hxxp://kckqvb[.]com

Analysis

max time kernel
599s
max time network
594s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/07/2026, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kckqvb.com
Sample260728-hw41sa1bqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1344	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296959789604173"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
3816	chrome.exe
3816	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe
Token: SeShutdownPrivilege	2352	chrome.exe
Token: SeCreatePagefilePrivilege	2352	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe
2352	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4992	2352	chrome.exe	83
PID 2352 wrote to memory of 4732	2352	chrome.exe	84
PID 2352 wrote to memory of 4732	2352	chrome.exe	84
PID 2352 wrote to memory of 1344	2352	chrome.exe	85
PID 2352 wrote to memory of 1588	2352	chrome.exe	86
PID 2352 wrote to memory of 1588	2352	chrome.exe	86
PID 2352 wrote to memory of 3684	2352	chrome.exe	88
PID 2352 wrote to memory of 3688	2352	chrome.exe	89
PID 2352 wrote to memory of 3684	2352	chrome.exe	88
PID 2352 wrote to memory of 3688	2352	chrome.exe	89
PID 2352 wrote to memory of 1104	2352	chrome.exe	90
PID 2352 wrote to memory of 1104	2352	chrome.exe	90
PID 2352 wrote to memory of 3832	2352	chrome.exe	91
PID 2352 wrote to memory of 3832	2352	chrome.exe	91
PID 2352 wrote to memory of 2952	2352	chrome.exe	92
PID 2352 wrote to memory of 2952	2352	chrome.exe	92
PID 2352 wrote to memory of 3900	2352	chrome.exe	94
PID 2352 wrote to memory of 4068	2352	chrome.exe	96
PID 2352 wrote to memory of 4068	2352	chrome.exe	96
PID 2352 wrote to memory of 2728	2352	chrome.exe	100
PID 2352 wrote to memory of 2300	2352	chrome.exe	101
PID 2352 wrote to memory of 2896	2352	chrome.exe	102
PID 2352 wrote to memory of 1836	2352	chrome.exe	107
PID 2352 wrote to memory of 1836	2352	chrome.exe	107
PID 2352 wrote to memory of 2088	2352	chrome.exe	109
PID 2352 wrote to memory of 2088	2352	chrome.exe	109
PID 2352 wrote to memory of 3816	2352	chrome.exe	110
PID 2352 wrote to memory of 636	2352	chrome.exe	111
PID 2352 wrote to memory of 636	2352	chrome.exe	111
PID 2352 wrote to memory of 1164	2352	chrome.exe	112
PID 2352 wrote to memory of 1164	2352	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kckqvb.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffad570c728,0x7ffad570c734,0x7ffad570c740
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,6349862034532083750,2035600601520092032,262144 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,11129543953126431271,4933660005014019540,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,8410209915227792054,3744699863667763095,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,5942235310870112615,16639262889122570470,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,2551529033166934500,13956870184959582340,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,13150901016828026601,2966785024978896994,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,12882234555984759403,12885898350530812946,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4928,i,11441870080757099458,3628940504834285343,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,11471592857049864644,4880829917541132138,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5620,i,7097529257323069703,11944663425142785526,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,15013346449866470982,11477491757268399537,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,1103508855758586628,6283017722031460092,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,11607356765045439224,16362322310687384790,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4460,i,9546856503953692031,16188576587982171578,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5320,i,5967166189189616344,10490803107962385392,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4592,i,17836308494776260992,10159436041194061778,262144 