hxxps://4ebmglzab[.]cc[.]rs6[.]net/tn[.]jsp?f=001dZViE0Wx1D1zCvCDfyGwc_KkZVe7NgntOd3aXkSjlT-Eg-QtO1kqd8BLFUOPTYZScZF6MBk7uUWOpN68BxBpjiHPKhe7k5smtwwwzHSLyXBbeh9HFS5ezTw2Fk8N8MtdXIMU6tBBUkr7cJAO2ErbHExTTO-bfc_v5a30-VbYj85ogeWavS9XMfRsBrJGfI8WdJtukrVbse7dr7AEqVwaOrPh6x6kO-1TV2d4MtyfKwyNZ8QlLUsSfZTmijSGDPY7&c=TSamwNQHen2WGWWUKn_LP3K4fDTcqebBk5MszyQMCtthzoBv7v8FpA==&ch=DimZq343-2W1TuWL7hexJbMc1y2PuPlKe3gk1u57B9OWNFWzIGwnDQ==

Analysis

user interaction
yes
max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://4ebmglzab.cc.rs6.net/tn.jsp?f=001dZViE0Wx1D1zCvCDfyGwc_KkZVe7NgntOd3aXkSjlT-Eg-QtO1kqd8BLFUOPTYZScZF6MBk7uUWOpN68BxBpjiHPKhe7k5smtwwwzHSLyXBbeh9HFS5ezTw2Fk8N8MtdXIMU6tBBUkr7cJAO2ErbHExTTO-bfc_v5a30-VbYj85ogeWavS9XMfRsBrJGfI8WdJtukrVbse7dr7AEqVwaOrPh6x6kO-1TV2d4MtyfKwyNZ8QlLUsSfZTmijSGDPY7&c=TSamwNQHen2WGWWUKn_LP3K4fDTcqebBk5MszyQMCtthzoBv7v8FpA==&ch=DimZq343-2W1TuWL7hexJbMc1y2PuPlKe3gk1u57B9OWNFWzIGwnDQ==
Sample260724-lbxmrawthy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293585436897536"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe
Token: SeShutdownPrivilege	3816	chrome.exe
Token: SeCreatePagefilePrivilege	3816	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3348	3816	chrome.exe	84
PID 3816 wrote to memory of 1828	3816	chrome.exe	85
PID 3816 wrote to memory of 1828	3816	chrome.exe	85
PID 3816 wrote to memory of 5052	3816	chrome.exe	86
PID 3816 wrote to memory of 5036	3816	chrome.exe	87
PID 3816 wrote to memory of 5036	3816	chrome.exe	87
PID 3816 wrote to memory of 5064	3816	chrome.exe	88
PID 3816 wrote to memory of 4280	3816	chrome.exe	89
PID 3816 wrote to memory of 5064	3816	chrome.exe	88
PID 3816 wrote to memory of 4280	3816	chrome.exe	89
PID 3816 wrote to memory of 2472	3816	chrome.exe	91
PID 3816 wrote to memory of 2472	3816	chrome.exe	91
PID 3816 wrote to memory of 1128	3816	chrome.exe	94
PID 3816 wrote to memory of 1128	3816	chrome.exe	94
PID 3816 wrote to memory of 1124	3816	chrome.exe	95
PID 3816 wrote to memory of 1124	3816	chrome.exe	95
PID 3816 wrote to memory of 3504	3816	chrome.exe	96
PID 3816 wrote to memory of 3504	3816	chrome.exe	96
PID 3816 wrote to memory of 1660	3816	chrome.exe	99
PID 3816 wrote to memory of 2968	3816	chrome.exe	110
PID 3816 wrote to memory of 1672	3816	chrome.exe	111
PID 3816 wrote to memory of 2952	3816	chrome.exe	112
PID 3816 wrote to memory of 4128	3816	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://4ebmglzab.cc.rs6.net/tn.jsp?f=001dZViE0Wx1D1zCvCDfyGwc_KkZVe7NgntOd3aXkSjlT-Eg-QtO1kqd8BLFUOPTYZScZF6MBk7uUWOpN68BxBpjiHPKhe7k5smtwwwzHSLyXBbeh9HFS5ezTw2Fk8N8MtdXIMU6tBBUkr7cJAO2ErbHExTTO-bfc_v5a30-VbYj85ogeWavS9XMfRsBrJGfI8WdJtukrVbse7dr7AEqVwaOrPh6x6kO-1TV2d4MtyfKwyNZ8QlLUsSfZTmijSGDPY7&c=TSamwNQHen2WGWWUKn_LP3K4fDTcqebBk5MszyQMCtthzoBv7v8FpA==&ch=DimZq343-2W1TuWL7hexJbMc1y2PuPlKe3gk1u57B9OWNFWzIGwnDQ==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ff871f3c728,0x7ff871f3c734,0x7ff871f3c740
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,11560402343034033973,9727114156617577677,262144 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,10881943920376328692,14061544763061935176,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,719166682361062527,6925085590282757358,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,3480877023494087618,2835445790848031020,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10790097506570743023,13390786228275756696,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,1648856745155241600,1276167896532283118,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,8805391952566364238,10058524306173634073,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3956,i,12452219904483615945,16581816270882843735,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5004,i,14120562361208048771,1622775626174266016,2097152 