hxxps://tria[.]ge/auth?provider=google&return_to=

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tria.ge/auth?provider=google&return_to=
Sample260819-c2qsfsxtcv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1048	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315805346216737"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{FB7A3601-D354-4744-9465-8CC3C92D5711}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4456	chrome.exe
4456	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 808	4800	chrome.exe	84
PID 4800 wrote to memory of 1048	4800	chrome.exe	85
PID 4800 wrote to memory of 1268	4800	chrome.exe	86
PID 4800 wrote to memory of 1268	4800	chrome.exe	86
PID 4800 wrote to memory of 3828	4800	chrome.exe	88
PID 4800 wrote to memory of 3828	4800	chrome.exe	88
PID 4800 wrote to memory of 5296	4800	chrome.exe	89
PID 4800 wrote to memory of 5296	4800	chrome.exe	89
PID 4800 wrote to memory of 5216	4800	chrome.exe	90
PID 4800 wrote to memory of 5216	4800	chrome.exe	90
PID 4800 wrote to memory of 5704	4800	chrome.exe	91
PID 4800 wrote to memory of 5704	4800	chrome.exe	91
PID 4800 wrote to memory of 1680	4800	chrome.exe	92
PID 4800 wrote to memory of 1680	4800	chrome.exe	92
PID 4800 wrote to memory of 3164	4800	chrome.exe	93
PID 4800 wrote to memory of 3164	4800	chrome.exe	93
PID 4800 wrote to memory of 5944	4800	chrome.exe	94
PID 4800 wrote to memory of 5788	4800	chrome.exe	95
PID 4800 wrote to memory of 5944	4800	chrome.exe	94
PID 4800 wrote to memory of 3980	4800	chrome.exe	104
PID 4800 wrote to memory of 5052	4800	chrome.exe	105
PID 4800 wrote to memory of 1456	4800	chrome.exe	106
PID 4800 wrote to memory of 4904	4800	chrome.exe	107
PID 4800 wrote to memory of 4456	4800	chrome.exe	116
PID 4800 wrote to memory of 4860	4800	chrome.exe	118
PID 4800 wrote to memory of 4860	4800	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tria.ge/auth?provider=google&return_to=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbd53bc728,0x7ffbd53bc734,0x7ffbd53bc740
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,91106946024970001,2937988107114758166,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,3742439501791909957,12516223169573312548,262144 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15894838704273992337,15833327301232620898,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,11193339181989079864,5034530136946460565,2097152 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,13829829683662742023,12319769800484959471,2097152 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,18285509912768672115,9067629112419802288,2097152 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4368,i,5007326939527172410,2673767878392778522,2097152 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3084,i,3415336076482062666,9207710060644246670,2097152 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,7271302406342641078,15959425529837122858,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,11831981924490478344,2768569842371870085,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,520246002627322279,8201883225411726087,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,17855329235378690130,411628875996656215,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,18224794383876356778,10275735444537308115,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,13167900013649178322,10111583128370566463,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5648,i,10189380473831671949,10317707837058425400,262144 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,6791125151044781013,3283801135205128160,524288 --field-trial-handle=1984,i,10788684112983187160,8312505326952342454,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ccde6098104e7060b960a518065a725600d7af3b455384110dbdb5c089a70cc8
