hxxps://52you[.]plus/

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
900s
max time network
883s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://52you.plus/
Sample260810-bapweadc76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4864	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307970143293294"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 436	3084	chrome.exe	81
PID 3084 wrote to memory of 4480	3084	chrome.exe	82
PID 3084 wrote to memory of 4480	3084	chrome.exe	82
PID 3084 wrote to memory of 4864	3084	chrome.exe	83
PID 3084 wrote to memory of 4808	3084	chrome.exe	84
PID 3084 wrote to memory of 4808	3084	chrome.exe	84
PID 3084 wrote to memory of 1292	3084	chrome.exe	85
PID 3084 wrote to memory of 1292	3084	chrome.exe	85
PID 3084 wrote to memory of 1032	3084	chrome.exe	86
PID 3084 wrote to memory of 1032	3084	chrome.exe	86
PID 3084 wrote to memory of 1100	3084	chrome.exe	87
PID 3084 wrote to memory of 1100	3084	chrome.exe	87
PID 3084 wrote to memory of 5056	3084	chrome.exe	90
PID 3084 wrote to memory of 5056	3084	chrome.exe	90
PID 3084 wrote to memory of 1444	3084	chrome.exe	91
PID 3084 wrote to memory of 1444	3084	chrome.exe	91
PID 3084 wrote to memory of 4412	3084	chrome.exe	92
PID 3084 wrote to memory of 4412	3084	chrome.exe	92
PID 3084 wrote to memory of 4464	3084	chrome.exe	93
PID 3084 wrote to memory of 4992	3084	chrome.exe	95
PID 3084 wrote to memory of 4992	3084	chrome.exe	95
PID 3084 wrote to memory of 5064	3084	chrome.exe	96
PID 3084 wrote to memory of 1344	3084	chrome.exe	97
PID 3084 wrote to memory of 4776	3084	chrome.exe	98
PID 3084 wrote to memory of 1108	3084	chrome.exe	99
PID 3084 wrote to memory of 4200	3084	chrome.exe	100
PID 3084 wrote to memory of 4200	3084	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://52you.plus/
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2e95c728,0x7ffa2e95c734,0x7ffa2e95c740
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11150091440179678064,10879677531328447227,262144 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9038362238726295356,6790444356873304254,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,6769420474143276139,6140470888625453700,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2768 /prefetch:13
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,10939063724756943630,1381779339096012,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,114453652786339919,16815303618450127262,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,13582066503051997905,1255092042767968298,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,1617970946698592109,3337403919212638888,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3160,i,17574480644195771050,18350986885675046608,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4828,i,11523961562372419078,12618145235350192365,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,4493382082888960204,9763999886314309027,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5968,i,12975602635602559690,12377086436776563832,2097152 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,5421305903725919442,8796160338134984653,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3920,i,1823198999276654251,6441746239279394133,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4216,i,6545396463333442087,5233434666776731191,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1064,i,7851660632368299585,12513733419949128053,262144 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=740,i,15845378668344415466,5688251928284367982,524288 --field-trial-handle=1960,i,10326261408132390373,11560106631011215868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:14
  2⤵
  PID:4200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

650a0105-0310-4bd9-ae27-ee30acaeb72e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\650a0105-0310-4bd9-ae27-ee30acaeb72e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bd26fd4a4b36f742d70a72c8f57df30076c029d5eeb3b3083d2277f76eee8f54
