hxxp://wagoosh[.]direct[.]quickconnect[.]to

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wagoosh.direct.quickconnect.to
Sample260805-bfd14abd48

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303655132710089"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 564	4600	chrome.exe	86
PID 4600 wrote to memory of 2080	4600	chrome.exe	87
PID 4600 wrote to memory of 4616	4600	chrome.exe	88
PID 4600 wrote to memory of 2080	4600	chrome.exe	87
PID 4600 wrote to memory of 4884	4600	chrome.exe	89
PID 4600 wrote to memory of 4884	4600	chrome.exe	89
PID 4600 wrote to memory of 4004	4600	chrome.exe	92
PID 4600 wrote to memory of 4380	4600	chrome.exe	91
PID 4600 wrote to memory of 4004	4600	chrome.exe	92
PID 4600 wrote to memory of 4380	4600	chrome.exe	91
PID 4600 wrote to memory of 3692	4600	chrome.exe	93
PID 4600 wrote to memory of 3692	4600	chrome.exe	93
PID 4600 wrote to memory of 960	4600	chrome.exe	96
PID 4600 wrote to memory of 720	4600	chrome.exe	107
PID 4600 wrote to memory of 720	4600	chrome.exe	107
PID 4600 wrote to memory of 4284	4600	chrome.exe	108
PID 4600 wrote to memory of 4284	4600	chrome.exe	108
PID 4600 wrote to memory of 1240	4600	chrome.exe	109
PID 4600 wrote to memory of 1240	4600	chrome.exe	109
PID 4600 wrote to memory of 888	4600	chrome.exe	112
PID 4600 wrote to memory of 3804	4600	chrome.exe	113
PID 4600 wrote to memory of 2664	4600	chrome.exe	114
PID 4600 wrote to memory of 960	4600	chrome.exe	115
PID 4600 wrote to memory of 960	4600	chrome.exe	115
PID 4600 wrote to memory of 1620	4600	chrome.exe	117
PID 4600 wrote to memory of 1620	4600	chrome.exe	117
PID 4600 wrote to memory of 1840	4600	chrome.exe	119
PID 4600 wrote to memory of 1212	4600	chrome.exe	122
PID 4600 wrote to memory of 1212	4600	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wagoosh.direct.quickconnect.to
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd5dadc728,0x7ffd5dadc734,0x7ffd5dadc740
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,11287960146005414451,11568457409453739393,262144 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,7658213044873905461,14566161144091618424,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,11813599557117296416,17359185852856279636,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,17250230263476239021,3014619937290803952,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,11973402619831238792,14581173428006009837,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,13777048864553471791,17199279864930812154,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3828 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,18032614495647215864,9354489954557581908,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5588,i,13095258887536497269,7673290736775253718,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3800,i,13992781768765187614,7383565183284165039,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5180,i,12549070518062623705,10608239104208369287,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,14508796786001086303,6416272056878294054,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,9377564308855273977,5694995824792972470,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,95136048400080541,13291492548191255231,524288 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3216,i,11226825165750221777,10110478662792701708,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5220,i,11538323815734517425,6472437729381995490,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=996,i,17556181936948353071,7908276947214610577,262144 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3064,i,9151157809609922790,841932567160598264,2097152 --field-trial-handle=1980,i,10859525832324494850,4491058543737366003,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1136 /prefetch:1
