hxxps://first-product-8943[.]sleekplan[.]app/changelog/59409/

Analysis

user interaction
yes
max time kernel
899s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://first-product-8943.sleekplan.app/changelog/59409/
Sample260814-pp92satalc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3720	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311843209906265"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
756	chrome.exe
756	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 3236	812	chrome.exe	86
PID 812 wrote to memory of 1692	812	chrome.exe	87
PID 812 wrote to memory of 1692	812	chrome.exe	87
PID 812 wrote to memory of 3720	812	chrome.exe	88
PID 812 wrote to memory of 2304	812	chrome.exe	89
PID 812 wrote to memory of 2304	812	chrome.exe	89
PID 812 wrote to memory of 3528	812	chrome.exe	90
PID 812 wrote to memory of 5116	812	chrome.exe	91
PID 812 wrote to memory of 3528	812	chrome.exe	90
PID 812 wrote to memory of 5116	812	chrome.exe	91
PID 812 wrote to memory of 4296	812	chrome.exe	92
PID 812 wrote to memory of 4296	812	chrome.exe	92
PID 812 wrote to memory of 2920	812	chrome.exe	98
PID 812 wrote to memory of 768	812	chrome.exe	101
PID 812 wrote to memory of 768	812	chrome.exe	101
PID 812 wrote to memory of 3240	812	chrome.exe	102
PID 812 wrote to memory of 3240	812	chrome.exe	102
PID 812 wrote to memory of 4184	812	chrome.exe	103
PID 812 wrote to memory of 4184	812	chrome.exe	103
PID 812 wrote to memory of 1676	812	chrome.exe	104
PID 812 wrote to memory of 1676	812	chrome.exe	104
PID 812 wrote to memory of 3352	812	chrome.exe	106
PID 812 wrote to memory of 3352	812	chrome.exe	106
PID 812 wrote to memory of 3396	812	chrome.exe	108
PID 812 wrote to memory of 4588	812	chrome.exe	109
PID 812 wrote to memory of 1460	812	chrome.exe	110
PID 812 wrote to memory of 756	812	chrome.exe	126
PID 812 wrote to memory of 4264	812	chrome.exe	132
PID 812 wrote to memory of 4264	812	chrome.exe	132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://first-product-8943.sleekplan.app/changelog/59409/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb81f1c728,0x7ffb81f1c734,0x7ffb81f1c740
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,13210524610484452151,16980180784010107951,262144 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1348,i,13083532003999434542,633735780930441640,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,6341731245078954939,5573733433209126874,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,4763433853573275937,12136991515007947611,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,15434767674845233081,16966692586709099907,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,17335208916000892493,4470454484564540736,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,10523081444610001023,15269020375191618799,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5976,i,12649944770904999355,636376837375505375,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,5053524783177722168,4557765189160154584,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,18140014622854379639,13987543641292561009,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5356,i,11392002335058324330,2807166121059860947,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6216,i,3643641160135821884,12678031682745960556,2097152 