hxxp://memz cat | Triage™

Analysis

user interaction
yes
max time kernel
899s
max time network
896s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://memz cat
Sample260808-j1fz7acd96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306501180254736"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2108	2632	chrome.exe	83
PID 2632 wrote to memory of 3980	2632	chrome.exe	84
PID 2632 wrote to memory of 3980	2632	chrome.exe	84
PID 2632 wrote to memory of 3844	2632	chrome.exe	85
PID 2632 wrote to memory of 2876	2632	chrome.exe	86
PID 2632 wrote to memory of 2876	2632	chrome.exe	86
PID 2632 wrote to memory of 3592	2632	chrome.exe	87
PID 2632 wrote to memory of 3432	2632	chrome.exe	88
PID 2632 wrote to memory of 3592	2632	chrome.exe	87
PID 2632 wrote to memory of 3432	2632	chrome.exe	88
PID 2632 wrote to memory of 556	2632	chrome.exe	89
PID 2632 wrote to memory of 556	2632	chrome.exe	89
PID 2632 wrote to memory of 680	2632	chrome.exe	91
PID 2632 wrote to memory of 680	2632	chrome.exe	91
PID 2632 wrote to memory of 2728	2632	chrome.exe	93
PID 2632 wrote to memory of 2728	2632	chrome.exe	93
PID 2632 wrote to memory of 2700	2632	chrome.exe	94
PID 2632 wrote to memory of 3168	2632	chrome.exe	99
PID 2632 wrote to memory of 3168	2632	chrome.exe	99
PID 2632 wrote to memory of 4748	2632	chrome.exe	105
PID 2632 wrote to memory of 4636	2632	chrome.exe	106
PID 2632 wrote to memory of 4100	2632	chrome.exe	107
PID 2632 wrote to memory of 2204	2632	chrome.exe	108
PID 2632 wrote to memory of 2204	2632	chrome.exe	108
PID 2632 wrote to memory of 3720	2632	chrome.exe	109
PID 2632 wrote to memory of 3720	2632	chrome.exe	109
PID 2632 wrote to memory of 1712	2632	chrome.exe	110
PID 2632 wrote to memory of 1360	2632	chrome.exe	111
PID 2632 wrote to memory of 1360	2632	chrome.exe	111
PID 2632 wrote to memory of 4572	2632	chrome.exe	112
PID 2632 wrote to memory of 4572	2632	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://memz cat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9ccbfc728,0x7ff9ccbfc734,0x7ff9ccbfc740
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,8309787606484760286,11152746511569400081,262144 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,16925373789513995549,15759527415359749177,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,2755548496382787786,2878563298233676649,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3028,i,11499639742714298628,1890159499066159108,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3016,i,5636145245335514021,7650104085205128427,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,14774274476775797724,7147569092404871329,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,5788120527767969814,3229514087294910198,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3184,i,137626973269165592,3707161982468857699,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2376 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,599815236997719404,13956290990570509369,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5608,i,8740200702117588575,14562004432729706998,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,8498201369772261636,12195760264420464706,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,6862677492917066120,6137590249886151339,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,1591798963171695964,13242876854164873762,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4320,i,8380724135696849687,5498014870103779829,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4256,i,13391430194362995996,10301060865315843216,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4388,i,9233319040470092928,5173738162554160292,262144 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,8742973972381655527,701904853410019167,524288 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1540 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5764,i,16215381239612554519,7564560885295854071,2097152 --field-trial-handle=2036,i,4549680754200749425,1339187842030426263,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 388a1dd0dddde314bdf3a719024375a99a79d64de02e87b26029aea060c71ec3