  2⤵
  PID:1212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 72c8057c4bf9870a4ae37b36b6dd9d600f0c39fae03c6f6fb96b7cc931c11ee9
MD5 c908f64fcddc00554f797b2d7ae7513a
SHA1 cf98fecad06fa4f32b07fb81685b3763efea204a
SHA512 d14635ade8b677a2f667c64dbc33cef65378cff8ebf050d54b5613c899ae847caa48b3510fe7bd98612b1441c687ee033022a518eae196c4d8cbfebd7f45deb6
TLSH
T19BE02B99C821EC275CFD472D50940646EE11136727A0945F363CA10C8FB06A70285C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f327e5cb3823bee49a9f72589a113c342cfe200b6e3160128fea682bd591c90b
MD5 a0ca1250a101a669670120f503d0c38c
SHA1 e39d9498a3f828b9ac66654ec73935b8203141d2
SHA512 21419997928b2609c9f24212f12113d0e84c4b06dc5fb38e1fcfe4c13692c8b4a661831079993497e5016d7ee34215424a9704a36d453fe325179909a419d280
TLSH
T14A41ADF793F4857D8A1196F4EB156E1FCE690924032C3CA688D46E1B93F2972E10478E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5facdc1d989a3ab34f28201e08e05df4adbaf332fce2421c4ec9574caf759ca0
MD5 d2aeaca9bd3923e581c3724274206b27
SHA1 685a1f899f9763fb47087ef197d8eb99daa54632
SHA512 8998ccce6ed93c15ac7f7f329e8f64fea87bbdacd40665158246102287ae8022991f3fdfc907c6b5613e3130a55ff34e88fcd22b2073896428d15a242cd82d25
SSDEEP 192:IR14Y2U8W2/nv7ApAPRp2Tli9qH1Fb+WNnXKPFzT2kwzTVyIsnAUgE:IR14n/vkUXfkh6PRT2hE
TLSH
T1EA42C52EED10293BACDBD229FA563723E7F6203560D42E84E6FC9A2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 88ddf8cf80cbcd4631031488c69340d4056914ff8ad2e0f57255159b8e3fae42
MD5 963b7ac19bd3fb674f9d4b665d3a0869
SHA1 d6cbbaeb1df87a75a02b2beabdc7c80ccb7326b5
SHA512 5250ce36008abb8bfb97380e99d2fa9763f08c9fadf91cf4ed4d0a04aab55ac158eda196cd303f51e040da648a5533422adfcd962f4224677316c65c7992ab54
SSDEEP 192:IR14Y2U8W2/Vv7ApAPRp2l9qH1lb+WNnXKPBzT2kwzQVyIsnAUge:IR14n/lkUXmkJ6PdT2ge
TLSH
T1B342B52EEE14693B9CDBD229FA567723E7F6203560D42E84E6FC992C14E75CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3cc5f919583b70a5106edfa0ac59b25d5879949909f17fad9b643a60b02a0571
MD5 70169e22835aa812df6c099947ae5164
SHA1 d5e86917a697cabc3665ef377443a214b3db5f5e
SHA512 b5db7c506d3ec7091a95cb9d84dbc1014372bba345441ba63b65547620b64745dce01b06b78460d4c09658c68f24e3953c7b70635cd033af2e408da3cde330e7
SSDEEP 192:IR14F2U8W2/Vv7ApdPRpxTli9qH1lb+WNnXKPwzT2kwz5VyIsnAUgE:IR14u/lkzXakZ6POT2LE
TLSH
T15652C52EED10693BACDBD229F9567B23E7F5203560D02E84E6FC9A2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 523f7ebc0aab485c689a7e8e1f0aebaed5b01708c56b1488321c278e964d635b
MD5 55219129daae0ea587510dfec73242e5
SHA1 d6e7812c1a5194c1e4473d1266451799c6623024
SHA512 439b80cab60eb70987964c05939996f3846970a7e8d2b019e6268e0974c35172b68818ceae31bc527af8dc73d09d9fc92b0b6fda34de0024cdfa6f84b12b2a87
SSDEEP 192:IR14F2U8W2/0v7ApdPRpxTli9qH1xb+WNnXKPwzT2kwz5VyIsnAUgE:IR14u/wkzXakF6POT2LE
TLSH
T1BE52C52EED10693BACDBD229F9567B23E7F6203560D42E84E6FC9A2C14E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 44bd304c5d0a33bfddc218491434ead3b79e3bc017ae10ac2962efa84d649d89
