hxxps://atpscan[.]global[.]hornetsecurity[.]com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield[.]securence[.]com%2F%3Fp%3D1[.]1%26amp%3Br%3Dssepulveda%2540ymflaw[.]com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0[.]0%252C0[.]0%252C0[.]0%252C0[.]0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell[.]com%252Ftask

Analysis

user interaction
yes
max time kernel
41s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atpscan.global.hornetsecurity.com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0.0%252C0.0%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell.com%252Ftask
Sample260730-tw2ffadj3w

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6016	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299023310917816"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 60	4004	chrome.exe	87
PID 4004 wrote to memory of 2536	4004	chrome.exe	88
PID 4004 wrote to memory of 2536	4004	chrome.exe	88
PID 4004 wrote to memory of 6016	4004	chrome.exe	89
PID 4004 wrote to memory of 2684	4004	chrome.exe	90
PID 4004 wrote to memory of 2684	4004	chrome.exe	90
PID 4004 wrote to memory of 4140	4004	chrome.exe	91
PID 4004 wrote to memory of 3496	4004	chrome.exe	92
PID 4004 wrote to memory of 4140	4004	chrome.exe	91
PID 4004 wrote to memory of 3496	4004	chrome.exe	92
PID 4004 wrote to memory of 1516	4004	chrome.exe	94
PID 4004 wrote to memory of 1516	4004	chrome.exe	94
PID 4004 wrote to memory of 2472	4004	chrome.exe	95
PID 4004 wrote to memory of 2472	4004	chrome.exe	95
PID 4004 wrote to memory of 4624	4004	chrome.exe	96
PID 4004 wrote to memory of 4624	4004	chrome.exe	96
PID 4004 wrote to memory of 2624	4004	chrome.exe	98
PID 4004 wrote to memory of 2872	4004	chrome.exe	101
PID 4004 wrote to memory of 2872	4004	chrome.exe	101
PID 4004 wrote to memory of 5004	4004	chrome.exe	104
PID 4004 wrote to memory of 5016	4004	chrome.exe	105
PID 4004 wrote to memory of 5904	4004	chrome.exe	106