MD5 4d5c41598506f0aed1a313a9d827d2bd
SHA1 ee4439a6b0948049344536b65e87384c0ed03058
SHA512 cb7535e034f21604cedcc7326ddbae37e05f9a76497dc0571af7a600341fbaa043d6bdb3cb163dfb8e74d8da01e3f23452b5fa76858bb0eea6c5f778f2d19abe
TLSH
T106E02BA6CC31EC3708FD071DA455464AE751039B2781858F3A3C420C8FB177A159692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 8fb243313a8cda5014db12413d880650f0d4fde4360beec41462497472dad8df
MD5 5f1359b8154f3dfbdbfe0a619559f407
SHA1 be13e309c14a9bf4338bd92586a429bbbde48cab
SHA512 2fd1409120f8bb6186ceab7f3b00ff4bc442aa5e5449bd273455d3ea2c9ef097337d22d480fecf2e7c8da2dec7666ebe9f8969b990f9ce4f1ad3ce757e6be870
TLSH
T1CAB0121067C04D11DB9127B8DD91084917901AC94510AB1281D6044568376B681818C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e5ef225b9ff62165061add8f834d05b62c04c0de4543df205419af7443c68006
MD5 99fa8321f3ff99d69604f92f610ce38d
SHA1 94b4b55b7562e8a72970ee296030ffc9cb668d9b
SHA512 f24d7600187eca8f110cf841ef33601c673c6be10b42c81804b507fd0df789c6ad2b895aa4cce7a91e90648c29de4038726c5e804dd6ebfc0c396f186dd254ad
TLSH
T1368169F3C3E886BDCA1556F5AA146F2ACE690918832C3C76C9D4AE1F53E1871D24164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c5b19971f2d10981c3e916eaa9ffbab6b5f52a3200b8ea09afc1141411d03282
MD5 7f90cc5e886e1eae9fe4c72e342231fb
SHA1 f24680428d9ff405194f265be87f1eb184f8ad2c
SHA512 5a8a04912811f7273607ae9d92ac804d74e814d630da9663da50485edcd28d0089ed49abbc8519fe80361fd432793f748d397f3f7d74537c7db3baca4259fca8
TLSH
T1267179F393E486BD8A1596F4AA146F2FCE690518432C3C7689D4AE1F53E2971E140B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dfc15f0d878a4d890d547b95b2b7d815b2d5907278be43a13a5e334b561e830f
MD5 cbdb4129f2572fe0a28094c6d5c4b160
SHA1 6262e317872fdefda96ae8983f81f67ad992c3a5
SHA512 8ce66432222bef5498cd239d0141a163c90ea760126ae4b5189ff212a73eac146113a5906061a448c7ee11e6503b9caab67fc6fd258ce5898a646a26bfd694c3
SSDEEP 48:YALlaSXJaoDSQhdaXYfo7EdKss4sxgmzsW6s9GTsyJfLdsAKrzsaasxCs8gjhhnM:DHJ7V7aIaEdix9vGV1LO3fhjh8gK
TLSH
T1A59169F3C3E886BDCA1556F5AA156F2ACE690918432C3C76C9D4AE1F53E2871D24068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e1c82201367fc8fb3a153e2e457f4b3bce809b075d6fb5a619c7d3f6c447da5f
MD5 3156502bef884f6a16c085a5a27f3ce8
SHA1 3102a0c06d73b2ff9a5d7c3c6354c0a0a63da1a7
SHA512 5f8c0836753152b609ed3505233f7282a2d01a0883f12eb1280f35493e2849972cb58b1ace2f07951d11f893bc034b3547e694628bf21273c9ca750fb554b524
TLSH
T17D7178F393E486BD8A1596F4AA146F2FCE690518432C3C7689D4AE1F53E2971E140B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 7cc3b48fd5ec46686dcc3a97dc2f8f79d6fa152bafae8f2e7fdd6b8195e94ae4
MD5 f749541bfb72230492b97a5e16048e33
SHA1 2350cc7ee643f020a01909b8f69939ae2baf015b
SHA512 466da7cb64fbf1761ad2da0e1e0415797e41409de943d94213ac1e6ffc949d106faf2890c0979a548049fd534318f4fedf615a5f2ccc27d1bcceab56afeea981
TLSH
T1F4F050ABE26AB413217D49A79D05780924B6743502416CE0CFAB416D90D14F33B26047
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 70766805891810003fd015548d58394e5cdf53c6959a01e4c6e5b9e1e35ffea2
MD5 cd37050c9acb5fe8ff3390fc68558edc
SHA1 4fdb966a4c987975af3bdcdbc556c08e0d9c9fb3
SHA512 df51011fc9c4b2eab91314834a011388dfb864a34472e9c12a23f80dbfa0a4bfeaf80c4f37985ba631dbe8e67942991d2783757d59a6c8f2d8ecac45c442663f
SSDEEP 192:RRmrvtGogeVv7H+pAPRp2rmE9WHsb+WNn9Jamt2g8Zn2FL0ekweAVyIsnAUgvH:RRmbzliUXeUwn52j2FL0e+EvH
TLSH
T16552E83EB950697B9CCAC329FE227B63D7F5106161901E84E6FCC92C15E76CD221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 902f6b8ecc1a94bcfe02548a506105362700e719a68adcebc8b912b2428c091d
MD5 ef1c1e6fcfcfcdc5d2745079382eda26
SHA1 c4b7f8f09145163b5ae7f80ae5fd7ebcab93cd42
SHA512 fd2a578971a83619b3564b14d81d79b8538ee3e15bc65ad346309b9a3d1b563fe4101a95dfb3283d522bdd29587f992e8fcef930d3413465dc12737fc96e3413
SSDEEP 192:RRmrvtGogeav7H+pAPRp2rmE9WHsb+WNn9Jamt2xZn2FL0ekwPAVyIsnAUg5H:RRmbz2iUXeUwn52D2FL0evE5H
TLSH