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,7958897721696534783,18005988126610132383,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,5604237821184971187,13205761858878740934,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,1870277827974821057,5860435222280106058,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,30536444231922037,11515496964459551145,524288 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5856,i,18240760279254070071,11281121554061840387,262144 --field-trial-handle=1976,i,17446729429531991796,10659491603982499075,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3a0a58111d3c5da22d9f34e9813d906c3712419c52c2dc0af816dd004b37155a
MD5 7f51f6899b6ac59cf283e7f8deb706f7
SHA1 df206a5e2b3f585116911f23a291327cbdc5da2f
SHA512 281de4fc1cae1a94d81bf9fec501b9c2761d64866b85359346d830c28e2fa13484125cd856b7c71352ce62fd08d5920ad162d7aeb2698c5cbcfcca11244a0510
TLSH
T167E02BAAC821AD2708FE4B196415874AE750139B3B81554F763D5108CFB062646C6CAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 18ff630968737aa560c3a257fa07966858a9b4af5cfc9491b15567ede13de340
MD5 4f729d661a66cbfe778e9f60f49dd76e
SHA1 012a40e540944cf9ff7138498ae941c81c5209f5
SHA512 934cc9a33ad20cb32ea0d6d049d7734e5b769eb13458ebf93b6c1fbf5d309c613c75fbbb2952781f02365228a5e6c563e2916e37a2fe52cc2e8193a241135852
TLSH
T1E6C0120224C0109FCFB0003A5B523E3333020A9802212303B6D8088017036E1A74DF42
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fddd5482bc1707736250a4fbfa25b7000c3fbf623a81248770a445a434db574a
MD5 210bb7d6157030bbac26785745ab050a
SHA1 e3aa2a45532a3e2156edee4ab2af25fc3b7b5e7a
SHA512 96f3413e5e288e528be902ea42e2a43c988bf12e6b0fcc82d0e8b814954cddeefdaec8e98be0c11dd683213b421441fe78811f073637ba5c70c0c4b8c079b4e2
TLSH
T11B418CF793F4957E8A1192F4EA156F1FCE690924031C7CA688E46E2B43E2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 64b228331607670372ba1659ecda73c475e58ca73f1e728c30bef53a0f601361
MD5 535c6bb4e0070bab2bc56e15d1c37278
SHA1 6fa13346339ba5eadd9fbec1a80fdf967a93b71e
SHA512 5e6cca66ed79778fa444c713024e5bfbac2564442d136a78f7fe87b4d1afdce22186f6334a684b30ebce8f348ed39b0b61289d013ea139f5c5f6e9207d908372
SSDEEP 192:KRDlEOjKq4iMv7spAPRp22gR9wHsb+WNn7R9E4zM/2y7kzr3avxwHVyIsnAUgE:KRDlRj6iYYUX/sKwl9Z4/2yIz7auE
TLSH
T1C542E82EB904293B6DDBD21AF922B727D7F5106261D42E94E6FCCA1C15EB9CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6950379c7e87a003884d854468fe1d908aec3ff6d10d45ae2ec4ade081a99eff
MD5 09cf36e6672bb8d852406391f38bd956
SHA1 488103cb61859ecb1a20cb137a91279523acaf4f
SHA512 f9715792c092b05a7dde2d5ecc1df608a5aae8b0d961bd6ccd1f14b2660913a34332c8d574355913aba9fa6080dddb657f9bc065c0b28f011cb75c3cf7cbcd3a
SSDEEP 192:KRDl/TMq4gv7spAPRp22gR9wHsb+WNn7R9E4zM/2y7kzr3avxwHVyIsnAUgE:KRDl7c8YUX/sKwl9Z4/2yIz7auE
TLSH
T14C42F76EF904693B5DCBD21AF9227723D7F1106161D42E94E6FCCA1C15EB9CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5c5a2b16d5fa1ea9cbc540fb644f054f5356f18dbeae196a83437a3523c7311a
MD5 ca20f4089fcb11e104df2bd6d3cdf5d9
SHA1 277c58667b872ec1effbc118a0c5bd78ba0a1603
SHA512 d4e7e2a48bf55051fb22263370567980dc8af31fd91e5d3e3012640398b40abf8b17a477cd7d643599285f57084a351b56c3acb773852f403b1ca3b320afa062
SSDEEP 192:KRDlEOjKq4ibv7spR9PRpUs2gR9wHsb+WNn7R9E4zM/2ybkzr3avxwrVyIsnAUgE:KRDlRj6ijYvlXURsKwl9Z4/2yoz7aEE