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,2092232182606248222,10948925357508366552,524288 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4528,i,18043168619951617552,14118770048070500985,2097152 --field-trial-handle=2016,i,7215270327674647699,17983182789663740154,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1e475b4cd6ca4153c99e995c8b9c71795c778278ec937b2311d608632aea6c05
MD5 1d15829542c57bbc7e7205f50df336d2
SHA1 f11311cf919078dcf34a3b88a22840e044d234ac
SHA512 682e8f9461e76427a7cb6db37dac732b206e6ff004a516f41656b42dc52fba61a854d99bb726d5a3dd262fbc4de67741397cfda9e55384670fea820a08cfe6a9
TLSH
T133E02B6DC8319D3718FC0B5D50580A46E70127666685456F3E3C910C8FB027641C9D2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 afce49302dfe3e105506e9c08114cf18882fe940538fad8c0347a6b8d2099728
MD5 1da2c792c548766ab4c86889efc7c85d
SHA1 45234a282a5728f4948bd7ff0a113ca3057543b0
SHA512 f1e52cf4748ab0f3f3ba46bb4303599ab69c3a3a6f35058a04f14af546ed9b6a3e632b068b73d9bfd29786d05bf6e95aadc8e222a3b932a5f1c55a3a0ab8b496
TLSH
T19D419CF783F8997E8A1196F4EB156E1FCE690524032C3CA688D46E2B53F2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6133783c6bb78f9b463baf79c6303f4c87b1b6b31ceef2583742ccf2766c99a8
MD5 dfd378fa493ac605cdbabec0f80ff603
SHA1 4088b6de4dddabd2ccecb9cd8b28225f85f1f73d
SHA512 d58eaec788193f7e37a75d22743abac1a6a35ba992e2b7e2d7e113159a9260cb608cb78db071be8ad38a5f730291b68a3e6d4cd9632670e3163edb2e66eb5b87
TLSH
T1FA41ADF793F4897E8A1196F4EB156E1FCE690524032C3CA288D46E2B83F2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd060eb579fb390c2a970fda2918b2e9cb1633e0ce86d5e72f57402b6a83f6ef
MD5 7f33ba48721d4b1b600d7a5f7bb91071
SHA1 05e48f8079c1b1760f6211b81f80418fa124db8c
SHA512 d17359c04ad126fc15bc161fb4ed7836d11fa645bcf2da9033b3c2a6e122dc656d9da9bd89c0604dd6a1d23f4acd111f48895c4b85a65c51db18e03214806f21
TLSH
T1D3419BF793F4997E8A1196F4EB156E1FCE690524031C7CA689D46E2B83F2972E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 09665dc340aa5ed2a7a25c88190eee43c18e6db85b331faa64ba7a99c31b3370
MD5 52e4f60fb1bb84a33772c8fd75206f7e
SHA1 f79d101001e5381874f61e61dcb0ce09eeed389c
SHA512 c87e025d6fd418c1f25b8a394bb7ce85c6497c070f84b69ef8fbf92a4fbc1bc60bfe6df23d9e9b62c160ab3c87335d2b1583beb4c8e0c02d9ab399586e6dc8ec
SSDEEP 192:ARDzl/uhzxv7YnpAPRp2ML9oHvmb+WNn4qPw3sa9qVyIsnAUge:ARDzWhkUXNuipPmAe
TLSH
T14B42C82EAD10A93B5CCBD32AFA667B53E7F5102121952E88E7FC8E1C15E75DD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 23597f4b4d0d5d8ccb888554bf242a9d96d04bda2a0d8a98fe24eeeaeb7a2289
MD5 db9e00b0a4135b6c095439d06bdc383f
SHA1 2130a39b64245d4a1ec1956f3cfb44d2ab05653e
SHA512 6e72b947f2cc6123f34d6f8b0e8735bf1025e5a5c7b01e9edb03a0e5d18391fa3489fee5c997bc715f2c54567daeef7835e287e3b8544f7c57fe242d5c2e0e12
SSDEEP 192:ARDzS/uhzxv7Ynp2PRpkML9oHvGb+WNn4qPm3sa9NVyIsnAUgE:ARDzvhkmXfuipPgJE
TLSH
T15152C82EA9109D3B6CDBD72AFA527B53E7F5202121901E88E7FC8E1C15E75DD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
MD5 a8d99a89af5bdc4d36bda0a26f9a1835
SHA1 eb4f61f12dbd8bc006b66b5635e820349ee33d41
SHA512 c99be19c76c0ad1a08682264926ddb11a255acc2f228d7157f1abd1d4a7df9d1f680e336435cd220b8f27397dfc7a98def0531d0590cc20f63719683618de399
SSDEEP 384:GYjax7KxkXqKf/pUZNCgVLH2Hfgslzh7pLuLcSjoJXODap+ErU3+pHG2xw4483G:Gsax7KxkXqKf/pUZNCgVLH2HfgsVh7p2
TLSH
