hxxps://v-ana-co-jp[.]oszar[.]com/https/ja/jp/guide/website/login-help_password/

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://v-ana-co-jp.oszar.com/https/ja/jp/guide/website/login-help_password/
Sample260803-hern5azgnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302130247263460"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
1684	chrome.exe
1684	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeCreatePagefilePrivilege	2976	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1628	2976	chrome.exe	85
PID 2976 wrote to memory of 4424	2976	chrome.exe	86
PID 2976 wrote to memory of 4424	2976	chrome.exe	86
PID 2976 wrote to memory of 4952	2976	chrome.exe	87
PID 2976 wrote to memory of 5104	2976	chrome.exe	88
PID 2976 wrote to memory of 5104	2976	chrome.exe	88
PID 2976 wrote to memory of 4720	2976	chrome.exe	89
PID 2976 wrote to memory of 3520	2976	chrome.exe	90
PID 2976 wrote to memory of 4720	2976	chrome.exe	89
PID 2976 wrote to memory of 3520	2976	chrome.exe	90
PID 2976 wrote to memory of 4576	2976	chrome.exe	92
PID 2976 wrote to memory of 4576	2976	chrome.exe	92
PID 2976 wrote to memory of 3804	2976	chrome.exe	93
PID 2976 wrote to memory of 3804	2976	chrome.exe	93
PID 2976 wrote to memory of 4888	2976	chrome.exe	94
PID 2976 wrote to memory of 4888	2976	chrome.exe	94
PID 2976 wrote to memory of 116	2976	chrome.exe	95
PID 2976 wrote to memory of 116	2976	chrome.exe	95
PID 2976 wrote to memory of 1008	2976	chrome.exe	97
PID 2976 wrote to memory of 3784	2976	chrome.exe	101
PID 2976 wrote to memory of 888	2976	chrome.exe	102
PID 2976 wrote to memory of 3824	2976	chrome.exe	103
PID 2976 wrote to memory of 4548	2976	chrome.exe	104
PID 2976 wrote to memory of 4548	2976	chrome.exe	104
PID 2976 wrote to memory of 4696	2976	chrome.exe	111
PID 2976 wrote to memory of 4696	2976	chrome.exe	111
PID 2976 wrote to memory of 1684	2976	chrome.exe	113
PID 2976 wrote to memory of 1540	2976	chrome.exe	114
PID 2976 wrote to memory of 1540	2976	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://v-ana-co-jp.oszar.com/https/ja/jp/guide/website/login-help_password/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7618c728,0x7ffd7618c734,0x7ffd7618c740
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,8652340525432907821,13110031833330142198,262144 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,2029883802283420729,1194215113825504172,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,1625056234218074922,1320676264510171636,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,5200612826248893533,2714989606783131835,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,17774409177808588087,15370463397224268394,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,15773822061455661067,10451082807904125918,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,8327139423463432836,15999927165503612629,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3224,i,14271847730715218126,8848007407326491869,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4828,i,17031597833989631901,14