hxxp://quickconnect[.]to

Analysis

user interaction
yes
max time kernel
300s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://quickconnect.to
Sample260827-j2nreseq9t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1304	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322918128033215"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{39053954-C0A8-4236-8D93-22BBEF7542CC}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2964	4064	chrome.exe	84
PID 4064 wrote to memory of 3172	4064	chrome.exe	85
PID 4064 wrote to memory of 3172	4064	chrome.exe	85
PID 4064 wrote to memory of 1304	4064	chrome.exe	86
PID 4064 wrote to memory of 1708	4064	chrome.exe	87
PID 4064 wrote to memory of 1708	4064	chrome.exe	87
PID 4064 wrote to memory of 2348	4064	chrome.exe	88
PID 4064 wrote to memory of 1940	4064	chrome.exe	89
PID 4064 wrote to memory of 2348	4064	chrome.exe	88
PID 4064 wrote to memory of 1940	4064	chrome.exe	89
PID 4064 wrote to memory of 4388	4064	chrome.exe	91
PID 4064 wrote to memory of 4388	4064	chrome.exe	91
PID 4064 wrote to memory of 1208	4064	chrome.exe	92
PID 4064 wrote to memory of 1208	4064	chrome.exe	92
PID 4064 wrote to memory of 3036	4064	chrome.exe	94
PID 4064 wrote to memory of 1620	4064	chrome.exe	100
PID 4064 wrote to memory of 1620	4064	chrome.exe	100
PID 4064 wrote to memory of 1808	4064	chrome.exe	101
PID 4064 wrote to memory of 1808	4064	chrome.exe	101
PID 4064 wrote to memory of 1852	4064	chrome.exe	105
PID 4064 wrote to memory of 1852	4064	chrome.exe	105
PID 4064 wrote to memory of 2912	4064	chrome.exe	106
PID 4064 wrote to memory of 2912	4064	chrome.exe	106
PID 4064 wrote to memory of 2012	4064	chrome.exe	107
PID 4064 wrote to memory of 2900	4064	chrome.exe	108
PID 4064 wrote to memory of 2900	4064	chrome.exe	108
PID 4064 wrote to memory of 2028	4064	chrome.exe	110
PID 4064 wrote to memory of 4736	4064	chrome.exe	111
PID 4064 wrote to memory of 2980	4064	chrome.exe	112
PID 4064 wrote to memory of 4044	4064	chrome.exe	114
PID 4064 wrote to memory of 4044	4064	chrome.exe	114
PID 4064 wrote to memory of 220	4064	chrome.exe	115
PID 4064 wrote to memory of 4760	4064	chrome.exe	116
PID 4064 wrote to memory of 4760	4064	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://quickconnect.to
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xd4,0xfc,0x100,0xe0,0x104,0x7ffe9b19c728,0x7ffe9b19c734,0x7ffe9b19c740
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,2209742962398008149,6710239641917351434,262144 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,8486433845374978707,8674390941911409304,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,10712508653352127909,7879514290137765259,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,13357327245312414123,18174820731397550938,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,16294786980867402254,6654519710966082123,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3904,i,15132379897413721929,17616810391824366225,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,6245910226069135932,2935208717404252508,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,16103158042970344095,1416472812192317104,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5420,i,4261490116148421973,17424072876954473796,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5460,i,14514124997327211585,10150849346982241116,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5868,i,10821966145599302475,11484962453691479535,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5344,i,4028267854464232522,1606085321451345657,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,11631696007261197317,12212799734343426992,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,12778851641058840406,16149226206138227360,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,12896656033847089733,6955024056710782814,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,9145467206788615124,8676998353584623665,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,11802025421885496934,785516041231636565,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5924,i,9347578376525754367,6188518609415239983,2097152 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6192,i,1169240447052769302,2180511555106143443,262144 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,1723815922139695022,2969638467513511677,524288 --field-trial-handle=2000,i,2039560598605151970,8737183368096765737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1492 /prefetch:8
