hxxps://ww3[.]appgate[.]com/e/863411/event-secd-2026-fall-tokyo/ccc3pn/5465751736/h/qDy4hhfajcCZaUZ1O1GLy2WBE8Te9NDWesIsikPArEE

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ww3.appgate.com/e/863411/event-secd-2026-fall-tokyo/ccc3pn/5465751736/h/qDy4hhfajcCZaUZ1O1GLy2WBE8Te9NDWesIsikPArEE
Sample260804-as3dsaab22

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302771022100918"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3788	3848	chrome.exe	85
PID 3848 wrote to memory of 1308	3848	chrome.exe	86
PID 3848 wrote to memory of 1308	3848	chrome.exe	86
PID 3848 wrote to memory of 2260	3848	chrome.exe	87
PID 3848 wrote to memory of 3144	3848	chrome.exe	88
PID 3848 wrote to memory of 3144	3848	chrome.exe	88
PID 3848 wrote to memory of 3724	3848	chrome.exe	90
PID 3848 wrote to memory of 4672	3848	chrome.exe	91
PID 3848 wrote to memory of 3724	3848	chrome.exe	90
PID 3848 wrote to memory of 4672	3848	chrome.exe	91
PID 3848 wrote to memory of 4892	3848	chrome.exe	92
PID 3848 wrote to memory of 4892	3848	chrome.exe	92
PID 3848 wrote to memory of 1424	3848	chrome.exe	97
PID 3848 wrote to memory of 4820	3848	chrome.exe	100
PID 3848 wrote to memory of 4820	3848	chrome.exe	100
PID 3848 wrote to memory of 4536	3848	chrome.exe	101
PID 3848 wrote to memory of 4536	3848	chrome.exe	101
PID 3848 wrote to memory of 1652	3848	chrome.exe	102
PID 3848 wrote to memory of 1652	3848	chrome.exe	102
PID 3848 wrote to memory of 1096	3848	chrome.exe	104
PID 3848 wrote to memory of 4760	3848	chrome.exe	105
PID 3848 wrote to memory of 4568	3848	chrome.exe	106
PID 3848 wrote to memory of 2956	3848	chrome.exe	124
PID 3848 wrote to memory of 4668	3848	chrome.exe	126
PID 3848 wrote to memory of 4668	3848	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ww3.appgate.com/e/863411/event-secd-2026-fall-tokyo/ccc3pn/5465751736/h/qDy4hhfajcCZaUZ1O1GLy2WBE8Te9NDWesIsikPArEE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed69dc728,0x7ffed69dc734,0x7ffed69dc740
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,10392169794660670277,13127232340816027748,262144 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,4936535727983704379,8975300328558150167,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,6645314591825793712,4838376740035598337,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,4967964530101687217,11970631877300150848,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,9577744445011455837,1832944273945022742,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,2385334058400029901,3651059055900693185,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,15727312193383556791,2722793698063154684,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5484,i,7154555253751900383,13072714599539070683,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,14452675007069324000,14255573510098391017,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5408,i,4317257679755490195,7357366516489661439,2097152 