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atpscan.global.hornetsecurity.com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0.0%252C0.0%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell.com%252Ftask
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff73cfc728,0x7fff73cfc734,0x7fff73cfc740
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,17598755973106801079,3618039539608810192,262144 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,1680832191057211358,11442672697372327478,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,6922429390137955078,9082001739643709478,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,1310974606318171096,10326488591318254869,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,1165237119215675977,4210020926206827361,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,16192677807435616553,6786885323045059422,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3948,i,9190109789801875208,2697653293345455932,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3264,i,3196312395609256991,16216601053999116299,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,15478120929162350159,6060289564796764645,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4832,i,13179549792438956222,784369631581781167,2097152 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3336,i,7224462340685822898,2192090230556292499,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,9762012311438363022,8026641896782669661,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,4906524156242947218,7896756231318362125,524288 --field-trial-handle=1912,i,4883741940747771969,6866634395285477545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d57dc43b67171c9473924407e4b0bfaf6dd16c57b3b4dec0af1ea9f95058ccce
MD5 783e87cd4f4a4dd68bbbbc7ba511140f
SHA1 00d6181e3a6d13d3914a99b9f381b86cbc921e12
SHA512 c01b30ba749c9009c271ba72ddacfbc2bac327158939d46cfd91747a4e4dacc83679b71dcb2895229b96e456010d048c3e824eb5bf726a6aa987277492717653
TLSH
T15DE0E5AAD9619C3708FD171960500745FA54135B3A40454B3A3C85198F7562A534A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 531733f02c3963026b7dc79fe892ed6e9fb6d7894df916c7deb1a8884d014872
MD5 40dff914cd16e7c28b42f99e0828b0ba
SHA1 2554a6d51e3db850ec17f3f183e9a7d759822b7b
SHA512 e9eaa83c1dc9bd1f1574a3bdc1a1f3bdbccdcb2a37d3f7a7d5fcc550d06b3ec33dd82db2629d7a888368d5adc18439a0a7302480a93ea094af6f540fed3acbf9
TLSH
T11BC09B5501CF5085D71611F614D19F9131F419741C7719C5F1D64877C851771C975099
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3f4f640d1f8ece3fdfc96ca173a3f8548f8f3313409ea83da283de8f11084727
MD5 73785ff17a29ac92283ddff7cd6f0c54
SHA1 275244a461e3fe91e2e63ad5d367c2735b51c4fe
SHA512 7a69c8abfb1a82da2b5be853a92fe19645f3064217117bec0e5302d7e15122447d038e5b46ff57456568b0081a8a2679a5709aa557cedd4717a1ea26b16758cd
SSDEEP 192:5REHP1RmFbv71hpAPRp2tQ792Hsb+WNXy0ml0qwVz2C0ekwKFFfQVyIsnAUgE:5REH6jBhUXNQwE322beDE
TLSH
T15B52B46EE820697B9CDAD22AFD117B53E7F5102571A11E84E6FCCA2C14D76CD322381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 07c4bd392f17d6adb515283a0819e7e9cb9e58c937768ac521417fde493588a4
MD5 85c2d889a514eac5947e36b408e41cb9
SHA1 3761cb7ae2a7ce29c2a9dcbcbefd96c4a7b8bf8c
SHA512 f152a7130d7908003c626f84e4d6592cf04e7c9c59ae81541ae0ca4e1b62c3c015a958d12a9f6f53bc84ede923cddcddb88f0f291799afbd1e0f2c791aad7499
SSDEEP 192:5REHP1RmFfv71hpAPRp2tQc92Hsb+WNXy0ml0qeT/0ekwKFFffVyIsnAUge:5REH63BhUXeQwE3eT8eOe
TLSH
T1FF52C46EE920657B5CDBD22AFD217B53D7F5102571A11E84E6FC8A2C14DB6CC322381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a8ab0a878265983d584b0c4b10dc79a737003e828c98be2753c54382aa27929c
MD5 c32ab0d03ff0735ded0840a02a7671d2
SHA1 cc152abf6982b4209deaeb072034f0f063a97218
SHA512 3628fd040406262ffc602828b1a4f08ea5f9b15acdcb47a765dbbe5da93d9c8f1e53688dc60c6bedc3954c7e593b24afb89b800982b867eeacafe1ee0be98d2e
SSDEEP 192:5REHP1RmF4v71hpAPRp2tl92Hsb+WNn0mlUq2b/0ekwKFFffVyIsnAUge:5REH6kBhUXKQwXL2b8eOe
TLSH
T16142B46EE920697B5CCBD22AFD217B53E7F5102571A11E84E6FC8A2C14D76CD222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1a78e68768d5417dddec8617beff478b2886554d8f9902cee0648bbe3d83c24d
MD5 1d14f692d35e36c12cf1c496618d0ae3
SHA1 71be960b26a575ceac6c8b94cdaf40429bcf6148
SHA512 a7316c1b501da6a1b4d6f3d9d290e299626b05cf41ad33355763a842c4eb56997f54960192c103c7d9da50fd252d9fd66e4f53ba9561ed227c90d69d1dce5e7f
TLSH
T137B0120084026511C84202B05152199C71145F109E1A2F0563F0A932C8252618014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59046b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59046b.TMP
Size 96B
SHA256 379134f92195cfe7c1bf0cbbc41b915f94e1b842e8ca0cd8d8dd7f1eafc68363
MD5 019fb24fbde03360e26c5dc94b8a877f
SHA1 603c7704664d997ade5adf68d9a1038fc50680a2
SHA512 3997dcb39c107b0c4edbb7345c4038342dc2d4c5976226a21fa980feb598c365fd78a97c52f7fb2c8cad3250e84fd48f5e8b3515ad9658bf31be95cdb23adc31
TLSH
T166B02200C003A222C00203B0228082CC3020CF30CA83032AA3E00EEACC223B00828020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ca44493172ff8dd642f0b5bb290330d8632a85f9c5840fdba77e139d620b8a27
MD5 b2cdb0b92d1e025a3603e1a03278e172
SHA1 98064086a86b11b2b826a5ba8acc1099f75b3e4f
SHA512 770a55fe980415fa2dfef549b812927531d6733da5dad22e6c71fd1bbfa10a812a38e93974ba4715f4369ebe19d436ecdb165056b6061bc02d10cac75a13ced5
SSDEEP 3072:zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Km7Rkm1tYpBeh2BAo3
TLSH
T1DBC3123B5DB5A9375DB9BB1EB08E0B1F1DF14AA6C920DE52C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 500587462969d2b42ab2e0adbfe010860af8219ce1e56a7b80c5f6ddd50b4f92
MD5 8ec9061b519e750bc70d416e80604db4
SHA1 09de4066892db9ce144bbf579ceee5f77ef37061
SHA512 7e7c34f22184c7d9960ee62538beac93ca4bdf77c41e613cded88b4f20b5a300ec5b87de0a0ba79079f3bd06f3d8434998cbe98b2753e54fd9a753fcc5d193d7
SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:lm7Rkm1tYpBeh2BAo3
TLSH
T19EC3122B5E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2b1bdbf7de4173514868208253744f88983858c8079b5f9b3dbebda8481e7a1c
MD5 70d5be4bd2a1eaccda0fde580f826028
SHA1 6e2a2664355bd359f7e826932c71aaf332af323d
SHA512 4c2401a76203f89d036fd38c4b3a717d5534084642165b6be3c29cbf7e76dc4eb0e465503dfbdc33ea11556848857fe6018393e2bddb54abde6e950aac820517
SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Lm7Rkm1tYpBeh2BAo3
TLSH
T132C3123B5DB5A9365DB5B71EB08E0B1F1DF14AA6C920DE52C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download