hxxps://189voicbegrudgingly[.]tavian[.]uk/184unexpectedness/

Resubmissions

10/08/2026, 17:01

260810-vjradadm5110

10/08/2026, 16:58

260810-vgz5hayvbs10

10/08/2026, 15:44

260810-s6rtbahb733

Analysis

user interaction
yes
max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://189voicbegrudgingly.tavian.uk/184unexpectedness/
Sample260810-s6rtbahb73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308503045112037"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 5044	1976	chrome.exe	85
PID 1976 wrote to memory of 3860	1976	chrome.exe	86
PID 1976 wrote to memory of 3860	1976	chrome.exe	86
PID 1976 wrote to memory of 1368	1976	chrome.exe	87
PID 1976 wrote to memory of 2056	1976	chrome.exe	88
PID 1976 wrote to memory of 2056	1976	chrome.exe	88
PID 1976 wrote to memory of 3056	1976	chrome.exe	90
PID 1976 wrote to memory of 4804	1976	chrome.exe	91
PID 1976 wrote to memory of 3056	1976	chrome.exe	90
PID 1976 wrote to memory of 4804	1976	chrome.exe	91
PID 1976 wrote to memory of 648	1976	chrome.exe	92
PID 1976 wrote to memory of 648	1976	chrome.exe	92
PID 1976 wrote to memory of 5060	1976	chrome.exe	94
PID 1976 wrote to memory of 4292	1976	chrome.exe	97
PID 1976 wrote to memory of 4292	1976	chrome.exe	97
PID 1976 wrote to memory of 3904	1976	chrome.exe	100
PID 1976 wrote to memory of 704	1976	chrome.exe	101
PID 1976 wrote to memory of 3444	1976	chrome.exe	102
PID 1976 wrote to memory of 620	1976	chrome.exe	105
PID 1976 wrote to memory of 620	1976	chrome.exe	105
PID 1976 wrote to memory of 1744	1976	chrome.exe	106
PID 1976 wrote to memory of 1744	1976	chrome.exe	106
PID 1976 wrote to memory of 1592	1976	chrome.exe	107
PID 1976 wrote to memory of 1592	1976	chrome.exe	107
PID 1976 wrote to memory of 4708	1976	chrome.exe	108
PID 1976 wrote to memory of 4708	1976	chrome.exe	108
PID 1976 wrote to memory of 4612	1976	chrome.exe	110
PID 1976 wrote to memory of 4408	1976	chrome.exe	118
PID 1976 wrote to memory of 4408	1976	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://189voicbegrudgingly.tavian.uk/184unexpectedness/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6e2dc728,0x7ffe6e2dc734,0x7ffe6e2dc740
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,10575816459032020016,11205656418093574631,262144 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,10895515188375784386,5175495593995263726,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15293275073894407412,13693593059955711015,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,3796228994942693763,5973573618251757698,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,2031995707732946916,16115519452102698580,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,13865150816119498723,1019649702276036029,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,10507389014551214818,229887560294523012,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6048,i,10006952585366465812,963188546043030525,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,7408288088786693373,11439530144337424188,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,8180120454346614492,15161887299110704039,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,9404310162913842971,9652261131371194512,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4616,i,6544559404629335434,11136382632391498206,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5760,i,16548549698658104948,17342299987568706850,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5804,i,9428055514251320222,8443531666123047861,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3488,i,8127060507185490467,1839869312746905767,2097152 