T15272F967AC48DD370F94CA8CDC277F4FADB9024B65ED846442FA982903D5ADA11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 267718061ed33e1a51918d915751eb040c2592191841aea6a9d5eb6afaf39e18
MD5 851455ba5fb059afb1bf381f04128c79
SHA1 43aa17ea52bfa9ef95c5b51124f3ed1701e5a0c8
SHA512 454cf308631a0800763064523ab4debd1ae60bd25baefc683bafa1a1d3876c7c38e32fe7a6030463f7eb64d3701294ef26f3cf944e7dd791b0d2344e406b1077
TLSH
T1C6B012018041D943C04202F41A66249872A45F20E60A170543E57922D82537280280D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587e53.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587e53.TMP
Size 96B
SHA256 4c23183063faf4243174673aaa10b4bb28cb1fcd8b805c6c538194386c5ee0bc
MD5 00329cb34c3f681f6256dd9e6fac7006
SHA1 14b7f438ec52a0645343327bf96cd2bbe53deb76
SHA512 09cd397839db936488c27c9f08a19ee4453d96007bb380f221b7665f7ba87096a7beb37d64b8fd11eec39de073c767b8800283cf230cea5cd82063bb4be5db56
TLSH
T159B0025AC1036616C25203F029F995D87160DF65CA13125692F51E6ADC2577175276A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 2e67d65149c9911a56cdf2f02aeaebab0859095ccadb4a703e115e2ee51081b1
MD5 622dd4971b0a4842b137d984b92db360
SHA1 4c5d138ebad0827c45ff499faa7b4139759dc609
SHA512 5a8784aa9ccc05aba1223250864050e4fc2df92808a968a4336bb2f0866665c073181b7ceeccc8dfa1a21227d218e0ffa7d527e1d9a38d900e9c643f28c80f54
SSDEEP 3072:BOunajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:JajSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T17AC302E0CAF1CC5BC66542DDF0355E8A49D08DA4E945EA8AB3DA3F5B342B1CE7A43431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 48c4862962058ae4e53e37f90d8ff298223c0dbdc2f621df41741a26c5bb8ce1
MD5 f9edf458c75756f60c43a67d7efbc3a6
SHA1 8b99b43c0e35a858928043b1aa0578cbd023c5d5
SHA512 522eefa712c349b06b454206685748b9545dbe8d0c6dec966a1f9352d36d9ca1e7fc740436470f91bd1873b994bd951d861458d504082c0c976c808d5d9c97a0
SSDEEP 3072:5OunajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:hajSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T184C302E0CAF1CC5BC66542DDF0315E8A49D08DA4E945EA86B3DA3F5B342B1CE7A43431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8ebf7f78fe6f4205e3a7f4994bfcee772541053098d2b76f08567dde1b23b8fb
MD5 014fb9404a8b1f84c53996b3c0cd1319
SHA1 60200d463cacc77d94a984a3f2323473a042b4d1
SHA512 279ea3b9e5b67ec65c9e512fb33e0c73764ff3b8d3e29cfbaaf1f66eeedc909a4535b41d97b130a10944aa37687077708b339684ea8ed9c60120e0be7da7c29d
SSDEEP 3072:2NajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:zjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T18EC302D1CBF2CC9BC22542CDF4355B9A49D08DA4E945EA8663DA3B5B382F1CA7E03531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72eb0f655b782f188335ec37054add15d64d017df44e3c8d524d59c9bc32aa5c
MD5 a5e6a40af69a600e5ce74b81a6c5aaee
SHA1 64405875076344debdf758d98db1e62194a7d2fb
SHA512 a47090f1a49f95cb6444db947ebd2beca7336d365b0f5692cbcbcbac1e3466cd7f738902a8b39820104bf658e9bb5a60063769b85cce434de8b18f35d8be7877
SSDEEP 3072:yOajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:UjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T148C302D1CBF1CC9BC26542DDF0356A8B89D08DA4E945EA8663DA3B5B342F1CA7B43421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 89d770bf9ceb50f050d86a1e19e53c87438d545f3c6dbe03f19a99755e4837f3
MD5 dab99d0bc48acd69f18ea2312f160c05
SHA1 4fc0ce22d2dd79f08dc7234cdb0da89f3079e8b0
SHA512 aba423af340a7b0c5f997f21e4c0c6a1d7136cf2e846374dd8646ac351deda73dde048abef5af5848c536ed729a36d11cf02d53d77b119c64c4bfa519b38946d
SSDEEP 3072:fOajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:5jSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T102C312D1CBF1CC9BC26542DDF0355ACB89D08DA4E945EA8663DA3B5B342F1CA7B43421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download