hxxps://537123OW[.]wiggin[.]com/1445910/pos/app/ms3tflzensl6hcmf0/tasks/tasks-list

Analysis

max time kernel
299s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://537123OW.wiggin.com/1445910/pos/app/ms3tflzensl6hcmf0/tasks/tasks-list
Sample260728-c2575sxtew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296797241969293"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
3196	chrome.exe
3196	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1088	1212	chrome.exe	85
PID 1212 wrote to memory of 5068	1212	chrome.exe	86
PID 1212 wrote to memory of 2420	1212	chrome.exe	87
PID 1212 wrote to memory of 5068	1212	chrome.exe	86
PID 1212 wrote to memory of 3000	1212	chrome.exe	89
PID 1212 wrote to memory of 3000	1212	chrome.exe	89
PID 1212 wrote to memory of 1700	1212	chrome.exe	91
PID 1212 wrote to memory of 1700	1212	chrome.exe	91
PID 1212 wrote to memory of 788	1212	chrome.exe	90
PID 1212 wrote to memory of 788	1212	chrome.exe	90
PID 1212 wrote to memory of 2812	1212	chrome.exe	92
PID 1212 wrote to memory of 2812	1212	chrome.exe	92
PID 1212 wrote to memory of 3128	1212	chrome.exe	93
PID 1212 wrote to memory of 3128	1212	chrome.exe	93
PID 1212 wrote to memory of 1904	1212	chrome.exe	95
PID 1212 wrote to memory of 1904	1212	chrome.exe	95
PID 1212 wrote to memory of 728	1212	chrome.exe	98
PID 1212 wrote to memory of 2616	1212	chrome.exe	107
PID 1212 wrote to memory of 2616	1212	chrome.exe	107
PID 1212 wrote to memory of 4464	1212	chrome.exe	111
PID 1212 wrote to memory of 3500	1212	chrome.exe	112
PID 1212 wrote to memory of 732	1212	chrome.exe	113
PID 1212 wrote to memory of 4212	1212	chrome.exe	114
PID 1212 wrote to memory of 4212	1212	chrome.exe	114
PID 1212 wrote to memory of 1732	1212	chrome.exe	117
PID 1212 wrote to memory of 1732	1212	chrome.exe	117
PID 1212 wrote to memory of 3196	1212	chrome.exe	122
PID 1212 wrote to memory of 404	1212	chrome.exe	129
PID 1212 wrote to memory of 404	1212	chrome.exe	129

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://537123OW.wiggin.com/1445910/pos/app/ms3tflzensl6hcmf0/tasks/tasks-list
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf4d0c728,0x7ffbf4d0c734,0x7ffbf4d0c740
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,7358611726767920626,9626104072815531353,262144 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,12008943084326314918,12077391156744339454,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17449055589880761553,385988678762377456,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,13421691847460639010,13177457017874639451,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,9838046596233145030,2802441793048780183,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,4522377780352599873,8547250768567022733,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,130830120044754922,9746695626039907033,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3188,i,10628602868285952845,13052434450213899471,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7217351091092495189,15129551107889383361,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5760,i,9984559280899430133,13816780779533394219,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,12462796661565076648,9301614320165704014,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,5748043151262046070,2945416221331864096,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3188,i,12657666429987279625,9109692545667175940,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5920,i,6045844870481374092,2404948526383896777,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=728,i,696330304364850135,6878716271723247928,2097152 