hxxps://google[.]com

Resubmissions

20/08/2026, 09:41

260820-ln6feshp8t3

20/08/2026, 09:40

260820-lm7xvsw1hw3

Analysis

user interaction
yes
max time kernel
233s
max time network
232s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample260820-ln6feshp8t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2192	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316925177045405"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{994A9D00-FCE4-4A74-B6EB-DE6008C81680}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
3008	chrome.exe
3008	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3904	644	chrome.exe	81
PID 644 wrote to memory of 1716	644	chrome.exe	82
PID 644 wrote to memory of 1716	644	chrome.exe	82
PID 644 wrote to memory of 2192	644	chrome.exe	83
PID 644 wrote to memory of 3168	644	chrome.exe	87
PID 644 wrote to memory of 3168	644	chrome.exe	87
PID 644 wrote to memory of 4680	644	chrome.exe	85
PID 644 wrote to memory of 4680	644	chrome.exe	85
PID 644 wrote to memory of 1592	644	chrome.exe	86
PID 644 wrote to memory of 1592	644	chrome.exe	86
PID 644 wrote to memory of 4140	644	chrome.exe	89
PID 644 wrote to memory of 4140	644	chrome.exe	89
PID 644 wrote to memory of 4188	644	chrome.exe	90
PID 644 wrote to memory of 4188	644	chrome.exe	90
PID 644 wrote to memory of 1116	644	chrome.exe	91
PID 644 wrote to memory of 4456	644	chrome.exe	93
PID 644 wrote to memory of 4456	644	chrome.exe	93
PID 644 wrote to memory of 3780	644	chrome.exe	94
PID 644 wrote to memory of 2760	644	chrome.exe	95
PID 644 wrote to memory of 3780	644	chrome.exe	94
PID 644 wrote to memory of 2340	644	chrome.exe	96
PID 644 wrote to memory of 2340	644	chrome.exe	96
PID 644 wrote to memory of 3268	644	chrome.exe	97
PID 644 wrote to memory of 4588	644	chrome.exe	98
PID 644 wrote to memory of 4044	644	chrome.exe	99
PID 644 wrote to memory of 3008	644	chrome.exe	100
PID 644 wrote to memory of 1624	644	chrome.exe	101
PID 644 wrote to memory of 1624	644	chrome.exe	101

