hxxps://tntn[.]omeclk[.]com/portal/wts/uc%5EcnB6hB%7CDbcgAwaC%7Cxz6mAszvTd

Analysis

max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tntn.omeclk.com/portal/wts/uc%5EcnB6hB%7CDbcgAwaC%7Cxz6mAszvTd
Sample260806-3jdchstaqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
980	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305327505899806"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeCreatePagefilePrivilege	2216	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 952	2216	chrome.exe	85
PID 2216 wrote to memory of 980	2216	chrome.exe	86
PID 2216 wrote to memory of 1652	2216	chrome.exe	87
PID 2216 wrote to memory of 1652	2216	chrome.exe	87
PID 2216 wrote to memory of 4724	2216	chrome.exe	88
PID 2216 wrote to memory of 4724	2216	chrome.exe	88
PID 2216 wrote to memory of 592	2216	chrome.exe	90
PID 2216 wrote to memory of 3244	2216	chrome.exe	91
PID 2216 wrote to memory of 592	2216	chrome.exe	90
PID 2216 wrote to memory of 3244	2216	chrome.exe	91
PID 2216 wrote to memory of 3776	2216	chrome.exe	92
PID 2216 wrote to memory of 3776	2216	chrome.exe	92
PID 2216 wrote to memory of 3472	2216	chrome.exe	93
PID 2216 wrote to memory of 3472	2216	chrome.exe	93
PID 2216 wrote to memory of 2176	2216	chrome.exe	94
PID 2216 wrote to memory of 2176	2216	chrome.exe	94
PID 2216 wrote to memory of 2372	2216	chrome.exe	95
PID 2216 wrote to memory of 2372	2216	chrome.exe	95
PID 2216 wrote to memory of 5024	2216	chrome.exe	96
PID 2216 wrote to memory of 5024	2216	chrome.exe	96
PID 2216 wrote to memory of 4264	2216	chrome.exe	101
PID 2216 wrote to memory of 1508	2216	chrome.exe	107
PID 2216 wrote to memory of 2604	2216	chrome.exe	108
PID 2216 wrote to memory of 2328	2216	chrome.exe	109
PID 2216 wrote to memory of 1032	2216	chrome.exe	111
PID 2216 wrote to memory of 2404	2216	chrome.exe	112
PID 2216 wrote to memory of 2404	2216	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tntn.omeclk.com/portal/wts/uc%5EcnB6hB%7CDbcgAwaC%7Cxz6mAszvTd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffdba2c728,0x7fffdba2c734,0x7fffdba2c740
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1576,i,8500096707177555495,15318155732291008839,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15565267877195400311,10744743863514710527,262144 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2388,i,5967668039981853579,4990055939412528653,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,3822654557267229226,15835717507407358545,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,6032116823431532742,3239683019117915052,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,16201332486286726213,9883589827367830386,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,4619737684815935729,12685913838658836185,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3444,i,5754544369451139894,10475789214502154178,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4880,i,15645704499498212678,14861459206182171058,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5284,i,4547022412677616764,6982901696600578146,2097152 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6160,i,9186528474148957376,2755167674639976557,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6308,i,857384045021440351,12769040710718741932,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6244,i,7318962660637046984,6725665938765170222,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5456,i,9407485435990038039,13539033646531357555,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4464,i,12258047606711705920,4194037735516736212,262144 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3220,i,9699159497378114676,14344751057058584350,524288 --field-trial-handle=1572,i,5524024172195552244,12806192728028746101,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59be0fec-d2a5-44d4-b1c1-061ba02dcb18.