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,3663289966066313625,4129076671913825561,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,16306246892842637929,16678369112115795675,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,17119507747162988257,10991243764856788938,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5540,i,15720120071189946631,14937244095425398392,262144 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,11184598088243436287,10808050037712777135,524288 --field-trial-handle=1988,i,4139247706553245091,6214139516073937960,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 841ef69c9fa8e5271a1526ed8dfc21f353098d5d11bcbb1930c2204e4611f026
MD5 458540ab19e84a2fb3b37177736a4742
SHA1 508c57ef6c616928963e042a1a050cb2219b6554
SHA512 ce90383984dd2b998a56dd5a7302a7c54ee6d45ae981080a5fa997c7e699a8770793a6bbdea44293464d4bc4e495107c1952d5eea4837b836f84d503de9597e4
TLSH
T19FE02B69C862EC2718FD0B18A0501781D755135F2A80899F7F3CD10C8FB56365585E1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 edcecdbeffa1146fc6ea3c57a0036a07639d39784609c675ba839167402e5aed
MD5 5361489282b7b53514ff7cab029f9d82
SHA1 d8db716e99150aed42c3ed6d6efbcae023751b4a
SHA512 1f4409f7b81079468bcc6182e32106bd297e9357b621bfcae4a8b1ba1c29f5e3091d8bede7742f366411b84bcc0b6ebb26fd3cecff61f97180afab897c0f8b00
TLSH
T177313E571B494C4FDF12B33490FE080D3B32EC9826D79DD97B80607A2CAA30D25C5265
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 0c606129264552213dd24336dedbaaacd85f0ddce6551c4693c745f4560f0475
MD5 7ab18b23c1969ef2aee14f703d1f5282
SHA1 bdad17835d22d62a93490f45792288e52969f4f3
SHA512 f856458af91e5e3ea2733b37179ed35746c7cdaff2b67d3fe69f0a0f0843cd7dc6f5df37814ae12a9ff7a9d8289856c8da5de36ce16c0c00775d94537f31415f
SSDEEP 192:DXcB9iHTBe70daaIaEdIrlD6Dk8ViN9VJ4RgdPSVNT+hXh3OP2BD+fJHVXV7cfEX:DXcB9iHTBe70daaIaEdIrlD6Dk8ViN9M
TLSH
T177329BF693F4466DCA1162F4DA242F1BCE1C09964368381A89E46E5FF3E25B1F181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 837de16dccb13035c102b49510665705ef2f537e6837ef7dd1a04a051573b886
MD5 455a04dab413f73796f7d7ed8afb0cb3
SHA1 c9b6a28d0b5ce1a8cf298ee353bf3c286eaf4e58
SHA512 6a93a2c4615d0d7c9f99c8f4e32299076708ea571e62abe98f067404aec6ff0c1e28c0f65d8775568cc85f642a3fd4d2a312621abf1fa59eb702403726586c72
SSDEEP 384:DXcB9iHTBe70di7aIaEdIrlD6Dk8ViN9VJ4RgdPSVt+hXh3OPyD+f1VXV7cfEYV7:oQAjFAbjw1m
TLSH
T12B42ACF693F4456DCA1162F4DA242F1BCE1D099643683C1A88E46E5FF3F25B1F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 99e2660f00724678af37edcca8b5448e4725058796329eab672496d011e59416
MD5 55bfc2d6a45ab64089060c07113117b3
SHA1 c1412231feed8bbc0f20eda6a7f3e1fd7472c0d1
SHA512 6ab7de7d8c4e36e47ecdf17622de54befec6104fbe83f816127d3e8feebac475cb3d7af549a18a70b16f825665e13d8b0e5f0f23583ceaf894a9a74fa7c167da
SSDEEP 192:IRLh7vwYI+qZZfv70pAPRp2dj9+Hsb+WNn0jPsi25e4XVyIsnAUge:IRLhg+e3gUX68wAPD2jxe
TLSH
T1BD42C62DAB50697B6CCFC229FD617B53D7F6102225912E80EAFC8A2C15E76CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 38f51d5484f08af3f3ffb4a688ed091daeaed9a23ffc8d1c0465c0160dac9941
MD5 1d9d8cf43ff1324056f811dd9ef202fc
SHA1 e6cdf43adb34dfc4b7cb65f9c6c1f641e0a0a72f
SHA512 555e3be28ffed5f28053f5907f4920d1d4324eb30c634346174e8afee5d9165c75d2a0bfaa3e7bca47447e18f811b8f5b5af647f9f8aa9053bd58e248d76f1f2
TLSH