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfd8dc728,0x7ffdfd8dc734,0x7ffdfd8dc740
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3346076070822841687,12226634457243057854,262144 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,13361728737465956620,504742706742734318,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,8243393801026220184,13577344950087195375,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2952 /prefetch:13
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,11703569935541129973,4679962250894667250,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,15220283027568625144,3082190403543291508,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,8011530537151985888,1098641085428008384,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:9
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,17868878503969872762,3422956835594410192,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,4852677498710767407,9687505718719094746,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5868,i,8646596365778614070,11796684245650921903,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,2021550379610680026,15018332740601888009,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:12
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,10379079193875415831,15250431881686672199,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5384,i,3195042903010501117,3433968341148548330,2097152 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,13165460196808256813,17286343266130978746,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,18351837223581729345,1285582112370627205,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,11603827722411481678,4662066542148182342,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4480,i,5352624117448983093,8294021089008962172,262144 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,17652355024935304966,13697827694974493574,524288 --field-trial-handle=1928,i,4700310279225743559,1608718364628660289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4124 /prefetch:14
  2⤵
  PID:1624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 37e74d4e81968d93e4584534e7a6fc07084607b804b571a6b149d17bd2062a02
MD5 30ef0401f5d82383221075ba124d05d3
SHA1 5ec2ba00d5217e5948df8da25c889b56c06ea6ae
SHA512 22f1bdae003e0d4b41190d1b5c679908e29b50a1120e46874dc81b60ff73fb8b6e89d6597b7719ff1e50fdbc3a68f3ad30897c3fb7a2444929dd23316677d344
TLSH
T1D7E02BE5CC31EC3708FE471C64544A46E710035B2A80858F3B3C560D8FB077A059591C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b9108569b015ad9de6d5828571425f60e6905ffad238d11e035d514229cc5b37
MD5 4f673b1d5c16aaa74700523621f6e988
SHA1 162a697c1a0c7aae63317f9cdf243883afd8c04b
SHA512 546e1cb823032bd38913fc73943e01e0ddd21c683ac059ee9719f13bc614046a25fbcb5d65b58ab21b9a512d12e9a9eeb52474879c09f1a193fdab16412dde1d
TLSH
T11221CB29618A1818DF16323175B00C58A2F3D5890C4D07CF62C60EC13F9B1BAB4BC5C7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ab24b2aa97de86cabf4363ee6dbeccbe93592c14c51ccc136c865cd609e9eff
MD5 9c5648e5e39c83d7fec8bffbcf3b970f
SHA1 834e79eae26a839ecbc9d3d7570a47f82aaa410c
SHA512 983174cd953d5e0833ca16e8a292aa72c103e39e31ed3ff118f42aa7d9c162a93d123db3e33a3ceaf2c2ed641a42528507de7055c2ba91f5c9c54e3ba46181fb
TLSH
T19531741A918E0C19EF1622B03DB02858E2F3E98D0C5A47EF5BD10DD53FCB1AD79691DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 48c542bcd238f0910d32e13760b14a338bd3dd84888798d88a93359322a63226
MD5 7dde605912ed11df873c37d9dd611bc0
SHA1 9ec66e4aa06499095744d2cf7c5db7ab6580cefd
SHA512 7d7839d270a21ca4b0b090c3b538b5445bdd8da2bbdc73f261f49903583304704ab37321a721146f58d2719fbf820cbec2647bf12114b5a735bba5b53bff0a41