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59be0fec-d2a5-44d4-b1c1-061ba02dcb18.tmp
Size 414B
SHA256 9afb150008377770ff0a6d8984f2270e4a56f179a91d3a5e2d23c7c266c273c5
MD5 270ab7fba385488c4a95c6edf9b3ee7b
SHA1 7056302011c6ed9a6cdfa56dd99e96e9fa16f00e
SHA512 4b2f7e85e43fdb10a54a0e05a28f44ff98b86605564a03539e72c92a296789e60d258429177bd1fdd0f2588e4dcdcb925a3dc5abad0e31dc3b590d4f4741c6d4
TLSH
T19BE02BB9C920AD2B0CFD071824594647E75523572B50456F3E3DD609CFBA6360586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 072598228621fb6f2a55d44bb982738b47968d8c7607cb493cc6a50fa57f196a
MD5 49474cdabbf8c178d16e2e881b9b9b02
SHA1 f0617dc33db23660b34e9236af9a7f5881d53ee0
SHA512 5c1014890f55ee83b7a2c9a43c30eee36dcc00d915b0931943e49fedf9b6e7ff267a4e8e5b2177a8f718fc492ea5adf9e375f2c9a3b4852806efaf12ba6ba126
TLSH
T193312E5848ED2448EF120A77E0EA7CCDF6B3574422A74FD77396A0B828CE3DDC812099
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0f4716548ffe1b1e3f7a9a56b4e07428d442782b010a512c7fc3ccdaa9fc5187
MD5 1eb108812d9be92ac6a927d8f327f182
SHA1 cea0117c8d4347525cefd5334cf48e7dc79dfc3b
SHA512 16e25c79d52cee349540c922eae59678741ae6c99c98e2f136696465733fc36a90919baead550d92a98ce15419256e155069a26509a96883514d0e1b55b437e2
SSDEEP 192:DW5vdFnHU0PaIaEdpXevlvD3Xlq9hvVsikQ:DW5vdFnHU0PaIaEdpXevlvD3Xlq9hvVp
TLSH
T1F4E17DF7C3E4CA6D8C0196F09A14AE1ECE6D0658422C3D56CDD9FE4B93E34B2D21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a7ffca5728ad2afdb3c5d320b812f1f80337f211360727e2dbebdb9befc3e53f
MD5 14f8a5208a5f449d6bc1598c99c89e7b
SHA1 f95e69cfe7815c2023e10b87cf855d3d88b52d89
SHA512 87417484793884064289a3bb4fc0eaa59ad78ad88cb405eeced44e1593e6f49f7c4e0decf9f8485376e911375754ae166292ccbd4750b776d93fd6f5941dc33b
SSDEEP 192:DW5vdFnHU0ryaIaEdpXevlvD3Xlq9hvVsiaDjhTK:DW5vdFnHU0ryaIaEdpXevlvD3Xlq9hvl
TLSH
T103F16EF7C3E5CA6D8D0196F0AA14AD1ECE6D0A58422C3D56CCD9FE4B93E34B2D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 886c8138d165eb4d006e6c3e0377f3ceb56bc5147fd35fd6c2f3508d6b3f2410
MD5 c1c47ce64981bcb0db88393fc4f42053
SHA1 1d896a24480110d66301a9123cf3e64ba1f0a1cf
SHA512 6d4675ef5fad7f5d072044682d52584b422f92cb1bfb66ebf6839454c48072f82e7ec98af66961cc5c9c4ffa279b494a9e0a86a86e2cf4e662766d9634862ab8
SSDEEP 192:wRHM/2M4eTZv72ympZPRphIi2rz95Hsb+WNnEMisr2Lme8eFqfsaNDVyIsnAUgE:wRHMuMb5QjXA7wrJ21arE
TLSH
T1B352F86FA914693B9DDBC229F9227753E7F6102565D41E84EBFC8A2C04E76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 762724800ae05dcadd98b6dda24905022be1b4187c8d7a2885ae672800eb47f5
MD5 728e6971caf836e88a30d8985b2a08fc
SHA1 0145922ab73eb0ccd390fe037cb78784c3f4920f
SHA512 8046070be91fb7ad45642bcf8c4efeff7a9eb1664fcae1f90766e3d1938605c23adabe27fd00b3b336a2c37758b0e7beafbd415449cae9537288d43338fc8679
SSDEEP 192:wRHMi2M4eTZv72ympAPRp2Ii2rz95Hsb+WNnEMisr2sme8eFqfsaNiVyIsnAUge:wRHM9Mb5QUXb7wrJ22a8e
TLSH
T14C52E86EAD14693B9DDBC329F9227753E7F6102565D41D84EAFC8A2C04E75CC231B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bf7e91ee0d795b677c29132c90e31a0d2837cebf8ed2efc894873bd30906d703