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3472,i,1679278366629901976,9258868194986771419,262144 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,16854388227839700862,4405753965464294246,524288 --field-trial-handle=1960,i,13064617836052996444,11300669556828166237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:4408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 90cb9c403d28cb93ad9764139a253e26b7b7e2e705425501616005ea85152bd3
MD5 9c37a68d70a5083b14d3e5f4df778a2c
SHA1 399ceb46ebc1f36e0e9629b7b16b83b5009489fa
SHA512 a867f3265ff7188e2c2e8c5c435b8879ec27748c1ac6a8aaae546e2a028c440003886d6b45a45c0d78cfee0024397734beee762a848d326df7d7b44027eb0ef2
TLSH
T193E02B99D931FC275CFD5B5D50900B46EA5013571761C45B3B3C91088FB4A6B4585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 7331e0a0efb95daea19d2c9a85712e8219cc61d9a161fc5abc7518ceb04e7ea0
MD5 fd0a1e63999c3d3c95edd9783bf33e91
SHA1 44a3e9423df8c8cdeb29cd9d8758080f34c79cb3
SHA512 86ff85c84bb5e3bbdc6f3af28d38282d273b109e9693e09adaf13be521e7920841f2a14282ec85088608495dff1f2dfb9d79d178c668c71241150cff96e3d69e
TLSH
T104B0015811E65182CB8013BEA6A3485436A10DB926162763A6E865A68922AE2850B291
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 c495926415d67ca4b231e1b09608530b2feb33aafde3cf77aa8e015579300654
MD5 6574f551e97b42ce6ba5418c1b85d158
SHA1 c3912f2aadd2510adc053ed8acd1d51615609585
SHA512 c81bdb5d60a77109feda371062185ed2b202a00f7fc191ac3e13bf7b28d3b25e8705d840f93f5cec1ca28b8989118f1fa56778bd60e7d8a21b46577b96a5943e
TLSH
T104D0122B52D1304DCF6186BC51214C00A6A16D1AC42877435058AC4BC96B6E7B56B5D6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 527a2f97ac54a8c5bdf2649ae6556e9f8ee7d5094caf707908eef903898fb832
MD5 f66fb62b9ae42bb0b8158a258fddd8bd
SHA1 92e95cc94ad13ed02f427353a4f75f7dbd46a1c1
SHA512 86881fbec804c62494d13955b2bd681758c66edba36877f138bf9195f14a68cf8490367e468d3972bb9095bee69ee1a2b72a83f237e91bc153cb39862793853e
TLSH
T16CE02B17F5D0B809CF77B2BC00394C00336219DBE81423034094ED1BC8671E3E0674DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b287be6ca4f6e6ec455ebb9fc13b44ce9956bf7ec5d0c324d53e69962420bde1
MD5 dbe31af58528e8c5b86bd7f6b0cc577a
SHA1 d340e9c6de612ffacec5f08841f734e89396d719
SHA512 e6195514134a8355019904933139bf210c8d1ff7a63a113151bd26b853bcfe1b7b346bd4fa56450be04ace75702c3c2342b513e5f90397d4d78e404dcc0c06f8
TLSH
T19851CEF7C3E4996DC91192F4EA246F2FCE2D0924132C3C66C9D4AE1BA7F2876D10064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2bf85c865f12797764ab3e50cfbbf930e473655f4b1a61d7a0faca833560a680
MD5 cfe5ce0ddff645b148753e8fed47c85a
SHA1 de5f5f7d1f48bd06609363351e67c8df904ebf46
SHA512 065b158faeb92d1f448123f22d01bea0bf12dd3c7b80a3b3351337114ae8684419ca19d31f125aa1525c2e5c219d2a9d373edda3588da020ebbe8edaea35118d
SSDEEP 96:D+jcjuaIaEd1KAf6l2jDItmKjbMBCqTKjD:D+jcjuaIaEd1KAf6l2jDIsKjb4bTKjD
TLSH
T1E691AEF7C7E4852DC911A6F4EA14AF2FCE6D0924136C3C66C9D8AE1BA7F2871D10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75c4f88616fd6d64120be70d7d674b54fc297296dfd7e7f0b76ec2100b994cd2
MD5 87747e5a691c098ac275f1d83aea45bf
SHA1 cfc3f5d9e040e5496aa9fbb1acd467b1ee27e14d
