hxxps://wiggin[.]com

Analysis

max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wiggin.com
Sample260804-amarkssxd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1308	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302763726669162"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
3296	chrome.exe
3296	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3332	1332	chrome.exe	87
PID 1332 wrote to memory of 4492	1332	chrome.exe	88
PID 1332 wrote to memory of 4492	1332	chrome.exe	88
PID 1332 wrote to memory of 1308	1332	chrome.exe	89
PID 1332 wrote to memory of 3776	1332	chrome.exe	91
PID 1332 wrote to memory of 3776	1332	chrome.exe	91
PID 1332 wrote to memory of 2112	1332	chrome.exe	93
PID 1332 wrote to memory of 2112	1332	chrome.exe	93
PID 1332 wrote to memory of 1652	1332	chrome.exe	92
PID 1332 wrote to memory of 1652	1332	chrome.exe	92
PID 1332 wrote to memory of 4588	1332	chrome.exe	98
PID 1332 wrote to memory of 3848	1332	chrome.exe	103
PID 1332 wrote to memory of 3848	1332	chrome.exe	103
PID 1332 wrote to memory of 2440	1332	chrome.exe	104
PID 1332 wrote to memory of 2440	1332	chrome.exe	104
PID 1332 wrote to memory of 2896	1332	chrome.exe	105
PID 1332 wrote to memory of 2896	1332	chrome.exe	105
PID 1332 wrote to memory of 2360	1332	chrome.exe	107
PID 1332 wrote to memory of 2472	1332	chrome.exe	108
PID 1332 wrote to memory of 1340	1332	chrome.exe	109
PID 1332 wrote to memory of 4064	1332	chrome.exe	111
PID 1332 wrote to memory of 4064	1332	chrome.exe	111
PID 1332 wrote to memory of 3296	1332	chrome.exe	112
PID 1332 wrote to memory of 1340	1332	chrome.exe	113
PID 1332 wrote to memory of 1340	1332	chrome.exe	113
PID 1332 wrote to memory of 4116	1332	chrome.exe	114
PID 1332 wrote to memory of 4116	1332	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wiggin.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd22d0c728,0x7ffd22d0c734,0x7ffd22d0c740
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,7402436108225630147,12304850933492270518,262144 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,14015677198483336021,106277019041461602,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,8098315565999998586,16341452812839767396,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,3983553628719577095,2956722114047355234,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,3790078180229830686,5900726042873299498,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,2409310453751963097,7149711107076337765,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5156,i,15174910954290481458,4992769455918467006,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3272,i,16719827891926349156,10654615424595236122,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5236,i,14307783455406574616,1611977854176601040,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,12686202464355935141,12107762230017752599,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,8008802119099833694,16506201216749268510,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,6985983986149068815,11190959367237640733,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5548,i,8363336740572657108,18003702383290499255,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3948,i,2153084952546600731,914005524197454381,262144 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5052,i,14022699178554089730,16312872274041583877,2097152 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,12769351076353406839,16680278381415684455,524288 --field-trial-handle=1728,i,5114834321787689086,13812694000760893177,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dc1dccfd8d15613a41d24c2dccc8a55f1f740172f95da1fdb02e0e60e8e4eb11
MD5 361867b7addf54acc313d271ad59c455
SHA1 c40a59246207a025193491c463cbd988185ce9df
SHA512 27f07c6511e3d169e0828a0d9a568e5c72eac73d7340536fc210b44376fb317357c7bd7af3e2f6a3e7174d8a2fa99c240e19a650bb814fb0cea0de3e4751b42e
TLSH
T14BE02BAAD971AC2B1CFD072C50844B46EB40235B3B509A5F3A3DC10ECFB4B36114585C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 414aecfdaf600c3cce054be05e0239df398449e674ee55478ae868b48056b142
MD5 4402c6ebc13c7025b73475a1ced04df6
SHA1 4bfc3fdfe72f6114c475a6ab62039f1b382b9aac
SHA512 0b303d2e0fc9002128ebe3405357041b06ab3f46a98852e50aa9c186b73bf16ddaf1d35f4145789a8addec369e6ca70cb38691d8d645b93d1f29c9ad6ef16e53
TLSH
T11C419CF783E4857D8A1156E4EB156E1FCE6D0524032C3CA289D4AE2B93F2872E14478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8258747fab49eab43c89f3b21b2c6685746d58a5b2e063d7460cb3a646503ebc
MD5 03f9e311c9c294060a585c2cdd41a398
SHA1 b8738db6f28929eeef31792b0fcd3221fb91fdf1