MD5 b1eaf721f0f17aa353121e06dcc049a0
SHA1 68a0ea34342af588902b405b45f20dcc0991fc02
SHA512 38783f40340a602e662c250b525f426b41c3434d41fec805d1ff6202afc1fa22bc5459d53fc25b2dc9473947d911d5725051c6240e80b49113a070d7e0cf8a96
SSDEEP 192:IR14Y2U8W2/Uv7ApAPRp2Tli9qH1xb+WNnXKPFzT2kwzTVyIsnAUgE:IR14n/QkUXfkF6PRT2hE
TLSH
T19542B62EED10693BACDBD229FA563723E7F6203560D42E84E6FC9A2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 84a7ce99fb5055900ff4b94f72ddf432140f785613289f8ca75e9292d6887f33
MD5 e464e1fbb8fc7b48bd69ec40f7872420
SHA1 de5cdd9c6cb92480dbf7762a9ca0ba6e373dfdee
SHA512 9a06bd2203f072c4f281f1fae162488874c628caabce83cc0b233c7efdcd95803d7a8641c8c5b9d019da6bccb79a0c86e38902a6d8812039ce7fe397763fdff0
TLSH
T1D1B0124084016103C55203B81243ECC871189F10A60E570183E0A9B6C8365618419050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5852bf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5852bf.TMP
Size 96B
SHA256 622e3e36db4fbaf267736cd54d134d38eb5658fc4c67c8aa6a79e4a85e44eb03
MD5 57347150d5b297a200d0587ca27a029e
SHA1 27662a8cc49f68ac44fd633a8290c6978a1d3699
SHA512 6a8e51d9f156492df6ebd7e8e543ffb26dd58411e083f42895703a7bd10f63e94eca578b90a59a7aae2d6f9c9fdb06554f3e02a8847dfe3147d2f2c8eabd9ad3
TLSH
T1DEB002A5C1327216C04343B8259995F87260FF25EE13135292E02E66FC3AB724526160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1a379fff72646963b47952e4fadb6d7469cb6cd638eef451d05c5edd0193d70e
MD5 8dd7175b7f38c0de8fda3ef771abc9e4
SHA1 271a60ebd97bddaffcacf4cbdae8a2a44c7637ea
SHA512 078d3f9232afb95c42f6bd8350fdb52652bce37f55e64aea47e40ce97770aad1450fed12f665465c37be0f20dce25c1c392cf0076bfc4ad35a9e3dfbdf8e4413
SSDEEP 3072:GSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Cm7Rkm1tYpBeh2BAog
TLSH
T198C3023B5D64EC375DB5B71EB08E0A1F1EF249A7C924DE92C8D86B0423E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bef1020c03d466a00aede8aa811df5faa4626716476eb388c68494413eb174db
MD5 4c5cb3627c917c98296477ac539cdaef
SHA1 0370e2bf392024ab10baaeb32299ac9f2c546216
SHA512 979b91c77cb4ea31e4ff864cf75d491bbb0ed2f7b7112fb5caba6689862e0ce37694842879164e382af62b73f26bab95560ddfbc75628d58c391b20ab28a976c
SSDEEP 3072:G5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:rm7Rkm1tYpBeh2BAog
TLSH
T125C3023B5D75AC3759B5BB0FA08E0A1F2EF249A7C920DE52C8D86A0423F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b31a74aaf7597b9ecb5ed25d56e7cabfc3c8c2043654a45138716dc45ad8ac4e
MD5 74f2d1f7ccccbd258424e5120b95335e
SHA1 cbfe40cfcd9a5502ec12a3d97899f345896798ce
SHA512 bd1ee99ee060150842665f1422de2d9683cb92da603a44b8412efedc3a16ac6465de0f3a1f07379e3afd892968a068897b26e97d36b77d4491afb77f7c8ba860
SSDEEP 3072:XSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:1m7Rkm1tYpBeh2BAog
TLSH
T1B3C3023B5D74EC375DB5A71EB08E0A1F1EF249A7C924DE92C8D86B0423E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 57537c463ff91edaa9ca9e80894d9dd14d015c46992e545613806a745517268a
MD5 90c30976000f5693b1542fa8b92d1e5d
SHA1 a6c2324e1a004c918f605db257d6f974d4a9860f
SHA512 be540d813a67f0ad79e0096b8ae245cc67418c8f1cd16ef20db8448d6dff131f02bc964adf388630dffcad6fb8982e2765f9b86e381616612320ee562a4b0b19
SSDEEP 3072:AdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Hm7Rkm1tYpBeh2BAog
TLSH
T17EC3023B5D75EC3B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download