TLSH
T1B452E82EB904293B5CDBD61AF912BB27D7F510A261942E94E6FCCA1C15EB9CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 875eb1f10425299f1e514b00421c0d1305a4bf8cb0a118b6e72d8c252a5e4282
MD5 6b0eda6aa35ec14018a12e9a0cf88956
SHA1 bf6bb519259f97241cc31ef44cfdd499e6bc8e46
SHA512 c8d97a0e5530368b5705e60044e244186321fc68518e643e182c9875f94caab1119619426e5301a5c91679032bde812d9117838f93415867fe936bc128d2c44b
SSDEEP 192:KRDl/TMq40v7spAPRp22gR9wHsb+WNn7R9E4zM/2yDkzr3avxwTVyIsnAUge:KRDl7cwYUX/sKwl9Z4/2yAz7ame
TLSH
T11842F72EF914693B5DCBD22AF9227723D7F5106162D42E94E6FCC91C15EB9CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4ba86c6d2d844ceda8b469605c307f490cbc8de66205481d566521d6cfca2c01
MD5 70039abe4081c9e2a132c4258c72ba31
SHA1 fe9c35c48bd98eb7b14c602a84a1184b2eb90700
SHA512 bd8f3e1f6a4b458429321544118cd7729f45d80a578042acfa9c91b99adda229d440bb33a14b5c3cd576932d7580fe639122125e792ae247c407c75be5b2ae8a
TLSH
T139B0120080015305C09202B06383548971145F10960A170543F06962C8253B1C128A50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b0ec.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b0ec.TMP
Size 96B
SHA256 c910695fbd50f89fdebf8fc43eba4e8e672c082801d47bcabc10530cda3d9ef9
MD5 164c48d8220ccc2f8836d65bbbb1951a
SHA1 18fe737c9eaffc0bfa5708a549dd3edff302876f
SHA512 03e2a24a905608fd549453872d4faf56f774260d272eaa75ee741c87bb2578dc6bed0f29237ef16057c7ee5dba07539736d4a8425d913e50cfd921b99d4000d4
TLSH
T13EB00255D102B626C49307F12B95B5D8B1A0DF27C6072212E2F01E67FCA5776CA25A61
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ad58c0bbdd26bce59212ecc03ad86e54ed6f523417a0d7bfe0f37e3053f75876
MD5 ee19e50a5e9e12ccc7ec39e7504387cc
SHA1 abc41736dc394955f7dc9bfee0f5924e2193c37e
SHA512 b4abf822577da73ef46ac116cafa799b45f411c4b2726b5982b76ee49ed67d2f0627ee7e72c0947eb41e00b44582b5017fe8cad0600f1f6abfb0888f5a61532b
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:im7Rkm1tYpBeh2BAoK
TLSH
T170C3123B5D65E83759B5BB5EB08E0A1F1EF149A7D920DE92C8D85B0833E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3161fd9f26a73c2e6508b12b24a553451733ca32654f6613380aa3b1893776a3
MD5 70a775ccad81d4f48fe73ef8899af871
SHA1 06501915750c78134689c94ef7c811fc1cdd12cd
SHA512 d112ea66092ad7c240d0f01076af8f45d609f89f3b571c93617da881f2f88f6f952ea98890f898f3ae539084dfd2ad924e44d43a8524301ebb668c5be38a8511
SSDEEP 3072:2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Bm7Rkm1tYpBeh2BAoK
TLSH
T1AAC3123B5D75A83759B9BB0EB08E0A1F1EF249A3D920DE86C8D85E0433E96CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bbba14449b609802d79bd05d284b3d0fba5580b26b1cfabd873aa60cfec780a6
MD5 8f6326c105bd1e52f69b5d7feeee6faa
SHA1 0d4a5ae6b0ee8f7c2f5ee53613257e1bd443ceab
SHA512 be1a411b9d11bea89007a59f97a4eb52d32a6669ba269b16a5c1247197ea5a2913323bbdcbd63d2483072ca6821270304a3329c2ec00b15c6f38deef34b9f789
SSDEEP 3072:2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Bm7Rkm1tYpBeh2BAoK
TLSH
T132C3123B5D65E8779979BB0EB08E0B1F1EF149A2D920DE92C8D85B0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 939c2c1adf9e8cf966958ba685b99cdf200237b6227ab5b7100686b20da6c4bd
MD5 154993c12bcccdb979b35d1e7d765da8
SHA1 99ddd15988fdc52e9aa6cd43f577d893c3346d59
SHA512 68eb99319ca7043f96bbbb66d974840d406b636a7caf7b994e0f5cfc1da58e831f4f5b038ff2d4d486fb46a5012f9c8f3d0921b4a0c053a1171c57d4906ed850
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Pm7Rkm1tYpBeh2BAoK
TLSH
T127C3123B5D65F83759B5BB5EB08E0A1F1EF149A7D920DE92C8D85B0833E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download