SHA512 658d0e04d48c535842963ac627e27c735e71e99e3e398954a9215f575480379771b93a2b8bb09ae1e931213248b05b0d24d2c46effc719d66f16d88d97a50e06
SSDEEP 192:IRI9vMURtw8JFrv7ApAPRp2l9qHsb+WNnCiPwI2uvax76VyIsnAUge:IRI9vnXTkUXmkwxP922aIe
TLSH
T1C742B62AED10693BACDBC219FA167763D7F9203521D46EC4E6FC892C24E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 db78bb5d24c1b6446d34a1dd08cd7bd66f1c685b90c9b882ed9281705a180ece
MD5 bebfebfd37b398c6f6388c1d37c66010
SHA1 a484244c742485dd93bf1a361158fe8ecb157f55
SHA512 ca0c914953c4189a15cae7c3b7e490d55f8923f46115bc8ddf4c129b95ef43542f75ebe8b06759cbb7f3b1692e12791cb86386684ddf7cfbbc272e6113d842b5
SSDEEP 192:IRI9vMURtw8JFTv7AprPRpwELeWu9qHsb+WNM7CiTkzM6QATQ2cI2uvax77VyIsv:IRI9vnXrk1Xkkw2A2z2Z22aHE
TLSH
T1F252D82AED10293BACDBD219F9157727E7F8203521D06ED4EAFC892C25E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca7f2818226e73766abba4af55920084f07e27fb3037119ef5ea6854fc70bf28
MD5 f9d97c64433468a37b1dc32d57da2244
SHA1 edc7e45f23a45d3134f7ad1ca4935f13aafc01f4
SHA512 b19befbc31664d09a22e7065bae000627c7ab7784b65f9fbef8eeab93f23c3e6467a69aa8112fdcfd6c90c6c977dde6bda5245e87a5529ce75ee74ecb3afe2eb
SSDEEP 192:IRI9vMURtw8JFjv7AprPRpwEZu9qHsb+WNM7CiTkzATQ2ZI2uvax77VyIsnAUgE:IRI9vnXbk1Xokw2Az2S22aHE
TLSH
T13152D92AED10693BACDBD219F9157723E7F8203521D06EC4E6FC892C25E76CD2217527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0b5199eb7556c3007e192578726f5e3bdd57e49628b966f15a0a3408b00ffe15
MD5 780b951d493917a1c37a9eb839ec440a
SHA1 9d88b3bacf75ce864a3f2ee33921c902ea0c724d
SHA512 b44d06205f60b42e575ace8eb6e75ae7f556e6dcb88a250b8896b28f6823685794db0bac6a692ac75b325c82d25988a8a0d71655c15fd96c1f2eef2746e09997
SSDEEP 192:IRIZ9vMURtw8JFrov7AprPRpwWguLezAu9qHsb+WNM7CiTkzM+pPSTQ2CI2uvaxe:IRIZ9vnX4k1X2kw2Afd2X22aHE
TLSH
T19462C92AE910293BACDBD219F9157727E7F8203561E06ED4EAFC891C24E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2f8244136f4d1426dfb875e4598dbfb22043fa3784d4ea104d98eab7c380360a
MD5 0c67909f4b0143253dea101344b8a973
SHA1 d2f9367dedc2e8c430910d86a95524ef1a367aaa
SHA512 5b900fe103a1a4ee00bb70cf9dd0f1ffbccb51686149ab8a1e263ef844e34f3700431a2f70a5827eca9af29dce30564484b64274933a7eba761ba3aa40beaf51
SSDEEP 192:IRI9vMURtw8JFvov7AprPRpwWguLeWu9qHsb+WNM7CiTkzMfpOATQ2jI2uvax77O:IRI9vnXck1XIkw2Afz2022aHE
TLSH
T1E162C96AED10293BACDBD229FA157727E7F8203524D06ED4DAFC892C25E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0e27bf27aecf92bd226d36ce5d79934eeaae1e6e33029d0565e98f1d610ce62e
MD5 3494f473654849fcb24506e69853e643
SHA1 99452e853958b1fe4dbdac80a0cdff3b91fffc4e
SHA512 45f85c12f9d362ef2321353adc72c67d5bd5406a9c7c703880c28b7cb848f1593ddb74b205102e0341424b72518c529ed14547c7213cf6aec4688b60d088cfac
SSDEEP 192:IRI9vMURtw8JFFov7AprPRpwWguLezAu9qHsb+WNM7CiTkzM+pPSTQ2CI2uvax7q:IRI9vnXCk1X2kw2Afd2X22aHE
TLSH
T1B262C92AED10293BACDBD219FA157727E7F8203565D06EC4DAFC892C25E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8e3b9cc3c982a9e0539f44aad7fb8bf198725ff30d6b3d4204b5affe459812c0
MD5 3b568a9a8b86c471cd85d569c7d19268
SHA1 e8a4d936c8fc22c8323b2a6b0f5ccd222c58a394
SHA512 8acda4ee6c1dd25b4bfbb59847e4789e9c93e3b75e333f786394453eb5355e3c677191d5d6c08054b114890c1df14ab02d90dc5b8609505fdbb6dc49c1310063
SSDEEP 192:IRI9vMURtw8JFuv7ApAPRp2EZu9qHsb+WNM7CiTkz2gI2uvax7XVyIsnAUgE:IRI9vnXKkUXCkw2A2N22arE
TLSH
T13A52C72AED10693BACDBD219FA157723D7F4203520D06EC4EAFC892C25E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 34d874fa1cc5aedfc0960698e30d2230bfe15ab1725f4acfbbede9ddb4bd64fa