T1B5B0129080415502C01347F4114618A87114AF189B0A370153E06962C8266508615070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ef1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586ef1.TMP
Size 96B
SHA256 5d581759c355950a49717a125138d5f16b404469ddcfbaba18ee7fce08dba469
MD5 88291b9819eb1ef04303f8befaeb4834
SHA1 49f8c45acfe142036f2ec34d90a46acad2806b39
SHA512 a70591ede087946ac19d7a32c124fb20d1c9a4750e8ac43298f495b6891e4ee45c9b958454dff39b3a71a6453491169d31d23b9864a7b224c6fac6e76871f14b
TLSH
T1D3B02288C003230BC08203B02C88E0C8B220CF20C223222282E02A32CC30A208A22030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 21679cb3e6d6be9aae0116f250c5fb0796c348d674bf7d66b831c00fc0d85573
MD5 5ffd489edad1414dc7495ed2f459cf73
SHA1 7ea1c1e65c8f5e22f39c5818686d1bb9a0483518
SHA512 8fd5171694cc0eb654eb65800d2ebe18086e5b54559e8797cc53bb70f57eaf83dd3d85681344fce310db4a7642bc51d0687a210c57f669b008ac50d0824d5057
SSDEEP 1536:14cyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Cmqfd7NtZL8cHQRZEQ6Sps3
TLSH
T18BC30237ABC61F339E83CB64B5130FD797F644A99034D301ABAD37EB688359564424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 201c9f65e83ed7757367ed1574ac89d98b881a5ce0f6c68aa9f1b2961e66bfda
MD5 ab6a4b8bacd09e853cf86dbafc5ca7a1
SHA1 2f83d9a9623ef77250fba06b470cd18eaaf72263
SHA512 b847a8a31013bbef8d6fa30a6930aff20c9bbcc8d749d728510d2eef6edc8eba50c4ffadace3e18a039634a0d21e3a8d923b56caa1cb45d7e7d3cfe6d1fb0a57
SSDEEP 1536:1xByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:nfqfd7NtZL8cHQRZEQ6Sps3
TLSH
T15CC30237ABC21E339DD2DF60B5130E9793F644AAD034D305EE6D37BB6883551A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 37dd17585cb3cb5ea785254d255145ff2e7855de25d1c9261a1d724a885933eb
MD5 2dee2a92f70f2eb32fc0daa6acb33c6e
SHA1 42aae7924b87e0241ee7f8c6612f117bb0cf4d25
SHA512 9a3b5ed59188113afeef674343cafc47ef01bf37cd3f6fab076791aa1805f6c1d5bbc5e4f8da60eb4488feaee93df50768669dfcad7c700f80fb661e9d91f58c
SSDEEP 1536:xxByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Tfqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1CFC30237ABC21E339DD2DF60B5130E9693F644AAD034D305EE6D37AB6883555A48289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ec4bef0f12a6466f7cc582376c6cd7d524ab340c2c210ae259713636be15ccd9
MD5 130287ee6fdeba169b7a4de6796b70b9
SHA1 f6d43f70a6af9966f9d38619096141134840e003
SHA512 9c02c294ef89917b342293e83df2d393feb413cef6442b3e3f5cb525f32a5147ec0da733d40791d8c97f5b3c8f40f60397251d223a673a879537a6285e019b63
SSDEEP 1536:byLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Gqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1C0C30237ABC21F339E92CF64B9130FD657B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 58df63cebf062d357a5b29719fd56514594d2993180fd034fab64e97834ae27d
MD5 11d3741229319c86d01a935528ce892a
SHA1 ff23e7cf0930626ecd15f9cde59e07baeb62ca2f
SHA512 d04a4ffa78e5227f803ff18d9f3d0dbf1b1ca6078dfa8c80401e4aacefeaaf02e35422286b6523c3773815644fca42f7555b1f9e22390a8afbabc2a0ae9b9afe
SSDEEP 1536:G4cyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Tmqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BBC30237ABC61F339E83CB64B5130FD797B644A99034D301ABAD37EB688359164428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download