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6008,i,17339103562436710115,5395198300831036616,262144 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,4402687136744587946,1095296136001770710,524288 --field-trial-handle=2060,i,3885854049411149406,13787758863975667221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1496 /prefetch:8
  2⤵
  PID:404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9ffc9d0ae6c9085429059c7f202bd38570fa0ad9e054366cfcc03b5304ae4425
MD5 26ae82cef1510102a747e792784570cf
SHA1 515ccf49277500dd6534d209939e5ef935ddbd72
SHA512 7eee38cd739f85e8d09c67d79be0c6cb896b7ad0f23a0c50f24277565712e5c64d3ad55c8d9bc49ba8d6e354bc9baacdb7602ab0ca31b79041fdb985bbd65484
TLSH
T1ABE02BADCC61EC3708FD1B2860101745E75013667F91C80F7B3D820C8FB5A3A856692C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7e9919e2fa35a0191fa58c8b30d9639973c0e4d24b83c5406c19021827cc850b
MD5 bff7c209a47504b6d872472dbbb618b8
SHA1 57579e00681838c2b43221f5a98152b3526c01e2
SHA512 2cdad256a3a5e72487bf18d2f1da83fe5dd097c4668ba573490c673714c22639bf32b2409c6207db8015f46e6aa2aa910723be25949e2bebcf77ec7af1cdea89
TLSH
T1F6419DF793F4997E8A1192F4EA156E1FCE690524031C3CA689D4AE1B43F2972D14478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a2282b971d02c15e492bf432a136557baf2c2758a17efa11d5dceedf24662b0e
MD5 8b6325f4ad940f149667fc930b13e218
SHA1 02a1fdab4d3838ea7fe62d438a19d392e152d96e
SHA512 d312b44355562685f3d9d2060a315fba77df8821b513740844bc6ecfedb863452d63e3f90df40c876bba1c9d63d7e3204c5902c17b27c5c0356d68d842573d59
SSDEEP 192:4Rm5/4seqJcv7cpAPRp2qE+9BHsb+WNn0gP9tskwQaWtVyIsnAUge:4Rm5QsDIwUXl3rwnPwwaW7e
TLSH
T13942F82EAE24257B5DDBD229F9257B53E7F5102265902EC4E6FC8A2C14E76CC331701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d9479b3fb6313c13198da9b2170f7964b626c0854a86ef37405f3e005e2a82fe
MD5 96d66bdb16038bbbf86af4882da30801
SHA1 23f31703906f146151132c980d6e445c003e43bb
SHA512 71e9266c0d043a714b18806eeae0f70de473f8751c28f35dd6a5ab8889db8f79b09a0fed068b8aea6d2195906425c32aed154c1d50bc11e753f75c99e40fd91a
SSDEEP 192:4Rm51pEqJcv7cp9PRphC+9BHsb+WNn0gPntskwQaXtVyIsnAUgE:4Rm5rJIwDXfrwnPKwaX7E
TLSH
T13652D72FAD20657B5DDAD229F9257B53E7F5202265902EC8E6FC8A2C14E76CC3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef597dcacebdc08277669fd39f75d7392d986d0618b1733fbae1333ca8e96061
MD5 b9ba706602e3c0a02bcdc52100b2f410
SHA1 066599734a4b06362afd655ce9cbba05ef778026
SHA512 a742444d55f15fdf9434a785fc6d64752972b336eba6e98d610ff03a6271f4fb0976e07dc667007d1d53f928b21c9bc5eed730a2f4e0f818ea0cc10255e9036d
SSDEEP 192:4Rm5BpEqJcv7cpAPRp2qE+9BHsb+WNn0gPitskwQajtVyIsnAUgE:4Rm5vJIwUXl3rwnP5waj7E
TLSH
T1FD42E82EAD2064BB5DDBD229F9257B53E7F5202265902EC4E6FC8A2C14E76CC331701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 552e6b5f81e21bd36e44fde7a3276b505033fd14c7f2a2a92c93b4dbca0c9208
MD5 4f268971eaf5bf6034b9a660d3d285a1