MD5 a37e2117c843fe2e4bc2af2a3fdfa42d
SHA1 90c0ecd81dbca21033b81cacd45117fb79bd48f1
SHA512 effdcadd65e4729909b40a4caad3b3c97c7b97ae2bf1d053a4239fe86932c1f71371cce23cdbde2cee31513963084613639ec7432d42faa77f086ee63a428112
TLSH
T112E022AAD866EC370CFD1B6D24504606EB54231B2A51994F3E7D92098FB0A3F4296D2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77ea86f558f27df6c0d9aaf5c92f5b11224769d0c9cad195b2a35ea395d211e2
MD5 537a2cb31a39d5fef3720e1ac1f52835
SHA1 fec97de850a6f1cf70ab3739766822be07f72787
SHA512 c67bfc23790ee524b07b98a3e65c1f2f76672d2965f8994edc45c164d44dca10757a4ef8ec9b097d3ee6605902a902ec486309b0bda2692874edc00b84082072
TLSH
T1DF418BF793F4997E8A1192E4EB156E1FCE690524032C3CA6C8D4AE2B47F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 75b258195b0c82780427e34caef1075e4ae93b31514d40a1866f14c403aa7839
MD5 eb4282ef0a39e469bb0854711f942435
SHA1 6d8a1cdcc7625fe4a51730286b43fff75d4a9bb5
SHA512 72fea381cb7910b0b1a4f2c4d012b78a134b2bdaeb7203e0eb4bec4ee2a795aa44693c05c7f7d435549f0788bf287aa49eb4afadaacb0054479933a964d6d356
TLSH
T1F65190F793F4857E861196F4EB156E1FCE690524032C7CA6C8D4AE2B93F2972D14078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f74874b605a04e0c5fd02ce0a87950b4ff8bff5845de4e56315b8837d11131a
MD5 dab3baac85db2ffdafab8b5c547af320
SHA1 541cd641b0f3d981190f8d15ce84311d78e77b53
SHA512 3d1745f6b2693810c556723bb0445d715ff87cc99a6d99c0061979f7439119ae3cdd996847ace620300506ecf7b246ef8b477d2b6878eb9b373ddcc2bb262875
TLSH
T13A51B1F7C3F4857D861196F4EB156E1FCE690524032C3DA6C8D4AE2B93F2972D14068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f1a249340938b828494690e3a5fa0940b73c78d22fcbe95ce7bd3295bffe2fa
MD5 243dfc2e686e89a7e85b42b1a1313d14
SHA1 7391097a761a7fd87bc2f339bd06360516dac6d6
SHA512 daf41b5b3e3cd60baa329173fa64da475dfc2cf008f725d881c3988f5b16d857a9a9107b66f6777a73fca2ec59da8de41fac4609aafb4369506febc5a6943d63
TLSH
T1D7418BF793F4997E8A1192E4EA156E1FCE690524032C3CA6C8D4AE2B47F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f35b7549efb685517e7d861dc99a1dcd442ac9c3a8020942aa5010810c0ef849
MD5 039fd2d6ef0b3a006960e93b8e5fc85a
SHA1 f493570b8ab38bb66bee0c8935cb4def16f7e6ff
SHA512 2629e51a8fd3feaf1c59af7cc498748f1062907e35c5e9ce9d66cbe64c1b2db235cd26c3d7ef8958eaf741bfad2c8d726b2eed007adc9db0678ccd5c7f09d1c4
TLSH
T1BB51D0F7C3F4857D861196F4EB146E1FCE2A0524032C3CA6C8D4AE1B93F2972D10068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b93d9e78078128cea92cbfce5b4d89a427d4bf82dde73ce5c265fa164b795c8e
MD5 f8e8c960985aba6d28fcd7491a1c5c36
SHA1 7f0df04426956b3b242dbb668a40cf229c141621
SHA512 9b821968dcb9cd2786651a9ff99e8995aa8923925e0953196104c4e1bfac63e84d30b8227390713a131fb19052d57516c547ed4b5443e0c7a553737deccd3ef3
TLSH
T1BC416AF793F4997E8A1196E4EB156F1FCE690524031C3CA689D4AE2B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 2d08b272dbbdc6551cf549d0eab4e31289705497aedfbd43cb155425e17f4127
MD5 d837f66fe9dd37a59b5b016e82894046
SHA1 8b463de067521fe84e68f7d398d0424f1cd70b87
SHA512 acb84fec2086af40b2f83fed905ce9174bc9046759fb275361c5fa4206259aa82145e83a0f944c6f07e4b70deebc645c41f64e9b84fbc83bf9234c2677826af3
TLSH
T136F059A7E66DB4670079496B5D44B90A35F6B83501A028F4CFAA826DD081AE31B02153
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ea921c083e371b8279263302d1ab4bd0b4034633b579aa7f27775739aeed6437
MD5 99c24fa0120ad2eb9e24b8c661e6fe23
SHA1 ecb2db30d696ca276e2960b8abc3d3b44a245891
SHA512 a8fe943517654a69e5f64fa003111fb91ebdff1818ac3d25165a366dfdae868c72197b961965dd2a8c07e421adb253107a607679c1c45191978ae16083959408
SSDEEP 192:wR35px7EcXEGv7bpbPRpf419Q9Hsb+WNno/y3M2E44imi1VyIsnAUgE:wR35nQyfJXwqwit2r4iVE
TLSH
T1F352C62AB90429BB9DDBD269F9217B93D7F5103274901E88E6FCC92C1DE76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5c35cf5723780964dd636306795c58df7e146509892867e7885d12250ff01a9f