MD5 e4fd9e585b41006325aab69a8b509de8
SHA1 4f0704d72b72c8ad67ab691e0bff87d443c2ae29
SHA512 c108fc4d8a418e0fa7588ba5245b09e1b93e91660552416646a0bd4c5fe4ccdcf51e0eff189a007d5f22e57311c88bd84b3681565476a95b2bc1d4a1214206ae
TLSH
T193B0121080015212C44202B011462488B1149F10A60E270153F4EF63C8356718018070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588652.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588652.TMP
Size 96B
SHA256 c84d0455cef4037f9fbe6863879a3d67923e97ad31e6a22c1477dc28083fc98d
MD5 603948f79d4252cb1c2ee107b0008d4d
SHA1 12885e6d022177da3ddda9a944143e4e72c1104a
SHA512 0ef9d2be0312de64f207ae1db3131945b1f51613a7c471dc6d34f6c5855c69edc9450b2fa5ff103e13d21574d20f5ba5f5ad03a5f9a5da3800dfc894abe98a73
TLSH
T160B02200CC033302C00303B02BC8A0E8B030CF28C2030303E3E23BAEEE282B00820020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 15870d8501a1248463a95bf65b7ccc5f6a35db73517ea2dfd848fc55dcdbabf5
MD5 f9a5ce5d808b6d75f947a0db936e2cb5
SHA1 5ceff816969f574e8e32b410c65c4536890c8cea
SHA512 a26d4758bba40176ae5eacd34e68409700d30a229132eec78f2a5f909fd7ab48a6d8f03cbad9893246353daa11d5683ade426c821575a3f4c2e762e256c0727d
SSDEEP 1536:dUvRyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:6qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B2C302379B861E339DD2DB60B9130ED793FA44A99034C305EA6D37AF6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 328f3490420eb26dd5199eba3b4f1f76df5adcd83c1a4c568439dc3d41e81402
MD5 cc2db534f63a28d69a1ba32fb0d51072
SHA1 cdd9644fc2ad5948160da8b4179aefedec8d74ca
SHA512 7b60cf87b85751b90631f9309c4e4e00382de7756083bd56d21695ba8c8529947425fb99c984bf1883055958a27fb4d7fccc55f4da044e227a7005d722095bd6
SSDEEP 1536:TAQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Rqfd7NtZL8cHQRZEQ6Spsk
TLSH
T164C30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 08b7f9229fbb1454b0d66c6e9908ce215f40bfb908012869e9a04026eb4d2e4b
MD5 b5678c766302a3d3e1a458762a26120d
SHA1 55a29648a451c3746e00ab1a93a1751e1ba137ed
SHA512 121a416d098a3a73dd253060fdee5bb3ef729e56fc06dab69ef4ab19354574b1fcc3928521b3b4414dbabbfe57571bffa54558974bd0dedb01e62690ca525aca
SSDEEP 1536:dgvexdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bIk:xDqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1FEC30237ABC61E339ED2CB70B9130ED797F544A99034D301AA6D37FB6C83495694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 30bb7ac72fa2d99b5ca600edecf8261b651d75c55b7bd859624c4de79d2eacb1
MD5 2407495e1409332b373b9ed6ae09e44b
SHA1 a33d182b8bfb9d47a21bdd9b9ccf9e8d6ebc28cf
SHA512 cf4256b8550402643f128c5712bac275bd7f7b3aa30f525ac7d1d245ab7f530bbfc6cf6fc923067c9e50b5a395ee0ca4797d28d250a20c8b7f274e0f9deec8a5
SSDEEP 1536:dLvexdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bIk:ODqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B3C30237ABC61E339ED2CB70B9230ED797F644A99034D301AA6D37FB6C83495654249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 0a2564140f6e6cedf8f44ce2d32d89e516c270a0fcc61112feb26d44a5370a57
MD5 4ce4a5a1b8eb4a88f466dc5f78bbc9d1
SHA1 f936d603af2b225a4381cca3c812638b0a211939
SHA512 386ef9e220a04ea4bc917b5efb0f76fad4b733d6e3d5633e3fe2216852407cc5d8b29d2a62b52b5719cb1e5d276e1841bc469ea9dea85a540fac77822051acd1
SSDEEP 3072:TX8ZyIHKZUx/SkWeRAtkpwqfd7NtZL8cHQRZEQ6Spsk:TMZM6x/STtqwqZ/ZLW3Exk
TLSH
T122F31235DB822D33CE8ADA34A5630FD747FA51EAC434D600EF783ADB58928D5A583498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download