQngFCFuCXiyaIaEdQTNCdNTkpY
TLSH
T156429CB3C3E5892D881519F09A187D1BDE590625972C3D3A89F4EE4B9BE24B3D30274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 71d19cc7f611b8c8c991b14a5f183e8acd25379e687c9c99973fab89c6907cd6
MD5 e38c2049a9f0ed38eb5e2f4d47a42891
SHA1 901d26dc21db0f4f7f67d291d26ce8b26928aec4
SHA512 563a584643caa235f1b91f6360ff9d45061b48d780858376ba3e5c9992236df2035f190457afe6681adf689cecd0b463491762cb2b2797a72f69d7e04388f266
SSDEEP 384:DHuj8IQngFCFuCXiKZaIaEdQTNC8Tkpu33Qp+BnP8HcodzARb40DyYpVREP/VPo6:zTiOf
TLSH
T17242ADB3C3E5892D881519F0AB187D1ADE590525972C3D3A89F4EE4B9BE24B3D30274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d919b1011ed9ebd30fe3fb69b402b8160fb17fbda0b2395141be7db49e69b5ba
MD5 eeb58ae6e154df9d61bde804e051dc93
SHA1 556d672136f518666120356ed7f5b18e28a405af
SHA512 f66dd7da1d34e2692c3eccf82368ad12fd0e118b7df7cb786c039949f66196809ac120800e356a889bfc7e7a26fa02a50d3c5dd78ab0c140b1bbe3e3e4a39a32
SSDEEP 192:IRsDkakQHMz8v7jpfPRpSdGu9+Hsb+WNnaBMQf27Z2hD2yTkwkVyIsnAUgE:IRsD9kzzovRXk8wOj212hiyTAE
TLSH
T14752C62EAA50693BACDEC225F9557723D7F6202265E11E84E7FCCA2C15D75CC322301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 284af61fc879b10d907ae632a4dc42b58bb5fc3b1cfedbd9a64ff035a451d3f3
MD5 1311a67f9182629822b1bc1dc03e263a
SHA1 9623b071ae124353194498d92ab95f4f68b478de
SHA512 4e277def17d8508cd5e6c8dfaad019b6b9c88665d921843103e589ae2f1929cce9ffd290eab388e85909ae073b9177426ac5eda6c62117d6516ec2c02c2e3f8d
SSDEEP 192:IRsDtakQHMzhyv7jpAPRp2dGu9+Hsb+WNnaBMQf2AZ2hD2yTkw6VyIsnAUgE:IRsDskzzhevUXQ8wOj2A2hiyTaE
TLSH
T14842B52EAA50693BACDEC225F9557723D7F6202265D11E84E7FCCA2C15E75CC322311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5934dc1eebb819d9005ed77098d7569d060dabb69cbef564956b801eb9df00d8
MD5 4c3e336bc16aafb56a9e2285c56b0bae
SHA1 826182da952d475c0f8af22a1508ceff4260aea0
SHA512 aab90695750407c6ae1580f990b173c2efa3f366754d388168fcb8769472777566dd7052ddf22b2bc4eed3114994e85afaa71f32476a3cd9ed0b1f9834e8342f
SSDEEP 192:IRsDtakQHMzKv7jpAPRp2dGu9+Hsb+WNnaBMQf2AZ2hD2yTkw6VyIsnAUgE:IRsDskzzGvUXQ8wOj2A2hiyTaE
TLSH
T10642B52EAA50693BACDEC225F9557723D7F6202265D11E84E7FCCA2C15E75CC322311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1a716ca55ffc06e82749b73463f2bab499da31a62f09e1d8a401e27c0d2d155
MD5 6d3e3e04e1859bba818df7d1e90a4f7b
SHA1 079c9b09814e964c3d68684e54f41cdf30272cf5
SHA512 d0bf9d5ff5b7e91973a53eb2538937e04c0584153c9de614e5ce874173a2e1522ce1b1b737a5cc9eb7a33ef3313f9a42c96f6605a8fea8dbda3f19f7c219b8a2
SSDEEP 192:IRsDtakQHMzNv70pAPRp2dj9+Hsb+WNnaBPuZ2hD2yTkwcVyIsnAUge:IRsDskzztgUX68wOPm2hiyTYe
TLSH
T18242A42EAA50693BACDEC229FD657713D7F6202165A52E84E7FC8A2C05D75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fbe17d6831117349021370ce65f2484e8a444fd6ae5f57a95d96fdd5e8edc08b
MD5 d66666b5b399f928726709221366f4a6
SHA1 299a1f7338be6f4f822c8be616793fc7e7bb88ec
SHA512 0e8f9f016e2748f9ac4ec2f30efe05a08610d521042bea1b11781f40de1d3d37c0fed2134051ec3e9bebeebbe7157cb092dc94e5deeebfb35ce51dd15c4c8837
TLSH