SHA1 e0fac629051785a3fe52aa3ecd294ec43951ccfd
SHA512 980df15615c1f76105418601fd997eaeea8ef0b3fc9f7bbf70583d6008bd40da26a0182a082670766465d9e298912dc6a5765dfc0341c0c041e52775cd571e8e
TLSH
T1B7B00265C3026616C24743B07DA5D6DAB760DF35C613921692F01A6ADC25660C6296B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 79096d722aea382ac239eddc5d7230405b4b976412b9139eb3ac9eb77185a9b6
MD5 d71d47408556aba6c9e86a5005376945
SHA1 4fdce4a6850393e65fe42dc906e5d43f2c112170
SHA512 61a48a9290221bf66795d893132ce9b8490f8dfac95c1b04a945b053753114709b7a550c8f61da96e2edce962945972e95b4d3e15283d8d70535946c8bc8ba42
TLSH
T159B01240C0019505C05306F411421488B164AF11D60A170247E079338829150801C050
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 502818f4991ae2a791413a6a399027f1e6ef275c2b5b6a899d4db370ceeaf3c9
MD5 a1d430b14c34c645ef6d2f206570ef85
SHA1 0b760838b955b74f7781e2a02068d9aa38c2072e
SHA512 5bd6627f415a20f34776a197e7bdee435863d158bd384a51fab249df02db57a2942b1bfa77c9c98d120c005a633b68e41470c5b1a7de4c41f30420871668e809
SSDEEP 3072:StkFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:UkFmUi21rSm8uUVNSlzY/
TLSH
T1E2C31214B9A3B8B3EE9931447ADE3A144DAC0D818291C50156739D415DEF3C66FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6ae84d8136612857d45f8c2abda3ebf3f18a434dbdf57149f5ec4aedc1bdbfac
MD5 e45a8121b56ed181573c2ae86b95cb6e
SHA1 64caad9f34d4f85dfe1cbc6cb998c6bfa63f2110
SHA512 55bda092fbfca6f116f41a33b62ec798e470255c8a6331c2e67148758a6b7e170ba3b10737479c41f16e2501ca640b17d5fcdb3897b9173a0c7f51476444991a
SSDEEP 3072:S2FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:hFmUi21rSm8uUVNSlzY/
TLSH
T16BC313107AE3F8B2FE9930447AEE3A159D6C0D818291C64157739E419DDF3C61FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 23eecf7ac460ca1ffc96bafad5ad5e01530abb30bafe6376df10e400662a6782
MD5 24920eeca48b3cbed80fcdbf7097f117
SHA1 1dc1f85b4df606b2ce6ae7668e2d14c063d9ca7d
SHA512 80fee3db95f6c93faaf75e6b2c1cdd31fd0bf64e172e1b45d77293bca92ff64ca2360456fc30d4447ebaf8dd4d4fb434ebf374fe49b4dc463984b8993a9debf1
SSDEEP 3072:SrFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:SFmUi21rSm8uUVNSlzY/
TLSH
T1E7C313107AE3F8B2FE9930447AEE3A159D6C0D818291C64157739E419DDF3C61FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 63bbf391dd08964c2083889d98cf46686a0decbe2bda17e33cb957f1cedd1e77
MD5 30b1f04e585b6147929bade28d17c297
SHA1 83572d67966573541f704f44c542fdb769926d4e
SHA512 5129e4bca61c9e08790bcd199830d19d96f27226c1bb81620526d60ad6679ee2c45934d8f91b390b35e087a3f3f290ebbb24fa049430c252c2bce1f65c4d001b
SSDEEP 3072:SaFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:vFmUi21rSm8uUVNSlzY/
TLSH
T1D3C31204BAE3E8F2EE5930447BEE3A145D6C0D818291C6415273AD419DEF3C61FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 d0104d3e34d654af27928831bc846688627c37103709dbfe44a5331af35441c3
MD5 14ed03d1607292f7d9c4e7d6b9af9819
SHA1 4de34b8fd5cdb9de5dfbda5b795e715f039fd075
SHA512 eab66fe9fff89368861f14d69f282f0a28be6110cc55596424131b794fe64eb784c21ac556524ac009afe83048ca1ce58a97ffbbd27168114d5a216324303861
SSDEEP 3072:SFkFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:MkFmUi21rSm8uUVNSlzY/
TLSH
T18EC31214BAA3B8B3EE9931447ADF3A144DAC0D81C291C50196739D415DEF3C66FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download