SSDEEP 192:DTUqkSqg9JpJOwlj52aIaEdq3QIX7x1yaP4IcIJybv5fPsNPyQXS44pHW3r5oFg4:DTUqkS39JpJOwlj52aIaEdq3QIrx1yae
TLSH
T16A22BCF7C3D8862DC90156F49B156E1FCE2E0A24832C3D66C9D8AF5B93F2471E29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 33ab8b63070bf21cd2439ab3393108a1333e78df6fe2193650b3c6b3c384e3a3
MD5 9d4a61cfe8aec14f902a0a3bd9b56843
SHA1 94ac37999586e3c29c4007b31375d89623e7785f
SHA512 53cb5259a34dcaafb79e50d1d92f22b77efc85dbafbc61d0392b83569ec585d676783155edbbf17e57627f9078bb4db3b2e17ba924bafe9a46bff239629ba671
SSDEEP 192:DTUqkSqg9JpJOwljBaIaEd593QIX7x1yaP4IcIJybv5fPsNPyQh3dBe5oFUsLC:DTUqkS39JpJOwljBaIaEd593QIrx1ya8
TLSH
T1B112BCF7C3D8862DC90156F49B156E1FCE2E0A24832D3C66C9D8AF5B93F2471E29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4744be0e8ae864cbfee13070b264741229d0a065473d86873c6873261d077d25
MD5 564247f4e6c36681df2097e537da03ac
SHA1 2ea42587dfeabfbdd7aa876c63370af2a2458bb9
SHA512 ff9289e26b2b04b95b05b81386ce929985202970a289280246966c2f5b1c4e625bee7548baa9d1718de1102d77c438620a7207fcb06983451d1512b1d302624e
SSDEEP 192:RR3/v/Y3WAv7H+pAPRp2E8j9WHsb+WNnL7ZfU2LOeu2y0z3VyIsnAUge:RR3nlciUXwUwfu2G2y4Re
TLSH
T1E442E73EBD10697B9CCAD319FA627B67E7F6106560941E80FAFC892C15D79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 386aff87283aedefe55df852acdd4294b41f7091123a140ec93c6c8a38c4b927
MD5 a386d00c1966b3955dd3e0f6aa648b9a
SHA1 018a4ff6020fb79a1ea0135a783a4172f078faea
SHA512 7b738d32452447c3350a31bafbf61b2d05cd00659635a74a7313702568d685f3b91a74a9d9cefb02c48af5243ecbedf520718779a75f77425bc93aa634352eb2
SSDEEP 192:RRLcBh/v9qg3WQOv7G+pWPRpgEKRB49WHsb+WNUNL7ZMDKpGoNOeu2y063VyIsnv:RRLmhn8QqxiXSgUwQyVoA2y7RE
TLSH
T1AD52E86BAD106A7BDCC6E315F961BB67E3F5206560D01E80FAFC892C15E7ACD211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 db00fdd127986354660b0d148332236fb206e9ac8abebb4298899e869dc6cc45
MD5 c680a70d302ef25894544cb6b1bc1c34
SHA1 dbc72d1ba9d58405232929c43137dae0f4669c36
SHA512 24a367198669365556fd7f8cd98b69bf2dc17c12b36c20478765f8539c806e6f2c74127fa05969b12e65179d0a3976f986e8a1ef5df41372e2858aa034ebf551
SSDEEP 192:RRLcBh/v9qg3Wnv7G+pAPRp2EKR99WHsb+WNnL7ZMDecOeu2y0z3VyIsnAUge:RRLmhn8vxUXEvUwfye/2y4Re
TLSH
T1B042E73EBD10697B9CCAE316FA617767E7F5106560942E80FAFC892C15E79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f011d17ab95e4175c9d28f6cdbe3e8799ac496469196426cbbd7110e8b7659a1
MD5 16cdb826b17a80a8b4af0f2b590e7828
SHA1 766a15b1a87993ff2225825135dd0e9ecfca8e1b
SHA512 7cef096c26b8769699d70d0de4f60bbfaaa4fadfa521c1af1eca102e8608badbc8fbf8d67fd8cfef3114eac4a7e9a32860a947c3763b015f546b2000004288c6
SSDEEP 192:RRLcBh/veqg3Wkv7G+pWPRpgEKRBW9WHsb+WNUNL7ZMDKHE8POeu2y063VyIsnAI:RRLmhnZAxiXSOUwQyt8y2y7RE
TLSH
T1DF52E76EAD10697BDCC6E315F961B767E3F5206560D42E80FAFC892C11E7ACC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 08bc396ab31aea53fc9d5afe459668c9dc7b3be741a9ca49e4ae05a4fcc03567
MD5 232df18db178e8b7d0f1d57bcc5a5ebe
SHA1 8d6e8194b59803649dd238655448c2c9094281cb
SHA512 ed1e4ed76e05ff20ec28a287fbdc1e4c56e35cce4ee69209af1e0d713579ca9549ded085470eae8e19f479b493e890f4a4244b768cdcbbbe3831730060ec9426
TLSH
T172B012009002A611C08302B4114354887218AF30960A270183F06D62C825575C1140D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5873a4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5873a4.TMP
Size 96B
SHA256 ac52e7489f29d41545ba81cb91a739e78283b65996ace0cea29e469d09cc9ada
MD5 0053e5af42ad72e0140dd1c5cd85c6ed
SHA1 09b20e23c3c9cb4d78fbb91b50b577451f1369b8
SHA512 f64cff2f5915e578f1e79cd7802743a8dc8ad82c7fc06e5539234d87431a5054ea78daa4f735575fed5c1a0cd5a64abd0cc43d74bbebe1ad82063d2affdcc043
TLSH
T14CB02202C0022202C0820FB02080B0EAB220CF2EEE03023283E00B22EC3823080280A0
MD5 SHA1 SHA512 TLSH