T101B0125088419191C44302B01957148971386F129A0A274953E07D63C8369628414190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ea9a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ea9a.TMP
Size 96B
SHA256 08885af6dddbdd3c7be4cf852c4f780c82c055e1c80ad278f04d2b0ea3c5d228
MD5 7efc644f6676d0e06037be4ac89346e9
SHA1 578b57e5ff77e96a8bbfcd5a68478839fa2cda32
SHA512 a3f2847fdb988213e23129d356a9e75222d48296cdb3c4fc8a8b9e7187dd9775fed18c313d694da5f596d64b9805e74583de655120720ef0b1a79bf5831bfe85
TLSH
T18BB02202CA822322C00203B0208882CC3028EF23C203030282E00E22ECBA23A0C2FA30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3dedfeda2140f3ea49f220aa929633345c2bda9370fe5a86a3f3bb85a82cbd4b
MD5 db65108f563f04ddeae67409fa3381b3
SHA1 69e53a5c797f68253f84f44c454a12cad9a6ecbd
SHA512 a2dca9f154e08af90f1d951006c0e5db6c4c8a30cc0971eb4b94bdd4220c7091bf84f5879dd8e8ccf37c006395346b91f79bc47309946980f0baa580da88b740
SSDEEP 1536:sVryD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:cVqfd7NtZL8cHQRZEQ6Sps3
TLSH
T112C30237EBC21E335DD2DF60B5130E9B53F644AAD034D305EE6D3BAB6883555A4824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e3206147c9e8d09795d0abd556b5366a65f663df2c389de442367242bec39b8b
MD5 4c3da86a29e9cecc502554ad2a20a474
SHA1 4ec9cadd2f4d86ac91118ed16c8e5e1cc2e861c2
SHA512 99bfddd2c3bc458bab7b6f7e09c24e9ef514d81b21d98fc3175e3b1c75134889e882b9a01a5da3cbc58a5c0dd1f1e999ba81506764405009b766ea6ccee8ebc8
SSDEEP 1536:kVryD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:UVqfd7NtZL8cHQRZEQ6Sps3
TLSH
T12AC30237EBC21E339DD2DF64B5130E9B53F644AAD034C305EE6D3BAB6883555A4824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 18ea73e4a2778bc80cca91b711ab8859f041d49559021988d1f59db9f597fbe8
MD5 0677ac3c48afe0b43a7948d1470e0d37
SHA1 366e0b914cef3f98e7ce6bb6f8a231f234cc62fa
SHA512 fbb17a60bc6679d3433654d3a5a6d437e6f584c8ceaae4641872a0e607fe723ee733daa05eb0965ec1cbc9f3a552173a3d97c4a3cf88316b74f7257e6883cee7
SSDEEP 1536:bJLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:jqfd7NtZL8cHQRZEQ6Sps3
TLSH
T13FC30237ABC21F339D92CB64B9130FDA67B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a4bd43c857dad45f3235023b86acf97dca5a14f9e7f305f93e233e0f3c406626
MD5 9cf2ed54e3afbc1fbeff2ede23ff16bb
SHA1 2f66cc397b6060f3af62fae2dd3a3ac366e25abe
SHA512 c2dcc486597f87dbc1ed1305729f29cfb5622de92b0e6799cb2368eb42e5a8c35a32719de1f048f182284d05ac24e28775c60b3f924ec6e1c92d710356819383
SSDEEP 1536:sKnyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:bpqfd7NtZL8cHQRZEQ6Sps3
TLSH
T171C30237EBC21E339DD3CB74B9130FD7A7B644A99034D301AAAD37EB6883591694246C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 25f69fafb63d97cc3520d0f47651818432c6da2c418aac0ab476a956de2edd80
MD5 f50290187422015835c2bcd52af95eb6
SHA1 b92c2ac428b55d6fa91cc5b62dfca83a20eb2ba7
SHA512 edda2f6c2c4dc58f5322e7151ed848fe3cf0911e5853ee6a32a738ff813f3c74327cac9c4e9fe3651bff155bbc14fab374d482ef6ef8265ffde250bd4ddd6392
SSDEEP 1536:RKnyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:opqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1B8C30237EBC21E339ED3CB64B9130FD797B644A99034D301AAAD37EB688359165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download