798586226704288782,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,5809493114893667376,6625617451486645520,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,9975203600777472472,9614011671173788851,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,6954429556092843939,9173240029384897583,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,10873226549264720949,9087030850452897285,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4960,i,10820845671842105935,15430707478385978967,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3132,i,15453387539811226796,5825338286025513707,2097152 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5864,i,14599336998150110002,10836171209007734970,262144 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,15540584163671741390,2855706717741456696,524288 --field-trial-handle=2008,i,7473959251742204657,1005835485077628856,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:1540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 58d57ab59d7342fbb0d5a60c57366b9ac91fd8f22219f39d9e92042f44c97286
MD5 943664fef6a4f8578979870446448a83
SHA1 c899f89724478b67004cabe10c72fac3e4004323
SHA512 ce9d635263c676cf579d01ce8e4a0bd900c090580f42d183684c20603ffc15029eef6d290fbd62a8215fba5775b47d6ddb2774d39e5d8db7e5fb759a2f8c7fa4
TLSH
T12EE02BADC920AD3B08FD072A24580747EB5423572B40456F3A3DD2098FB963645C6C3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 c136104767afc792416808835c41eb8e2fad1c98eb5fb10021b28d60a03bf7ee
MD5 4c8545cb996349656f178b3c36896c21
SHA1 d1cbb5e7d6ba7ad26c00b5ca0ef7bff231f13c59
SHA512 1e9d65e89566f42d2c63ff11a382097180ea4c9700ab5158bb5b75892e819cad9f6cf3dd37d5a0d18e545c9ac931bfdc8bfe8710b369138432a29c39b77da59c
TLSH
T14A018B1D98C9E250CF18DA7580E64D073D740DA86D2B4FC3DA4924F1738F3E89845053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 2ec8ee501461180e216271f8c8e6e64836df79ffd51ab1298e652a68fedce1f2
MD5 f7da1a26f2a8c3e968c3beccfa0d5a62
SHA1 22e81a7d33a41fb88a7e2aa68bbb3c94b6611aea
SHA512 60373b9b35ece438d5d112b11f2f1c3c20610aa7f32c58240285e25d0926bb5531a7d472c4b7f7651c9256e1a1915223d92cfb802a1a406fa559d7d67e6fb369
TLSH
T1C4B0129C1190C610CB982235E7D0410EA6200ECC72D0832780EFC0CC74111B05191091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 841d511204716c7e5d50d1a2d975fdf1cd1147c4246c2c9ec6eb989cc8b87f91
MD5 3e8fad6340b0feb2ab8f228b7a009580
SHA1 50fdac2305fdf64057bcacf77f95583adbe52eab
SHA512 401689a55c378b892ca015b6eb3a4ad5b6bd5de3079a860a26e8b5f60d29c457fd303fcb61b177d4233ace84195e43d3c1dc0c16c0a5024c5018237783688840
TLSH
T13D01DC5D48C5C228CF58D97980E11C177D300DA5692B5FC7D64930F5238F7E9A540043
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 80475eff20741e0c8cd9571cec9c3855a6b6066398a96b7c640882174c470920
MD5 9898f2660afc635b280a904d212129c5
SHA1 423e79c68d96ddc5ae0205446296d2d936ceaa3c
SHA512 8020ebd7627ba69c7e8daaf06e793bb125d848ea300378e87f77576443a994aa0b980dadcf205c990d96b7da93788832b2244faae4976fdfdc802a2a00b2adc4
SSDEEP 48:YALlNSzNxr2SYJhMaXYfo7EdKsdWU4s1plsdYbs1EAOsdTgmzsdMH0xJgpsdsrs3:DYLrcJGaIaEdqU1pl297dH0INrYCVY