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6508,i,12730721592623973356,6850880882547916433,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6512,i,11185567427416285771,12069441680449300350,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,17031662637315023917,7831214333450265516,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6816,i,8707812092405382492,9002078525509064648,262144 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,2769846128731120479,13505995241091635418,524288 --field-trial-handle=1996,i,9683542029334602183,6204808613595189860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fe76830d15125798fc97c1433e4dbe693198dc7a885ebf7f37f9a92625c8a343
MD5 4a9a3ddbbbf11062f2b1403028e2f95a
SHA1 6ecff621d7a15f54ddff997c11e796f3d09805cf
SHA512 1631c9a9d53c854a14295c898382696c732db193d3d38facccc7b0d979c758e4c35070ef08aa598710386e25eca3b2ea5a2a7df03d535a8967aae4a79ab64da4
TLSH
T199E02BADCCA1AC270CFD6B2820910646E79003563F90DC0F7A3D910D8FB6A3A85A682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 f625077c5f628ba298ff44ab00c5afefec5ae96aebf82968cf980be026e967f4
MD5 32106642236742cfaca0da0229eb2e49
SHA1 9b8a6a569447795270cd9d6f5375197d24e21c5c
SHA512 583d06c6b129d81ba2f417cfc7c2ca4ee1b25a7129c7dc8ca019f05ae8a1fab6300fcdc7203fc86276d190e79d732b851e39683713c0acf4cf8fb1e5110c77a1
TLSH
T1D801550615C6620EEF093AB269C11A3471BC5972563B1FCAC3CD2DF3EC423A8830088B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 084d7df382f788bc60ec4060a4a817763a7315756acec0953941927df47d0b0f
MD5 6c9bd118a7b230d9e42876e8219ea259
SHA1 605a8037d453d99349443999ff98507a942ca033
SHA512 aca6f85f2c15c197f3ddc44dda7d3ef2e1f1ba646eeb122efec7cedf12eacb47ba65f9a007a6bc08a54b9282d50b4493529207cec5c43b98dc1185fd5c37a130
TLSH
T143817EF383F4896E891192F49A14AF2FCE690524136C38A689D4AE5B97F24B1D10478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 91f92f8f05b975b578dfd1758449509130927a97031f8be7cec645177811f5b1
MD5 36bff9bbc0012655e2ace9d1771d4c9c
SHA1 674f6564f47135cb3a8741d622c40c988e3a5dc3
SHA512 e57dc310dbe1151a89237d353368d030b84e79d3c5c578a9a3aa86e037e6683068de68f2f3a5888c8e5c5802e04bc59acb14d24f8e1fefd27758a025fe197d0b
SSDEEP 96:DYM5gFSeAaIaEdOqNLMpfvdCZJMVFAjhc2l:DYUg8eAaIaEdOqNL0fvdYJWFAjhc2l
TLSH
T1D0918FF783F48A6E991196F4EA14AF2FCE680514036C38B689D4AE1B97F24B1D10079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ffcd1c7b3eb7ef76ffcdc63691212b31a46f2ca068ff423856728bfae54d6f84
MD5 89cdaa6b935b4d6e40e7bbdb50f01f90
SHA1 a5e7ca768b3bac1f4a8959e2533fbf144ef27dbf
SHA512 35b7d507125b48f0c8c1e1f0cb658a4aa91c4d33b2aeef52116739e84b36eb315869e9d3d5be08fb12774a14d2a583e232ce0f632b68e1830b2814407157a912
SSDEEP 96:DYM5w5FKaIaEdOqNLMpfvdCZJMG/FHAjhEl:DYUw54aIaEdOqNL0fvdYJ7FHAjhEl
TLSH
T100918FF783F48A6E891196F4EA14AF2FCE680524036C38B689D4AE1B97F2471D10079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8a9ba1b1ee8dcafb6fa3c36082cb2f3a8a2a14655999645c18ae77ed17be0c75
MD5 32877f6951e95e40b0b438f95e22f2c5
SHA1 66100049d2b429cccff57aea4817c3c36386f69b
SHA512 2a0cedeb7e8867be205e36063e584a4af3cfa0268b2c7bf3d4679fe33cb743b6d8647096a6b03e79c72d6a629f48ef1f88131d0ba521b5f57860d7fa8baaada6
SSDEEP 96:DfyLMmyBaIaEdOqNLMpfvdCiUDMOH5/Kl:D6L3yBaIaEdOqNL0fvdXUDpHFKl
TLSH
T1B0918EF383F48A6EC91196F4AA14AF2FCE690928036C3C66C9D5AE4B97F2471D10175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9055ff0d25ab669755e30a6cae5a8bf1d455fc5daa815ebc89bf8fb7bf927ecd
MD5 271c2f7079b4331f1c8ea8d0dc62c3e4