MD5 d8f7e1252a4e9697096ea38819b07402
SHA1 4ff74a92eba125d3945e83d2037f95d295381e7f
SHA512 d83b7e230fae66a7420828110cded4781794a390ba3bfc48f7853870d248c42c027027f155f8f906235bc3b237758d6a2dc1b660e34801973efe18c1b460ba46
TLSH
T1B1E0E5AAC962DC370DF91718A0900745E65513173740948F3A3C85194FB472B424685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 e2fb3ea8ac6ce65e89a6911701f79d5e71c33003c241d46b2b2dd62182a16823
MD5 ee282d634f00d14d32963dfeaf81be67
SHA1 bac7a338eb51f61a557f9f75db4e17f020eb5921
SHA512 a58d175a4e992c993bb0678100eb62cb6633ec05b6b226d5462269431aaf93481e96b03ad9fca74f7687829547205f6efcbbd903e5cfef6faa6bcb0f22fcf711
TLSH
T14CD05ED5C3043081C35061B190AD2D3FAD6D45AC1387036349A17DF03F4FD2C1612246
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 7a0dcac16fd0b4088d02fdb7e0833ebd04a632ee01724b2285234c8fef82e4dc
MD5 6647855528dd7eddb034c79c6d76dc6e
SHA1 665e4154d5a53bec753ccbcaad110dc80969deb2
SHA512 f2ec1c88ab975cc35ab5ec5cf6d3a676a9f337ed04d8888c8e0ed2c2294fcfd66b569c8bf359441ac77e33f8bfbd137883712357f3d3d3d32e55ff3f1e3ce53b
TLSH
T1E8E017D8D3087000C36162B190AD183AED5D5A6E5397065348A1BCB47B5F92C1616286
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 cffb69aeafc383738ca02bb81e4a46a23820c3cf6b53536ff58c13d7a3ea58e6
MD5 5dd41228b8685b2614c81a73902cae2b
SHA1 f768d719ea657a406d42ea2833224e3d7ef8b345
SHA512 f96c10024565b6f9456e3cd05a2b4bf8e9616cda13c6ef52827439e8675dfc2dbeeafb699684e57d68a52d0039f15c23846f46d31ee4acca37842d398e0a76d5
SSDEEP 96:DQSVgXQDU2UNaaEddFTIGEXpZ22xPozRv:DFaADz0aaEdd9IGCpZzxPozRv
TLSH
T10AA16BF7C3E8853D891156F4AB156F1FCE290A24432C3C66C8D8AE1B93E2971D21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 30bd0ae05be22e6ea8ae4de4ca21bda0d7c1b4d97275de23c721d1d98d0dcb59
MD5 1d336d287169bedab92be0a55489fe3f
SHA1 c09018f7e79a8511e1e207a3c164b6e168093645
SHA512 73109488f2ef8608818ac813d1adb3832f071de05c8be32b66b6755ed3b6c721707ac4e3b7caa36630ba1c605be6457c8ce6133017ede4a0874402bc3efff3aa
SSDEEP 96:DQSVgXQDU2UNaaEddFTIGEXpZ22xNzRVZ/:DFaADz0aaEdd9IGCpZzxNzRVZ/
TLSH
T177A17BF7C3E8853D891156F4AB156F1FCE290A28432C3C66C9D8AF1B93E2971D21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a90e7673633923b7526c767985d3719b6869eab3e7b3ed1e1b3869cfdf667bfd
MD5 2a1af1a560eff13b4b47050647973fe2
SHA1 653ace9ac035361a23b36b19c6134a8e97ca0b74
SHA512 71caa06b08b6d896b53cae9f115c74d612e4023315d47a32858e7697297576221565311ad59c79ac5aeda1e116ecbc91b3adac059fc90f6d04ef8f7cd5090f27
SSDEEP 96:DQSVgXQDU2U1rzU1VaaEddFTIGEXpZ22xN3zHAv:DFaADzo3uaaEdd9IGCpZzxN3zHAv
TLSH
T198B17AFBC3E8852D891156F49B156F1FCE290A28432C3C66C8D8BF1B93E2971E21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4a6b037bdc89d7933790db710f965dadb064307b5118ac364539ac42584eab47
MD5 481a566e145943f495432accfe44e37b
SHA1 eaf03ef83d17eea7e217f841c416989648e96c7f
SHA512 0d865a3a7a57929b2a83b20e78c905d05d3bcf4e748b350e019ced08205106835ecdedc28060b85b0cc7fe6e1ba2d1cfa3316ba7dbbd7c1532b2f665ce3c40ad
SSDEEP 48:YALlhCqnhvgh9QDhW+afo7EdKsAWgmzs28WCT5siWtsFTYWBKsKWqzszYWFs6W2n:DQSVgXQDU+aaEddFTIGEXpTXq22ox6K
TLSH
T185915AF7C3E8853D891156F4EB156F2FCE290A24432C3C66C8D8AE1B93E2971D21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a052c447c4ffd517922d2bda587a8d3c112cf6667ceb0be860b6b139bcdee2ea
MD5 b304438fb0bd35f5c51d6d74859dfc18
SHA1 699b4a227bde7faed52f868c297b206dbe16be1b
SHA512 8d5d966a12e56474fbcc9083e6a0ccf0e62b5cb18ef0e17902dd2a4af26e0f8793154d575b48e6e246ecfca8965ef466c56385fc8f39037596b34fb65a08f928
SSDEEP 192:5RM5nryuKzXv7FhpAPRp28U992Hsb+WNnIoQzo2wb27dnOaC6oVyIsnAUge:5RM5rIz/hhUX8QwDj2q27dOaCe
TLSH
T1AE42B32FA910687B6DCBD22AFD227757D7F5102121E42EC4EAFC892C24E76CD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e0a4de19d3416f3ff39c5e9e8c3c9addd11d5f8ceaebdc17270f2a3b17b20b25