Submit Download

f6039c9e24611deb_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\f6039c9e24611deb_0
Size 191KB
SHA256 f47182144bc2d91c66bf9211cee0eec29006f799c9afd7e44c306ae207996f41
MD5 396f6e6a5c93f2a6e871f1d273f81adc
SHA1 9575f2af57df0480b0c79fa3f7a7e609019e077a
SHA512 3223f33a3bb3d791f0aa61f1199aa368d042e61088ef9ddb7f048d9386b744be580869f6e08c9fbaac0842c8ea992e57d40176cad697a68aea565cab4f30ac5c
SSDEEP 1536:To/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:oSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T1B0146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 eb45777f913a2c201c768e1a21114f85634d99045c538c0ab8a74a55ae905fb2
MD5 abd81c044f5237ab23d36084ba11588a
SHA1 9289452dee0e79229f1ec42279509c729aac3306
SHA512 9f743b49538d578d60d28268aaeb88fe359ef9b07074ba5a46e56cc0aed450694814de1ecdc35e7f79ce90f225aa1bea349846deebece6339f3129817f2cb20f
TLSH
T1F5A0023123D6E86AF80112761095079437A1CE900229972371A12044C9737418E11443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 b06f1def8716446c77314a6b36659782ba2d37da418a21d528e7e327690995ad
MD5 54ff806bd2d2694117c1bb9c5953730b
SHA1 badddcca2121243a2734df37d3f3260aacbb8815
SHA512 1c53d27144df19b544d05f2b850e067825296b17e43c7e2bc003e644b3fc0f579f1523ef283db580721c35e1562b97792a6c07e5ff12e0265d62607ead800534
TLSH
T1F8B0112A2380EE2AC828023820C20A00F32028A000AB8A03E0800088E223AC88E20282
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a4ead34d65518206d6ddf9ca4df31119ab51604735d27bb27f7505148d75a565
MD5 75b8b01658ba65f076e244b410409276
SHA1 497d1ff04e9cfa69458653bdd963158817ab922b
SHA512 1202b14e8c58bfe496792efbd2e4003f30324d45d4c371bf4da800d3f3c6ff16f3cc878011899afda9f8cdd76299b921a8c7617121e7495dc9a4c35aafbc1c17
SSDEEP 3072:/y+zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:/3WDfxA3OnjrYQ9EU0/hEV
TLSH
T190C302A15C3ABC660DF8FE98640D3E60BFF46C9A91476DD2A2ED2F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 814ee61978cacadeaf420ae192a638ea49a15fb5001c8eb7d20e69c768432252
MD5 fc97ff72c24d652cdc0af24abc056b81
SHA1 415b0444096fb1a866524952c5a8e9a9a449c98a
SHA512 5541f0f365cb261366b531fa7d4c598343a0b928076fa1fc4fd870538038ed877f1169a20e6063d23d8271ee8cbea9a5e6f878b720ae5a2978dad61bbd0304ea
SSDEEP 3072:QVzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:GWDfxA3OnjrYQ9EU0/hEV
TLSH
T137C302A11C3ABD660DF8EE98640D3A60FFF4AC9A91875DD392E92F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4552e49bb76880bea7c698974857c05806c53623df1baade0a5887c37e651cf3
MD5 623cab077dc642d97906a2665a07eb8e
SHA1 5fd8f00d8071374cb47ccea583291a297b1ac6cf
SHA512 6c0755307f7ee6d4ff78f866ddc1a0f3685878f115ed6bb2b0a4b3ea5edc88489415697b1db11f8a6d72c451fa2e14b29c5c0d353a80c6272d793b34a0fcb4e4
SSDEEP 3072:Dy+zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:D3WDfxA3OnjrYQ9EU0/hEV
TLSH
T129C302A15C3ABC660DF8EE98640D3E60BFF46C9A91476DD2A2ED2F4C14FA5CC1179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c9382ef2337a9ce3376a4429a6d41a9cfe38e62db443bf800b22dddb54005469
MD5 f0975fa980c3e1acea4dcc74d5d3596c
SHA1 3f9aca773e6c443253c79e8761952e72acab3d79
SHA512 0d721990f962366a555aa6ce976a05d024d93297c26869256ecfc2fd8fadf14ef0cb83f840264a9a85b571458a44789c70455b909578d0adb7ca6c2b76e185e6
SSDEEP 3072:ezWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:8WDfxA3OnjrYQ9EU0/hEV
TLSH
T1CDC302A11C36BD660DF8EE99B44D3A60BFF4AD9A91835DC361ED2F0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download