SHA1 83b48cfd691db6486ddbeb75476d698472bf7dc6
SHA512 7c1bcccc2f6f4dfeacbf91b4b49df0164effd5f2b316d77c9d2b0db41cffa1b92ea19ded46db5a25a02b5de5cf0c8b7c396fa8f8113f4a684bb44f14ae2da309
SSDEEP 96:DYM5wgFKaIaEdOqNLMpfvdCZJMVFAjhqyl:DYUwg4aIaEdOqNL0fvdYJWFAjhqyl
TLSH
T1368170F783F48A6ED91196F4EA14AF2FCE690514036C38B689D4AE1B97F24B1D10075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5a56e4c2fb66d23278481c0258e2dd4d11dc467ae3ae6789fa279fc2d5e4e955
MD5 4b5c33fbb5173a6788e2fa25ba56abc5
SHA1 aa38ae57f8ce0e08ed47c0d780f0c2ab449adc89
SHA512 35ee5b293b027f29f85c0daffd59509dbc233246890cdfc13cbf18170306f99452bcd185d77576c64a8703cb62a1b0604ed94386c8c459a80fb213c9c26ade05
TLSH
T1F4217BD792BE7477147E596B0E067C09287EA43902C1A8F5EF5A812CE0DB5F32B16463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c65eef233162c10ddea3af8b67b3465fcb18ba1f53d2d42025d4a0e03e02b2aa
MD5 ad39e3cdd4be26f68f6bf878fc86c968
SHA1 72528ae8054ee2c7e595b7b45054139af38631d0
SHA512 bfdcf29d2c14e6299de1897969d1b4b3175b1e9d87917bfb250268ff556ed7595c16fda0dfe08d4a662fc9402bb843ade4a7ff5ac7d8baa62229336eb4524e97
SSDEEP 192:4RHFjAI9e3Idsv7cpbPRpnqD8UQY9BHsb+WNGfhTNQGN2Ey42AIoe7PajGVyIsnv:4RljF9RCwFXqprwyb2I2AIdajeE
TLSH
T12952C72AAD60397B5DDAE229F9157B53E3F5102625902D80FBFC8A3C15E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c5c3084d0dbe906c26cf670492a485924179ffa13be7a6241919dc58e0777907
MD5 500dda9190a0d6ec687964daa484f9de
SHA1 d2600737bcd93ff28fd855ddc115e259e69edc2f
SHA512 0ccef63ea1ac0b49c1de452cbd6fe2a58881174c9ac10ce1b9675681bdca6997af26eccce1c9a14c4cdd4eb96e08af8067fb947805c40c03d46cd84fc2dd1335
SSDEEP 192:4RHFjAI9e3IkGv7cpAPRp2qD8UQY9BHsb+WNGfhTNQGN2Eq42AIoe7PanGVyIsnv:4RljF9RFwUXlprwyb2A2AIdaneE
TLSH
T19852B72AA96039BB5DDAE229FA157B53E3F5102625902D80FBFC8A3C15E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e83633b72bfccc8218fc5598f2f14fe730df9038eaf70eb9abd532bc7be34dcc
MD5 aea9acd4d9bb9493d35a3a4603f601eb
SHA1 6d7ad0dffb1efb8d48213dd3437cc0f5ec7fb97d
SHA512 2e8c42ddda07194d40638b649c1594402d8fe7473df73cf8208719c9eccd7e630320d7466c00d0d880a14a2415a93e997642a79e503c9ab02f0bc405baa10458
SSDEEP 192:4RHFjAI9e3IDv7cpAPRp2qD8UQY9BHsb+WNGfhTNQGN2ED42AIoe7PaGGVyIsnAC:4RljF9R7wUXlprwyb2Z2AIdaGee
TLSH
T1E652C62AAE60397B5DEAD229FA257B53E3F5102625902D80FBFC893C15E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 66797121e1cbc71aa7206ad5d22f72e40e4fbc023bcd1002c66c62fbe9a4b1fd
MD5 8c4f55600e26eb2416d6f9327b169f7f
SHA1 e5a532311d1052eac691c36b67b26d6bbbd66fb1
SHA512 9ec6b836dcf67e7e8a77997fa593c03e95af17a7ddf4d6539da32cbea324a0b6965dc9c0beeb5ca63db3cfcae506a47bc2486377ab9f57d447b3095c54d34d4b
SSDEEP 192:4RHFjbI9e3Idsv7cpbPRpnqD8UQY9BHsb+WNGfhTNQGN2Ey42AIoe7PajGVyIsnv:4Rljc9RCwFXqprwyb2I2AIdajeE
TLSH
T15552C72AAD6039BB5DDAE229F9157B53E3F5102625902D80FBFC8A3C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 73cac22f2d9a167640738c3fc3198b7a5bea36479a6eeffc47879e23ea057864
MD5 18cb70c1526dba08bd11e8036d28ae4b
SHA1 7a14fc6767d056a693cf5fd1aea141960923cc47
SHA512 2dda4d1653b8ad0a7e491359bfdcb78f949ae983876699785f750408314edb1002198fdcfef47d92ce268952c2ed37a5d84e6c9678c338e18cba490ca5ad366a
SSDEEP 192:4RHFjAI9e3Iiv7cpAPRp2qDAUQY9BHsb+WNGfhTNQGN2ED42AIoe7PaGGVyIsnAC:4RljF9RuwUXl1rwyb2Z2AIdaGee
TLSH
T15C52B62AAA60397B5DEAD229FA257B53E3F5102625902D80FBFC892C15E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 9297c7b2e5752c38eec6bc735cfa60d26b4cc2ed336a0e6b0f96f6d13bea4ab3