MD5 67ecb30a340676d0e93cbdf6ab225e16
SHA1 4c90d709654daae28b5af1828676d1c15db21125
SHA512 7e1a2f77c50ecba56946a6f9bc91bf03c97b663d67c2344075c23170b6b4a80a19af82173cb451bd3a4da114df2e3ea6c5d9b24e8594d74734cca35086244002
TLSH
T11CB0124080025602C01703F41143559C72149F10BA0A170143F07D668C2969081240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58915e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58915e.TMP
Size 96B
SHA256 3ced1d01ab69ddccb869ee467130d54edd23df38d082abc6b7f7da7eb5abd33f
MD5 44c0863de829bd6c7300c7139c77a09d
SHA1 d66dda82582e5e363c3ea83a7ee26626228102e4
SHA512 4230f5be7cc4820dd08174c1adea294bbf9e408f93f2c8cac2ac0040301c6f4dab50af7d16a1a1ad69c18b17e7afbb877ba952ed6c22eb35d2d62c2b7faca1f8
TLSH
T143B00265C2026612C45207B42E95FFE87164EF25C64B531792F01BE6DC3A6E49725570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7d4e67f1f31962433918f417c4116cf0cd158343d2e62bdbd4431b846241c678
MD5 7c08deaa58b8bb38a37e7e39f10f1eb3
SHA1 822b48dccecfee858481fb51275858416e95f362
SHA512 9b08ed99f293aaa121ebba8b6c9a1b3ff8de156b1f624862a31a609d3bab8cd5c10b3e760be9ad31c6e569d7fef3d705943f9fb7799b571b35226239a31afda8
SSDEEP 3072:WlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Fm7Rkm1tYpBeh2BAog
TLSH
T155C3023B5D75A83B5CB9BB4FA04E0A1F1EF249A7C920DA52C8D85B0423F97CD1A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 82ee4ec6a9f104bc8433f160586bcbddf278aa1804226fe0bbc4832209137d07
MD5 98e96d84fdabffaca2ca442b7653ed65
SHA1 90cc4cea31e8a60108f79905d93c43e49370e7c8
SHA512 83b73b9bd4cda01163e1c4b7bcf2f3ec60d07521c26254f4f2c4c4f1c5fcea001f08eecf4187d9550a5da52c47462ce1fb919b0d118c84fc6bc200e181d34274
SSDEEP 3072:WKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Om7Rkm1tYpBeh2BAog
TLSH
T1C7C3123B5D64A8375CB5B75EB04E0A1F1EF249A7C924DE92C8D85B0423E97CD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4f336b7600e5a8406a4d403339f6f212b85506dfd15ee25edc1988bf08998e52
MD5 5ff2cccf5b0b1cec3d635e69136a734b
SHA1 65a3f817ef8b4d23745f369c6998a53673e636ba
SHA512 033cf14542a6b41e77003a21e9a79ec8b28fbfaceb807c185f66dc6910488604b148dcd7a071f696dfef0052678e69b67a4943917827abef932ee997bfa85e5a
SSDEEP 3072:HKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:tm7Rkm1tYpBeh2BAog
TLSH
T15BC3123B5D64E8375DB5B75EA08E0A1F1EF249A7C924DE92C8C85B0423E97CD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 355eb4dc2a22615096901b45c06169f7a3ffd5709498428127fd216f8820e528
MD5 14577e3b253a5cd8aed5b77aed6efd9a
SHA1 e798a579b1cec0feb92f573a8a42d473f1f096cc
SHA512 896798a071d930b9c83ce1637edf921f0b98d8da8e9190d5e8e5060bb9c3ae51aab6866bdbf1eee41fec6fbb8b6833dca5d8e1625f14407c5669db2cf54e8df8
SSDEEP 3072:AvGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:9m7Rkm1tYpBeh2BAog
TLSH
T1F2C3023B5D75E93B5CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 f4b55411f9e54c63fcc732b368e05220752856615dab8b2a028cb65a979122d7
MD5 e047391bc96ec4f8a52dbc466dd6ee43
SHA1 52faad7c05646aaa8ac4c99dd7df69e084bc8bd6
SHA512 37600d88f327afe861b31b207047de86ac5b71ea169ec8c1794d5a2154fc018d44e98ac0750c86c563bcd0eaa7ad7aa7db4ecb23aaf483564e589cea222e0694
SSDEEP 3072:WlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Fm7Rkm1tYpBeh2BAog
TLSH
T1EDC3023B5D75A83B5CB9BB4EA04E0A1F2EF149A7C920DE52C8D85B0423F97CC1A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download