TLSH
T1709180F7C3F88A2D991153F0AB196E6FCD6A0514432C3E7A89E59F0B93E2571D200B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7903e1e8d413d2145fc6ffff0342897b8925d1a15a51966337eec334f663344a
MD5 0612b2e8a92ebc77d41667acc4af9b63
SHA1 36c89420f4c2d5c0d709ddb9f71700b08c5a3670
SHA512 1ff8f2118ccb0b7e0bafac1e8b8efbebfd985c828f63d3b999ceac44bf9a8e699b16da97275740ef0b97a01ac23486517bc6f4c5306067865a8f32ecde3cebc3
SSDEEP 192:wRbaG5BV97v72ympTPRpLc+v95Hsb+WNnDxOA+SMCYT7SZekw9VyIsnAUgvy:wRbaADQNXZ7wFIIYvSZervy
TLSH
T10952E92EE920297B9CDFD269F9127B17E7F1107225901E44EAFD9A2C14E76CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 32c4ab6914f88bad02062852e3c14d55a6b0fa53a82c38e619c76bf92d5d3197
MD5 5de3b579588ae640e91beb681f114450
SHA1 d661134886ca2c48d605451aad0db368eb773440
SHA512 aa6136fd0d3101cfcc421ea07a5f7b4fe7cf5783eba24e7faad9e931d4b892f7f1728c7e2479d89b98723146fb7c67037a037e19bc7d029789cc008ff745ec3d
SSDEEP 192:wRbaG5BV9Ov72ympTPRpLc+Y95Hsb+WNnDxOA+SMCYT7SZekw9VyIsnAUgvy:wRbaAqQNX27wFIIYvSZervy
TLSH
T19952E92EE920297B9CDFD269F9127B17E7F1107225901E44EAFD9A2C04E76CC321751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d7243532ea435f3ee2bddf24cca560cdd87724aebd61d770653aa290b34aa71d
MD5 0aa1c4e845b107574f724721f8a7822b
SHA1 71f695042f749c779d1bc1968df100625956ce6e
SHA512 a6e51d7a726c60b97e97d58310fb7d4f2b482c64735b518b6932a5db273e2abac1f65d2113a3a1d8a8b7c7087bdfce2b297dd1ef92b5f7aff94ca648864222fa
SSDEEP 192:wRbaG5BV9Wv72ympTPRpLc+B95Hsb+WNnDxHDjeo7SZekw9VyIsnAUgvy:wRbaAiQNXL7wFfeiSZervy
TLSH
T10152E92EA910257B9DDFD269FD127B63E7F1107225901E84EAFC9A2C04E76CC322751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9e720eae0f5a56ad7c069cd924b7f84d20f55524927f545d1836d6e34cb75d8d
MD5 2be268e48d1b35d348667e19cd4fd934
SHA1 34856b29a07310e012b8d7c0530f32a8a1f625a9
SHA512 80cc06f0592795e80c92cf8c43b84fdc9a7f806db1d116a3c4f87b617fcfb99301ba14b9a0228ae2d7e0efab2ea5ee38ffe59fd38b5acc19ab21fb7716101872
SSDEEP 192:wRbaG5BV9Tv72ympAPRp2c+Y95Hsb+WNnDxHGW2t7SZekwLVyIsnAUge:wRbaArQUXz7wFv2tSZete
TLSH
T1CA42E92EE924257B9CDFD229FD227763E7F1106225901E84EAFD9A2C04E75CC322751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 258149edaae62d7519c8ac4083f1877f83fe7f8d6fcce2dfd3c389a63ce6c44c
MD5 aa7292d31b465e2ce9e7c1637123e43f
SHA1 ba6cd7578fe1c8b4c76e503515e643eb8935ee15
SHA512 595d70dd14f4d3007db073f3348d47232feb43ba3ad72c24e48dd9d7681276fb1cc1afc696ba3f1659cb1cad893e361c99996fc92dd71f3047848aa0c6ecb56c
SSDEEP 192:wRba/3zV9Rv72ympAPRp2c+Y95Hsb+WNnDxHGW2t7SZekwLVyIsnAUge:wRbanBQUXz7wFv2tSZete
TLSH
T1FA42E92EA924257B9CDFD229FD217713EBF6107225941E84EAFD9A2C04E75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eedcc7f9761c5cf0b16361159eff1f5f198e654133a17f7ab2ab85072a44f7b9
MD5 c1fd5a3684207ef58c063aabf34d9017
SHA1 f4ba2bbf49a9acc2488e5cfb14d5b3ff9fbf9cf5
SHA512 a8fa80dad7636ea3fde765ef90c2e65622e360a8402e7460dade5dd6bc14bf6c23e27749cc765676087d07a3a5bf4f259850d7e77bf54b2f0e3aba9d19b4008e
SSDEEP 192:wRbaG5BV9Hv72ympTPRpLc+v95Hsb+WNnDxHMCYT7SZekw9VyIsnAUgvy:wRbaAPQNXZ7wFRYvSZervy
TLSH