SHA512 050a65d46bbb0e4bd84e2bd8ce13fd33351d462a78cf7f73c010b30db0ca17dbc2118becd2ad82b1479a1307280384bd95345ccf7613cfd84fdbd45c30d17ffc
TLSH
T13C516CF783E4857D8A1156F4EB156E1FCE2D0524032C3CA689D4AE1B93F2972E14578E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fbd2f45050536442dee62cd2fd59101b1deea7f1f33a7dc0ceebc8156312a8ba
MD5 379c26d015f82bff3749cf4242c13eb6
SHA1 8f7471cf7f9e1f4c312041186ce35146be7e2400
SHA512 0f99461232d63d3611207add5badd8ea01e359c8341b8154bd46cbb0aa6406f4774dd306e66929df175825d95b76ebc6c0626eab6c316b0f568083a7e9bec9aa
TLSH
T1693179F793B4997E8A1192E4EB11AE1FCE790524031C78B289D4AE2B43F2972D10439F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7eb2eb5251715c530c808fcea55155055d04bccd8aebcf6f8c3b157ae88ee627
MD5 3dcf269ac41dcfd0a9c6e067f757f4b0
SHA1 4e9db219c38bd578e99d33b47c3a1de922ca26f8
SHA512 5519a78dc344eaf9fd2036fdc5532506b35810840d37a14d905ada0be310f6bc9f718ae49816a6e1b56f15887465aa03f89fbccb47a719b641554c6c43190cf7
SSDEEP 192:/RzoqxKbv78pTPRp/wv9DHsb+WNnSfPAktV2BAckwMapVyIsnAUgE:/Rzoqoj4NX65wGPZtV2XsaPE
TLSH
T19242C72EAD10293B5DDBD319F9257B53D7F6102161A02E94F6FC892C15E76CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9876f0a57632339df5e1874a44f34b5e5ec5d33e2fcb9c549e0d269ed78fe203
MD5 e2253f197199405ba61000908dca4bc9
SHA1 9554e2e7d4f0762941fa37d49dfecb16ca62e976
SHA512 82ce494aab5a5065f8134c71b0254a4f053e88cf57b38c808c7107887b9f895961215fed99b77f724811878a25687d7a27ecda7835ae813257fe04bf0c188d9e
SSDEEP 192:/RzoqwKbv78pTPRp/wv9DHsb+WNnSfPAktV2BAckwMapVyIsnAUgE:/Rzoq1j4NX65wGPZtV2XsaPE
TLSH
T11C42C72EAD10293B6DDBD319F9257B53D7F6102261A02E94FAFC892C15E76CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3326c8a75c0293cd2ea6d71f160f73266fdea8788c78d2cd51fd94c639498f47
MD5 d1bcae466c79c3ac64b4e0591706b2d1
SHA1 81715b5961af3afd26b9b8743f41ea1cacd0f392
SHA512 2645097c4279a90765ef521a1c9215dcd30bf9bb2720d07eedc2c93fd75953aa3000754a7a982de9f7b5423ea84311629a76ac7d6a373d835430230c2b8cc48b
SSDEEP 192:/RzoqxKbv78pAPRp209DHsb+WNnSfPDktV2BAckwMa5VyIsnAUge:/Rzoqoj4UXD5wGPAtV2Xsafe
TLSH
T17532C52EAD14283B6CDBD229FD257753D7F6102261942E94FAFC892C15E76CC322B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6e8227c088bfce6bd05cfa8c1a6e50e22b4fe61d44472d58c83332a9ad58bd4a
MD5 cbe87d64ef87125f7a0b9b24acf02452
SHA1 17410a2a2b2ce11af98205006c407c29a98de12a
SHA512 8accd274dcadaafb45bb113b670b5ed887fe4eff57d59c8988049a067a82a87c6dc5256cad1393bad9bbe22c061112ab0a081ba502175d4f888cfefe9895ea81
SSDEEP 3072:qYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:qTm7Rkm1tYpBeh2BAoO
TLSH
T143C3123B5D75A8375DB9BB1AB04E0A1F1EF249A7C930DE46C8D86A0433F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ebe35d1ead84ca8d07821f8b993a0f4ec95024e5d40cc0ed79276ab7aa2d880b
MD5 b7765151d8b28c014775db6f3c4a155f
SHA1 92b058f610787aa6ef0f2b3c7a9c683d9f8a1f49
SHA512 df24d84e624d006e99b3de0809fd578d26d28ac4d06c3666df987bcb50e1396ca4b95fbdf72ac9b6e2107fdf87a8d02d93f16e6332072ee3c9d6d1bfec5d076f
SSDEEP 3072:mYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:mTm7Rkm1tYpBeh2BAoO
TLSH
T1C5C3123B9D75A8375DB9B71AB04E0A1F1EF149A7C920DE46C8D86B0433F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9f9407a68df17971e98baa2c9f6a6ec565c2b9ba6d6dfd5f7839d8f2a35d3cb0
MD5 36aadf7585d1239641dcedb0a46451f1
SHA1 dd1a742d6726beaf3992e506a626719dc1fc525e
SHA512 41e21b5881d5e88141c956921dfc310354bf7e9b94fe51cc563dbb13bbef920604e49945f50a47ce023a6491cf01c96d582138be5138381f6f16d0a65d8560e9
SSDEEP 3072:llGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:lsm7Rkm1tYpBeh2BAoO
TLSH
T124C312376D65A83759B9B71AB04E0A1F1EF14DA6C920DE52C8D86B0433E97CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 931b73896ff29d4208bdd0f386bf50d4410aaa47a3fd22d0c2d6b9743757f5f0
MD5 6b94bcb0d475eb056e106836bd851dec
SHA1 2bef48591fb9d67b57f2977e19bad98d353da5ba
SHA512 35c697ecd5ac2627e1283e157c26d26b3c8883d1027054c11dc0f6fd3bc793cd79767006d1745baaa5a22caaf12f8fb3965ad3624f77bdd93e2eac09dce505b9
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:im7Rkm1tYpBeh2BAoO
TLSH
T1C5C3123B5D65E9375979A71EB48E0B1E1EF249A6C930DE4288D86B0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3e095c8fc5659abd3b8ba0bef081262375222106ca045ea5c71d1c27fcefd265
MD5 a93c392fa9e77e02eb18894d959979bb
SHA1 077ad2154d7fcfd69894b82ab1b3c7365f6d0178
SHA512 18ca24254a01b288578385430f5e4e2192ae241d1799ec0b01f4302381175a53af3dcbe352147093a8a5ff2beab86673775b11119bedecae990800e3d050a1a6
SSDEEP 3072:klGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ksm7Rkm1tYpBeh2BAoO
TLSH
T1F8C312376D65A83759B9B71AB04E0A1F1EF14DA6C920DE52C8D86B0433E97CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download