T18242E83EBA50657B9CCAC329FE227BA3D7F9106171901E84E6FC892C15E75CD211B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b18b2b568eb731cd0b13d9add639b2ed1f192b906cb70be26b3f177c3f6e2c66
MD5 54f195b9931f808fa8137c2593bea9a7
SHA1 c8ad329733202112365a0b7b0bb66211f6732467
SHA512 4cb63e2e70a9151a5cc50b16f77378baeba5fd78f509514bff04eece9a7dbd15f0482dd161df8b18b113d15db854fa3bb8a36b54f333a1a4f93e10b0f5a1a20f
SSDEEP 192:RRmrvoGogerv7H+pkPRp7rmE9WHsb+WNn9JaECeZOzZn2FL0ekwoAVyIsnAUgvH:RRmb4Ti8X7UwnMem2FL0eIEvH
TLSH
T1C252E87EB950297B9CCAC329FD627B63D7F5102161901E84E6FCC92C15E76CD221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 07f1f0e8d2060f703cd5f96e2bbd68fdf68f603b2f1b071fbb4346199f713cfd
MD5 a3f6d456a72addbc9703637660b9cd48
SHA1 f3ece00d3d6af1c3c41f9c8c98d49a340e10c7af
SHA512 051be54acb708a40647cd5fbf0cab9e31d93c8c8c89ebe9474345e39cb4b4baad4ba4ba7e345d47a95e173843e4bf63cfa3eac09e4f4f52ec616f5d20464fda3
TLSH
T123B0124080016502C40203F81947188CB214AF10960E570143F07D33C827161C024090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58966f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58966f.TMP
Size 96B
SHA256 ffd205160ece5afc935023b2288e588174bc066cdcd5f19cf332551018ec999a
MD5 4210a08d3cb6beacee7de4814247aeb0
SHA1 8525dc56bac37660cc8cfca63fa2b8e2869741ab
SHA512 caefb60e5c776c88f0766bfa70864457bf1c9b079d24c06e4ce4ca534d31458ba6a0689cb5ec9e4ff05ad2e67b70983a5dbc1759df370a81a80b6925f276f3c2
TLSH
T1A4B022C0C0232A02C08303B02CC080C8B020CF32CB03220A83E00E32CC322200028830
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9a14e1e4ba47cb0916e78c69b501f1b3a3354503eff69238f503b733be4fb3d7
MD5 f0174eee39a5cec60e3a8601c70597d3
SHA1 0042ea17bf9fe81023fa2dd7517f2cbba3f4b8e8
SHA512 e5a79233c67e14ba5cc90a272c17f876325745a5bd8e5d003202e2364a213ab1e19ab62d56b72d9789ca88c5af6c20621f8af59008acedb3692aa45755b3041c
SSDEEP 3072:MLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:oWDfxA3OnjrYQ9EU0/hEV
TLSH
T14AC302A11C3ABD660DF8EE98640D3A60BFF4AC9A92875DD362ED1F4C14FB5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 6226dbec21c0a2794f40ee8c2363962c45cbabe9f5eca1f58146824d31d2751a
MD5 7d517ba8e249a0f57b0b56f4da58f77b
SHA1 25d2363c3f6e24afbd44c09ae964271b8c246f7c
SHA512 1287482799b5df4fa8f6ab50f9f4f30a482678a4d4378d5ba547e063f73c2b3db7ecbc64b2b959eeb5970269e11f7e5fdeb8ac78fe0bfbcea7ba65fdbfcaf211
SSDEEP 3072:OybzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:OOWDfxA3OnjrYQ9EU0/hEV
TLSH
T10DC312A15C3ABC660DF8EE98640D3E60BFF46C9A91476DD2A2EC2F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 dc8b9c947ef2a5eba0572526bcc25260fd0f182dd0bc60a42da8f1c5942d5fd7
MD5 87bbdd8831d1f509b10fbeec2b905f37
SHA1 10b383caf40cc18cb8a5caa716fbb3b1b11a0039
SHA512 16eb10f8ac3a9b60840c005b835c96509800d2cf9258fa2e02e0688621acd65ecb4e9b5ce0cbcd2e260812765a3836ce7e8b76dd8106f61f6a552bcb89cf0ad2
SSDEEP 3072:GybzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:GOWDfxA3OnjrYQ9EU0/hEV
TLSH
T1C5C302A15C3ABC660DF8EE98640D3E60BFF46C9A91476CD6A2EC2F4C14FA5CC1179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 45b5536c6c8602f585feae4b8ceedef320c77647f1727a512fa10fa3b93f5c90
MD5 c9dce007401f7149007764e60f692fe3
SHA1 9256212f327e2f59dd6d0ac945d0bc07c323c1b1
SHA512 b15eaec101435af0e6c720b08390dcb1dbd44e776c459311978806ae1c2f0782d85f8bc55845669b9a07e23734f5bf612409538d76a7511f4b974a58d7ea1e68
SSDEEP 3072:bzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:fWDfxA3OnjrYQ9EU0/hEV
TLSH
T10CC302A11C36BD660DF8EE98B44D3A60BFF4AD9A91435DC361ED2F4C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f060d6e216adaf0194804979ecc338d2e738e75fb53ef7b9d3a468763d82571e
MD5 ea0d0d8890cd4fbe8503f5ff50cf886a
SHA1 dd3c38eda514a4ad8fb5967ed05e0377d61b3c0d
SHA512 1d3a37401f203ec642998752ae4f77bd0a4c9bfc5c53951592cd5959b748b9e01b7f7d0f3fe379e875c8268faa11de8f282598ecb29b088ec6c2bc0f97778ca3
SSDEEP 3072:3LzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:/WDfxA3OnjrYQ9EU0/hEV
TLSH
T1F1C302A11C39BD660DF8EE98640D3A60BFF4AC9A92875DD352ED1F4C14FB5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download