T1C152E92EE920257B9CDFD269F9127B13E7F1107225901E44EAFC9A2C04E75CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cf29fe87cc22e57188b48a6cc4f10ec0e29ac41dc7ab6045d57df86bd0305254
MD5 4319a6715dcc33607b3e4da347ea4d79
SHA1 c18da7aea01c46c6ef25b08e606e6e0b2207a6f7
SHA512 fcf8be91f1e6e3b6ae9a7b4cd23a7a7d0c98e66b4f112ec2dba5ee9d840419efa4de4b221f38bb840c0f2a58550ce036b072cd7e87b1710033bb2b1c13df33d5
TLSH
T1BAB01210C001D201C04202B01292148C73645F11F60A170143E469A2C8365A18014091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586702.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586702.TMP
Size 96B
SHA256 f3e02c45298b88b76814dbe6bde02ff09d44a1fb2fc404bbad617d048f7d768e
MD5 eab023d47dd77ffb4175242eb428610b
SHA1 b750873db316a8babffd6ac88fb4580a80330341
SHA512 c8ac2bcfa9e977e1621323669488cf7b369d7cd66ce3c31fc8a7cbb85b04635a5b274acda03a5ac3834a072cc12d53debf4dec0ef8da276b9f80ca9c706bac7f
TLSH
T131B00299C906761AD04603B03695A5D87160DFB5CA03671392E42AB6DD39EB149253E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 174KB
SHA256 bb0f567c0bcaaf3827ac070047a8a69e19b1c1060de4c051bc9185f66fe7f30f
MD5 2fac102c5e9c55ecc384ba29c474e000
SHA1 c01ff9e239a238f053df394d49bb7c349dfdb4de
SHA512 c6cd63a42dd0390d77f584fcf87fb9c09fd9a910b7691d7cb06958515af5afc9c67e4840b70c39b6d58266a61f95f399c0ff50b09439f835b3489d5fec1ca4ad
SSDEEP 3072:Rg1JUM1PbDmqhqfd7NtZL8cHQRZEQ6Spsk:e7hjyqhqZ/ZLW3Exk
TLSH
T153041273DFC71D324DCACF64A92306EA9B7E1595A070E2059E9E77EF6883C21A81185C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4315b56bcd6525ab4e94fea353dc0b022ff2fa2df02dc108e88dfadbdba111f1
MD5 302aea5e13f16f47e3d944587cfc2135
SHA1 099d7858d5e29c918fcb4f6c0e789fcdfd31f4d6
SHA512 fdbc6397cb60742bdba0b85305dc613cc06b2042f4bdc5bb10c5c4894db308a115512d0f07c6a20605d771eed6daf693e616171287dc74cccd5afedf86069fd7
SSDEEP 1536:TBQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:4qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1F9C30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D37BF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 06a512db60fb9e1656f6f42f55c49536d450884f5e7362bf00ad42dcfebcc9a2
MD5 5e949211e6161b6b7962a958a4ca8318
SHA1 5a344491e5e016e0f7b4d7db31ddcc3a3d9c0176
SHA512 83d93cdab9828152819ba3b232e1e0e2c9f6de6dafa8a311077a23a5847227eeb7a15c7f7234ec1fd22b6d113cc33f915c9d91466a93c2ced2bbdb50496b56c3
SSDEEP 1536:SdxHUyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:a+qfd7NtZL8cHQRZEQ6Spsk
TLSH
T194C30237ABC61E339ED2CB70B9130ED797B544A99034D301AB6D37FF6883895698249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5e84b1f037929d159c3f363dc0c31a747674a2822e88ff76fb14c19213650846
MD5 d54ac4de4b092dc21faa73a277e7f51e
SHA1 9c64021e2004bdea30c3ebe7ecd396ffc23e3337
SHA512 5f7fb1c7a31e40304987a010915613e6fcbd69a96090a71700bddcbb3d0e1647c66eece67f053f991428748dc12ba26bd61a46eb1ffa4933b61595938f1a8d75
SSDEEP 1536:ZdxHUyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICP:x+qfd7NtZL8cHQRZEQ6Spsk
TLSH
T152C30237ABC61E339ED2CB70B9130ED797B544A99034D301AB6D37FF6883895698249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download