hxxps://cts[.]indeed[.]com/v1/H4sIAAAAAAAA_4WQX2vCMBTFv8rIg09zdTBkFMIYrrCxWotaZE8lJsHENn9IbtyK-N0X05e9yB7P-Z1zLtwzCihHAsD6PMuEA06FdfJE6PBAjcr2jmjmM6kZ5-yFwg_mish-WizrcvVVrNt1sVm8F29NWbTF8vWjnEgv2f-h7hvfpK3U0E8CqNab4CiPa7Y3A3dtmvUJKc5kUOOhZFCiLJEHfXs3xazDzI0FDdhL4EnAYDnupe6S6g3FSrIxZnCzQfdIofyMaC9ptxXOhIOIfwMXeESjGxeiVY_Pu6tNNIdpqlriuIZtF_FVGQ-LP42m-qxWuyoSuCYej8e9N2p-Ek9z8zybocvlF1VTRRelAQAA/YcPcayxxfpSHukrHmT_8rtYYjO74uBZ5em699BpMVYs

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cts.indeed.com/v1/H4sIAAAAAAAA_4WQX2vCMBTFv8rIg09zdTBkFMIYrrCxWotaZE8lJsHENn9IbtyK-N0X05e9yB7P-Z1zLtwzCihHAsD6PMuEA06FdfJE6PBAjcr2jmjmM6kZ5-yFwg_mish-WizrcvVVrNt1sVm8F29NWbTF8vWjnEgv2f-h7hvfpK3U0E8CqNab4CiPa7Y3A3dtmvUJKc5kUOOhZFCiLJEHfXs3xazDzI0FDdhL4EnAYDnupe6S6g3FSrIxZnCzQfdIofyMaC9ptxXOhIOIfwMXeESjGxeiVY_Pu6tNNIdpqlriuIZtF_FVGQ-LP42m-qxWuyoSuCYej8e9N2p-Ek9z8zybocvlF1VTRRelAQAA/YcPcayxxfpSHukrHmT_8rtYYjO74uBZ5em699BpMVYs
Sample260804-af81sshg88

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302759140937236"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
2304	chrome.exe
2304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3056	1572	chrome.exe	86
PID 1572 wrote to memory of 3472	1572	chrome.exe	87
PID 1572 wrote to memory of 3472	1572	chrome.exe	87
PID 1572 wrote to memory of 4628	1572	chrome.exe	88
PID 1572 wrote to memory of 2844	1572	chrome.exe	89
PID 1572 wrote to memory of 2844	1572	chrome.exe	89
PID 1572 wrote to memory of 4816	1572	chrome.exe	90
PID 1572 wrote to memory of 4816	1572	chrome.exe	90
PID 1572 wrote to memory of 1324	1572	chrome.exe	91
PID 1572 wrote to memory of 1324	1572	chrome.exe	91
PID 1572 wrote to memory of 1468	1572	chrome.exe	93
PID 1572 wrote to memory of 1468	1572	chrome.exe	93
PID 1572 wrote to memory of 3804	1572	chrome.exe	94
PID 1572 wrote to memory of 3804	1572	chrome.exe	94
PID 1572 wrote to memory of 3344	1572	chrome.exe	98
PID 1572 wrote to memory of 4488	1572	chrome.exe	103
PID 1572 wrote to memory of 4880	1572	chrome.exe	104
PID 1572 wrote to memory of 4576	1572	chrome.exe	105
PID 1572 wrote to memory of 2304	1572	chrome.exe	106
PID 1572 wrote to memory of 3964	1572	chrome.exe	115
PID 1572 wrote to memory of 3964	1572	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cts.indeed.com/v1/H4sIAAAAAAAA_4WQX2vCMBTFv8rIg09zdTBkFMIYrrCxWotaZE8lJsHENn9IbtyK-N0X05e9yB7P-Z1zLtwzCihHAsD6PMuEA06FdfJE6PBAjcr2jmjmM6kZ5-yFwg_mish-WizrcvVVrNt1sVm8F29NWbTF8vWjnEgv2f-h7hvfpK3U0E8CqNab4CiPa7Y3A3dtmvUJKc5kUOOhZFCiLJEHfXs3xazDzI0FDdhL4EnAYDnupe6S6g3FSrIxZnCzQfdIofyMaC9ptxXOhIOIfwMXeESjGxeiVY_Pu6tNNIdpqlriuIZtF_FVGQ-LP42m-qxWuyoSuCYej8e9N2p-Ek9z8zybocvlF1VTRRelAQAA/YcPcayxxfpSHukrHmT_8rtYYjO74uBZ5em699BpMVYs
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd5dadc728,0x7ffd5dadc734,0x7ffd5dadc740
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,5786026330716293470,8439486167831063982,262144 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,6081963958478741670,7432068763321160598,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15710569221282091216,7821361250467233050,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2968,i,4946441939246922795,14296286388112551240,2097152 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2972,i,18009825764380989639,1044428977834759073,2097152 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,3947484246508782524,14239435973294223054,2097152 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,5168106569251402273,13481854900555727251,2097152 