MD5 6ae1bca34b843fccd9ab6edfd0f0f9dd
SHA1 cb498fe0e00784f6df183d54c4e0a86c9b807d09
SHA512 af23d98a00c76b8440072182c83b09c92d6eab7ee8551b8ace18ced406cb40449400a6ec48d73279ebef2beac681c51f64469d96d764872336773a4909035825
SSDEEP 192:wR35px/EcXEsv7bpAPRp2419Q9Hsb+WNno/Pe44imiqVyIsnAUge:wR35n84fUXbqwiPp4iQe
TLSH
T17B42D62EB904297B9DDBD269F9217B83D7F5103234942E84EAFCC92C19E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 22c8512726628702bd6746dd9fcf325c0586147f67bb6126e59f2bec73f13193
MD5 bdb2fd6aff63ad11da03e7596b47af34
SHA1 278c35949daec49f77ee78cbc95717c1da32b003
SHA512 8cf6d907905ae262c051a598be2a0e98f7bcba291154912ddc0e011f9bd1949f3ce93fddb0a9cb30febdc7f44756871c6dc36d10df745742e30e7b609c2834ef
TLSH
T13DB0120080415201C04247F81146149871185F14D64E1B0643E07F72C839161C514450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587606.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587606.TMP
Size 96B
SHA256 fbb3ae4b0ffd4ed0452adfae11cacbc669bfc96d7fbeca02da275e93369e01a2
MD5 540c988fd56387519fa3aba0473c45c0
SHA1 b4b9203d6efe4ac94b22ee45b8485246d848d513
SHA512 9145c84fd4b8dbeb60bab05c817df11cc331bb045184b8b5f256fefa34b96d408af85cbc1849e680eaf69aa1850bec5dcf1dbd70b6de380a3e9faeabbf7889cc
TLSH
T1D6B02200C202F202C00203B0308380C83030EF2AC30B020282F02FB2CC282302820020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 567d4107d5232624090a96a4dbb7a6a326cb9ffde1165c46261b568ec9d79565
MD5 e216d66763ba2067821bb71291bde259
SHA1 98ad7d9dde5c011d8d0a9d4f4032f1212b79dc90
SHA512 1d9392b0f10b7b693c5a0a06be04a58808b8ecad28b838e423a1fbd4d3f3d46722b6538dfd46b548bdfac1ed25fca83e4db93eb7bed9c08ad8bf2368e812b1d9
SSDEEP 3072:Tq4hqdestFKTqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:/hqdVt8TqfRRVZFX8KZGES4F
TLSH
T1F4E312B1A81FDA1B9B723308D3CB3F0FB96E75859266958079DA443F44873C52323B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fbe22ac7b6e07b2c76870ed8a6e5b7bbc54d380805a085a8afd799ea3c871c98
MD5 adbe37aa8e1bc8b37f5e7a40b563a9ca
SHA1 2230e54b08a7dd7aceecc92a2e57ef9a37a1deec
SHA512 59768cc133b9fd26adab34770d69f8c10176f9396f60acf281ebd507f18bf11139d3399d90f8c6225b0326fe784b0e8c121aa289b46dbcee926f87b089f769e6
SSDEEP 3072:sfqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:sfqfRRVZFX8KZGES4F
TLSH
T17CC302F1A81E996FF7A2630DC38F2F0FF56EB142D1296980789D052E54477882363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c002c18e1f5c4da4627d24045db27ae6c89d470ee30c522e95b6811c67ecab17
MD5 e95a1603fa22da6d9779031402d60313
SHA1 e20f5a64371b92d3537c9dd4a691ce1316bf0afb
SHA512 d4cc04340587d5d2c0232e737d7dc7f3dde746260fb60379010424b07208a81fbc19a8a3bd8ff143241868fd49929d6b4eb714cfc3152613a2720540fc7928b7
SSDEEP 3072:lqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:lqfRRVZFX8KZGES4F
TLSH
T190B312F1A81AC96FF365630DC3CF2F0FF66EB141D1265AC0789D452E98477842362B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a2ab603e696320d672fde5c022167483e4992c7dbb08ceb3f0902d6704642169
MD5 b0594e498985d882cce67c6d825fe44a
SHA1 1e4e66a87f5d4270635d12e49ed0a3f14f3bcbb3
SHA512 667f58f471d71926cd07e66558d7ef6cf65eac4c1ada44fb3e3a4b4a766c7ac67992b62c47882fb64267256225a28d8104ae2a01e7e99fba6fa340ea49e0fddb
SSDEEP 3072:UqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:UqfRRVZFX8KZGES4F
TLSH
T133C312F1A81AD96FF792630DC38F2F0FF56EB182D2255A8078DD052E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d1a5f39febf10e0e130751447984b0f55cf3ebf1e5db8163a168a3e1a34e6072
MD5 67e2090e512e0f1812b52ca85f90b999
SHA1 b5d2f17f48d5261a01b670533af07f595b066492
SHA512 139f7610e93db2c9515ba89d05f9cd8528226bef64e19b7985992fa9214e30d2a59ad27374c1039ecb3d6230addf84793f3e3abdc282e82d36460983bb558fd9
SSDEEP 3072:LqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:LqfRRVZFX8KZGES4F
TLSH
T146C302F1A81AD96FF792630DC38F2F0FF56EB182D2255A8078DD052E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download