MD5 8eac9f527d113e316af82b0800535ced
SHA1 9b9b1d26f89618bd6110e0e2656657f7cebe7ad9
SHA512 2bfe3a1fec2157df490c5aa7ae91bb49701e193178a990c77420089d2f865a911e594a7cd31699119a8cfa9a56addcc44997719a476811100c46b6ac18865321
TLSH
T111B012C184425141C00203F419522488B1349F109A0A178143E8A9738C3515081140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbc9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bbc9.TMP
Size 96B
SHA256 bfa0853c3c8d1de708eed52941c1ce984fcfb0b5ea3ed600e32d9af3e2f785ec
MD5 350910581f59dc835e62ed583b02f4b3
SHA1 27e824bc025249aa2b1fe66e16ae5265b24ad499
SHA512 2644c2d9c29c49254f42bd10e7cc3d9d240648cd4fa42b018a4747967524ea4b68b889ae1b2a01b479ffa141a805d3966b5e21c9a672ea98cadba95faa5fb425
TLSH
T14BB022A2C0033382C00203B838A880C83032CF22C3330B2BA2E02A22CC2823C0020AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cddac56b22aef0ce301efdac2de68b7a3e218d3de054bbdd9133c52d53c16715
MD5 dcd9d947f29a2c4268b8a6a86c6b1312
SHA1 9afb2c87cb240910e341ba922409b6ae9284346f
SHA512 e6598a05177556c7a366917d403f1c5aa5738301a8c0de10c3c0c053504e6e4d1cd1a1bfb25715ec0822cf8f5fbaf19b217e250fd5a9b7a4a17c538deadadeef
SSDEEP 3072:ShBFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:oBFmUi21rSm8uUVNSlzY/
TLSH
T1F6C31210B9A7B8B3EE9931447ADF3A148EA80D818291C90156739D415DEF3C66FABB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 d49c8155aebeeae513cb38423ce8c5631c6ef3028a8265dfc3e535285245617b
MD5 e4c0e401c9faa732ac5a85e56b6b0b75
SHA1 787e1a64efd4f2ff3c17e2f330559f3f7936038b
SHA512 2a5f66d0fa8bbd393bd912ad19a242dc19d5f97688a53bdef7574a837b5a7b0f1688c6cd2a5068639cd5c0f75fe7afcec5079a8c19d547e4973152eaeb9cbbba
SSDEEP 3072:SVBFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:0BFmUi21rSm8uUVNSlzY/
TLSH
T188C31210B9E7B8B3EE9931447ADF3A148E680D818291C90156739D415DEF3C66FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 481b1c688da24cbf97a6dcf848ba3d1205918c274ac093cf4e65b99609b4da7e
MD5 d3a3a232d4a1fb78012ddf8cf50aaf78
SHA1 32c53d53a22ba233414e09c2172a7f4bde973b29
SHA512 b5dc7e4f840c6a047f9d1e3bacb3e53572e920c57c3186bc9783e2490680d2b170fe43b3f2b450e9cafca7544539fecee28a60d5ffcf7a764870678b24bdb76a
SSDEEP 3072:SbFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:SFmUi21rSm8uUVNSlzY/
TLSH
T129C3130076E3F8F2EE5930447BEE2A149D6C0D818191C64156739D419DEF3C62FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b4f180a7026a7e3274735859792eafb966c3504d8a188964db3171ccaee09318
MD5 3296f54bd348f17d9e506553c564636e
SHA1 ae11ee9715f5e760535826d733d6a6c5fd6bd7e5
SHA512 7ddc996cbc92c5a45b80f7c1a4462e0c6c9b159fdb69878ff9519e77c665db778331be2cfd15cf7ee59f31f591f257e0fa4a6d1e189d2fb3f6561f755ac3c466
SSDEEP 3072:SuFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:rFmUi21rSm8uUVNSlzY/
TLSH
T15EC3121079E7F8B3EE99304476EE3A159E680D818291C50157739E419DEF3C62FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ce07fb6bca38480caeec125ab377b6f18b7f91d671fc0257a0031bd9b5fd54a2
MD5 ebc2c696bb87a4513045ec9e8ec8a7c4
SHA1 d174504c3bb785cb0db74998e181d67e141b3aa8
SHA512 dcc2823b86848ed6d4eb811ed10d34a7f1eb73e7e8d829dd4ca7b1ae0511fe2e472867ffff9312df56c060c90c5a3af4c3303e98d33272bac979b734dbf944f8
SSDEEP 3072:SBFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:qFmUi21rSm8uUVNSlzY/
TLSH
T1AAC3121079E7F8B3EE99304476EE3A158E680D818191C54157739D419DEF3C62FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download