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,3600602398165340434,18009257679217764956,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,2422735254887045864,12966993131348489987,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,4077949704143182948,15152203883116564503,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,6263528672172162628,9276035317991710254,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=728,i,5040338284106818427,1484317587889518520,262144 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,9908101986401424184,3556773380934020109,524288 --field-trial-handle=1980,i,10636977697650758589,16675085119218927844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c64d78cdbc3b841c7c1ddd99daa5beb01ed7cb020c2a440124e2ba0ba6866c32
MD5 8ffb24f115cff3296bcce2b1cd152dce
SHA1 135f569a2d4b69810572fed4213ffdabf8b55155
SHA512 0866699b0eb7a6b2cfb2d598ce38239ca53c563aa9bd8470a1dc5ef362155e71d5dad6bfefbb72e76c46132f23a2ac3e1a24685f41f45e696451ff148a68e205
TLSH
T183E02B99C821FC6B0DFD472D50954645DA1013571B60885F363D9108CFB1A7B0185D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 0e71903203a061be730314040780d1051a7e9e595c252a2cea5b61e6785bd61c
MD5 49eb19a688746c16aa58e0fc85df290f
SHA1 eb96de8d0b57c4c3544eac46f0b00629544ba105
SHA512 11f75a458c42165fa6a96f7f54e507885442629222457ac6a5a4870aa66f24c9fe2f9741312578650e191bcd65141bf6cdccd7cbd897a0a7b3ab5b082e5aa493
TLSH
T19DE0C2B5B3C1475CDF9511B95D930E91E92F096F00575BF380F43B4568EF6C511171A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 787f2b5d094a373e0ed6fa9c05f02a2adfd97a2d70d12a289fd891d772d9519f
MD5 67ad36227fafe3c34ae7e992b79368e0
SHA1 8bb719c082a0dff1b0fc146f3017d39ad4f35f12
SHA512 504bfcea78c30bdc593a1c30191f9ad52a3f16fe7826352165a66392c6adea3c2ff770e97ca1013e014d3e4ae76f8605497c35fb6ccf55a575883303f10320a8
TLSH
T1A8E08C7573C0074CDF9112B91C930E91E52B056D01174BF380A03B9458FF6D64103144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 7e07ee8ebd5ec3d47d3d9ff03fea56944b6c44e4bfa9a86ad5cf797a9e999a10
MD5 786e85bd393ae450857843c983e1026c
SHA1 c3dbd5cc746c0710f5be3af267c8e70b90af539b
SHA512 3696cee6d1d19daf44911f4b094cf4cfd4b99bf661e26f8cccef3ea671b5857363e82af428a21783f2a23eb663047c17eeeb36b10903cea7d461d2b62755ad39
TLSH
T11AE0C7B2B3C007ADDF8122B91CA30E92D52F096E10174BF380E03B846AFFAD60103188
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fdf6931a69cc16267cedd830f5cecb1839a478482c59aaf5daa40d7ed541277d
MD5 ba11b0a78ee0b36c3d262d3ea341d897
SHA1 c4cd629384a458a8baf966f7f99bc132e00ec7fb
SHA512 a0a2aaf17e46e90507b51ec773df1e62bc9d2c79cf86a2f165b71752d4be2d8e9f61f02a568b74c1337f508d3f2d42d4cb8c01e4ede2822993a69da8794309d3
TLSH
T138716BB783E4862DD91152F4EA156E1BCE6E0528436C3C66C8D8AE1F93E2972E14178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cce1ab283757fcf8ebac7ea46902c9a802459a2bfea221e3b0f1689c385bed47
MD5 ed65890be104498bd8a76f9427fdab2a
SHA1 5f1b7dcfc351fdd1baf4a5ad5545d3703333a670
SHA512 9531d861c6227f1932e656c1826d66235364f71b89a7e774adcdae74b63f309cacf8671e51be153f135759bf9ddf8bbf4222657cb7581e2836ba8b297738c61f
SSDEEP 192:IRLS7tg8RwpXvv7ApAPRp2p8Xs9qHsb+WNmlN2G5F2YQeDgKra22VyIsnAUge:IRLSAXnkUXckwJ22aaLe
TLSH
T1B552D82AEA103D7F9CCAC229FA1A7767E7F5103920C42E90EAFC992C15D75CD211B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c89a3b8b6c200cf6721a1ae44294517b174f93a473ddbdc294652776d90d2669
MD5 d7dac23a9059721be403c74865b9ff2f
SHA1 144cc64d6c7adc6b7c8daec943b85ccf6712c878
SHA512 85aff4667af8c70b4fd1d84baee949b88e149140f0605ece14458fa435c5ec4cfcc4ed2951f29cfeb9d99827497b8cf4dd8717ac74ddaafd200fd2a8314ac8f8