MD5 16537e240577b503869dc8b860d7674f
SHA1 e6f2c089c2552441c746b5605a00a19dedcba11d
SHA512 e547f295a2d90556c20bedd330751757cd7731ce64458c8410477ae6e4bd2f78f12913bd31f2f83eb58fbab262d20b2d1cfdacbed84e588a30c2860b1205ef7e
SSDEEP 192:5RM5nryuKzgv7FhpAPRp28U992Hsb+WNnIoQzo2Yb27dnOaC6+VyIsnAUge:5RM5rIz8hhUX8QwDj2y27dOaEe
TLSH
T1D852B32FA910687BADCBD22AFD227757D7F5102121E51EC4EAFC892C24E76CD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 36772fbfbcf62141b13e744b7e9d7810ab2d2fe28603b211e1889d4f4790d0ab
MD5 82333770a3cd30f0b401c526349a8414
SHA1 b6feddedc4c24b44e79aa1f52800445dac5fcd0a
SHA512 b50ce0839a0d4d850a799d179654b36504ab88a058f12d1a3a66f4a6dbb23b136d66cf2081cad115af10b85f9057c3b19b4b450d3790750ab9dd63797a25a4ac
TLSH
T1BAB01201D0026101C84206F0118A649C752C9F10970B170343E06A33DD296A18814051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583582.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583582.TMP
Size 96B
SHA256 db4a232ce3112c73ff8991420d0056c6bbd511f23d1e382da03ce640e666c52d
MD5 7dfefd53e25b9376abf79507027eafea
SHA1 5560c0b389efdd5dca15b1c66a3a4ae2f14efce9
SHA512 3fc9b5fa6c0192911b30537c5bfa4bffda74660105b633fd64a0a7311e93594ce0307bfd190953831dac1abb3323dbb7473c462e61c5b8a81e2adfc135054512
TLSH
T1C0B02200C0033302C00203F0208AC0CC3020CF2AC3032222C3E08F2AEE303300220022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e7be8f5bb49d9218f1bd3ef5b91134bb45f1ce2c580b4b68ac3d341fd1e8564f
MD5 8c008a1f19847684165eebf049dfb07b
SHA1 899c87db2fc579e5747a3e682db72681f1373a82
SHA512 71e8677949a1cd07f53d0e4636d7c6a2a80d5ce060cd1fa1f3adafa6a1a456203fc88425ab6863c4be817ffde3602a02d982907122a018135e33364f4ae2f135
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Em7Rkm1tYpBeh2BAo3
TLSH
T10DC312275E71E9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a97eadcc486e626e0c7f17949871823f61d21aaebe5519980271e7d581477696
MD5 517ad4642a9d920ede803713351238c2
SHA1 7d0d0dd89eee605abb9ff48fd0bd665cc6234d59
SHA512 763487ccebf39ee1f6580bde4ddf9d7607eefa4bcac8938c71bb53eda2b9d1e04ce906a545be6c9e342861590692390079cf55543d8fbd895c4869fb04565c26
SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:lm7Rkm1tYpBeh2BAo3
TLSH
T13CC3123B5D75A8375DB9BB1EA08E0B1F1EF24AA7C9209E52C8D85A0433E97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bcf07fbf160b0e17ba08ad5f3237576ca9b8b9de7ea832955f948fd565b3a072
MD5 64d96f9ae6a5cd27138b9e77d0ec078d
SHA1 1fa1c36fd9d29e3440c91e815aba4c155b1da612
SHA512 b5fd7883246c706b4c2f9923b13b7d31f4883df488191676490ddaaa4b8a4d0efc2784b9a0ca205dba01bb2dd8e52c4bd2d51dad0930aadbba6b523cf22c03c0
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:1m7Rkm1tYpBeh2BAo3
TLSH
T1AEC3123B5D75A8375DB9BB1EA08E0B1F1EF14AA7C9309E52C8D85A0433E97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f2ecda04396939637f815e6d3f96854f1ce02e2bf3a1d296e360b4c88e131fd6
MD5 98b7d78ef2e868c83c2d6fb3b3afc394
SHA1 b670499b62577a3312290e586897d8305f9063d9
SHA512 a4c27a8fcc90e726825281be137fee53a0c787903701d5395540c06b821e60b5d4c360d788a703cdf2702fd2d667216008ac5acb7c3cb5ec201236dffd75cd57
SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Um7Rkm1tYpBeh2BAo3
TLSH
T1BDC3122B5DB5A8375DB5B75EB08E0B1F1EF149A6C920DE92C8D45B0433EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 699513f8b807724717fc6ae588c3fb6e0917bf5db396a95abb2c1ce882bca5df
MD5 e53846579fd4e829f3bc4643a26bfe78
SHA1 3d9b675e56361a81d2ce757f7932d4400b3f0674
SHA512 b874539233b44183cb376420209a336d7fdbc5d687f9d4fada45239773a68d497ad48c1af2103bce03c3347e5aacaab8a4267e7ab75c873daf14303e5c6d315d
SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:5m7Rkm1tYpBeh2BAo3
TLSH
T1D5C3122B5DB5A8375DB9B75EB08E0B1F1EF149A6C920DE92C8D45B0433EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download