SSDEEP 192:IRLSUtg8RwpXvv7ApOPRpgp8Xs9qHsb+WNmlN2G5F24QeDgKra2eVyIsnAUgE:IRLSnXnkWX+kwJ226atE
TLSH
T15D52D82AE9103D7F9CCAC229FA1A7767E7F5103520D02E94EAFC992C16E79CD211711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 240519cc49483dccc9a4671afdc3202cd7aac7bf198ce4fd2adb477ed95392e7
MD5 75ea7153623220db0f591530c4a562c7
SHA1 921e87d41065addc56d7aaca948182bcad0c0774
SHA512 2e07af0365f2d35bad43aa9ce1f253daa118d7772ce13328da5ec868e6147d1ae5689cb2a60fffd57a45a2b64fb77030bf38c4542085c86cc62e73e2e8439909
TLSH
T1C3B0129088015552C01203F4118614887125DF20960A170143F46E228C352508415061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585407.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585407.TMP
Size 96B
SHA256 5668308e2a988a0a487509b32abcf24ca3a3cd380d88f3e235c4852733880c27
MD5 719d3731b8073e8aa941ea835db3e040
SHA1 dd885164aec4e4c0d8aed3c52d5753fc27d87cfd
SHA512 5ab54f31ea46ae2746b360aee6a15bd2ad0c43210e7b20c294e636a40c8b03e385b8a01aad20f943300c42f8a6f01be94cc65409bc34d2b1b04dcd05e9a12aba
TLSH
T1A3B00269E202AA52C44203F429E5A5D97266DF29C603525BD2E41B67DC2A6604925960
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ed7dc2fdc316f37a9b878c3984d627aaca81355e7514a9bd29645be7bbcd1699
MD5 d9f2a9ef6428e2c67218609a25860190
SHA1 2e2cfdd8c0b7e8127fd7bd5409fbd8f2bc7a6d5a
SHA512 08f12400f6c8c35388b10600dd94e5a1028525f6b0898e059761f55fb22c56c77c417c0ad7bf6085baec73f25d70c5345498c8902d1142121bed6f54ac8308b3
SSDEEP 3072:OEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:cm7Rkm1tYpBeh2BAog
TLSH
T1FBC3023B5D74AC3B5DB9BB4FA04E0A1F1DF249A7C920DE52C8D85A0423F97CD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 19bfa14882653459260d27ea86814e55556f7513e8ba84a102fba1f15fc423bb
MD5 7eb8f1ff7286de1e675a72331a6e1da3
SHA1 0d7a9fbcd32f04c7141cc90330e8d0c72e2c3719
SHA512 e010e6332b761a9c282708f9efdae80f0beae53fe9973a22ddf2007dd6f30bd02ca0cf56535cf1b21dcd515b13918beaa9a44ff3921cfda50363bead8550f4bd
SSDEEP 3072:OjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:dm7Rkm1tYpBeh2BAog
TLSH
T1D1C3123B5D64A8375DB5B75EA04E0B1F1EF249A7C920DE92C8C85B0423F9BCD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9865f102afbdd82c4777ee9acb209c3413a16790aa8ae7944d22b10edb3e4833
MD5 48456ce1369677dda3ff422c322e0c11
SHA1 eb513bba750066f56601939240d3f28e36b4aef4
SHA512 86ce4fb724e516ff2268aad2f25cbade3b4d7ee6f8d3c8b862338e1cb44c4585b1db55a4969d1dfd0f6e2b386cc6dde3efdf7ed41b0b81aa6dd8f9de1529b269
SSDEEP 3072:A5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:/m7Rkm1tYpBeh2BAog
TLSH
T170C3123B5E75EC3B5CB5A74EB48E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9b802f3e3569b9888b6da784ffe8b7a39e4f4c838b4c4da63c743027ebff84fe
MD5 e821d78d0025ddc283784fbfc4585a24
SHA1 35937464e15f1fc131e7e749a1966b1c5fd33e05
SHA512 23cea585242a9532f0f8247d89f53927292c0b241f79ec1f210aa2a31f586c2c2a7ca9035a3dd5485f250624e383155689772114f3e148a16521c111819eb8a8
SSDEEP 3072:PjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Sm7Rkm1tYpBeh2BAog
TLSH
T1E5C3123B5DA4E8375DB5B75EA04E0B1F1EF249A7C920DE92C8C85B0423F9BCD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 2745ffba687edaa4ba672ba6abd15d1f3fabe85260adb684b6fd6e8bf74adab4
MD5 341ef889d9fa1b8cf05424fa16a0d5e0
SHA1 1322ac359d3982dad85496a0ca0b8e5bac49e87b
SHA512 e8e809f6733be516f33f86694e88adebcb4f1e125c92062ef2098d1b639c482e9ac982088dcbeb4f6173859e60966b2f2be81fedd4e4240afaf6d405b006fdac
SSDEEP 3072:eEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Mm7Rkm1tYpBeh2BAog
TLSH
T194C3023B5D74AC3B5DB9BB4FA04E0A1F2DF249A7C920DE52C8D85A0423F97CD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download