  2⤵
  PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5c7aece25fc443d0b4d4e774fde1788dc55c01ee09beb2a89eeb7774bf9d1354
MD5 6db2c33bf847d5eb25c4924f6db3441f
SHA1 f1e9924bb9b6fb50f0c0259e1bc3b4040c191e52
SHA512 172fb8563665dc14aa091249f47155b611c312d7ae0667bd85e7cced9e67240738755ebff89f7e229d0532c4784f41f9376b9dd8b294b8b6337fd574cd158f09
TLSH
T107E02BA9DA30BD2B19FD071D74580647E654235B2B41856F3A3D8609CFB9636098AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 36KB
SHA256 acdc8f60059cbf557957869f544dce756689a499c506856522204b3ea06be8c7
MD5 e09ca52560d42e4626656b4fc70d970b
SHA1 8ebc2396198a586a15352044dd1aa962018970e1
SHA512 42c6e7292562ba4760bb799c66be6c9b511592763923ee43add5d1b9c261e6d70b5a6777ac0a81bc72261bae91006f36db9aed8c9c8040f57cb52e8863d72d5c
SSDEEP 768:dP+jLZCiTypAmFqeJefWkwSr4FIYo1HqMO5+XtgHcgW4+1tkJij:dP+jLZCiTyyN+kResEUtgHxWjCE
TLSH
T1E103F17F1CFEE47672A548725090BC12D8FD8B067949E9A600E76E4624C2632C492F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 b6d7e830b3fac459b18addd7cbb4578830f4e62b46961b78db57c200b8c3774f
MD5 8a09aa6aa1a42644e3e4345a009c25bf
SHA1 0da1d26db5ed4cf3df849ab91080d911f2d1d590
SHA512 c00fb8e0a34b1496a8034578a8d9ff1fd0133e34d4246082e4790146db01de5c78a93cf326d1d378ff5b8e284bf1a2f41e3cc06c65fa58be6f526ffab115ad83
TLSH
T154116D1C219FE8A0FB881F74E5E92C1A1EB10DDF36213FDE635257E4F0A22796504668
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 8a7d55924724569e347fbce74d4e54a9c5c4040165ce3166820c66c5e08b6cfd
MD5 8147cfbde9614672636bb5e55f80c7a9
SHA1 14aac2e143f84866a2fa46d5952226bf0b7932a7
SHA512 0f3b97737c0e0a32fd3172854b58ef6e18627b246d26deed7f997354d7c24b9ee4b39753899f74a93702454b23cfd6db366de2e5ceed51cc2bfa76b11441708b
SSDEEP 192:DwmhThF4JJJNaIyiXHkv2zUNtXIsIT4aPdvdfP3NPaHV/pNN:DwmhThF4JJJNaIyiXHkv2zUNtXIsIT47
TLSH
T160F19CFBC3D8862D891156F4AB256F1FCE2D0A28531C3C26C9D4BF1BA3E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 9e0aff719829ccb22aa42655a32eabea8027383df5f81d528e67b3520b427685
MD5 e35527dcb25b389fbbca2d471859083c
SHA1 fc591ae6875e4874782ce39163a2e84258a88106
SHA512 07a0309823f4b90c4ec6282fe885c6bbf8b4c53564abc65ebd41a47823a9d1fb583d8d0d82a7b2e91870322b0e21eb14ed232d541b715528c754ed83281bc3ab
SSDEEP 192:DwmhThF4JJJ1DaIyiXHkv2zUNtXIsIT4aPdvdfP3NPKV/SNPYhSjhq:DwmhThF4JJJ1DaIyiXHkv2zUNtXIsITS
TLSH
T191029DFBC3D8862D891156F4AB256F1FCE2D0A28532C3C26C8D4BF1B93E2871D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 177b3e2965458c9cbe260493020ce736320450a92c8284afe2f912d0e76ae715
MD5 bfe5d3c8ef4de4e9a11b2e227db65d26
SHA1 4b72ed26888c04b5ff4a28204bd6850611f90e6a
SHA512 3f260a1bee1e17eb46a322b8736f668b841cd614c835a56fc07c415071df6881c0f84684ebd296f7572163b7e85c271cbed246d0fdee10f854e7bb1fb7a4fa49
SSDEEP 192:pRicBz4cJRS/Yv7LympAPRp2Mryl/95Hsb+WNnmVH7Q+0jefN2aAkwjaTVyIsnAI:pRimz4tEXUXe7wAsJel2TDa1E
TLSH
T14D52B72FA960397BADD7D31AF9227757E7F5102625841E84EBFC8A2C14E75CC221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 173d2c580be102957f0ddc007e63295d998d6626a84ac849a5b718ce08eeed23
MD5 2dba66ac5620e7597b04fbcee471ef45
SHA1 4e0a252ed7a9f1ed6133cfadab311f68c3891b05
SHA512 177619fb12a52aea6b4f82b46839944833dee8b4d4fc2524816dbe9b99ac45e119a7d955682683fa5b11e3fa7fd1bfc95cf6fbc7fd0e07a4ea723bdd08d5c599
SSDEEP 192:pRicBz4cJRS/3cv7LympCPRpkMryl/95Hsb+WNwcmVH7Q+0jeuN2aAkwjaxVyIsv:pRimz4t3IXiX47wasJeq2TDaXE
TLSH
T1D652C72BA960397BADD7C31AF9127757E7F5102625942E84EBFC8A2C14E75CC221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7a431e31a563abafda8ea236f0516c2d385d4aa793262735ae6e5c7c3fd655a5
MD5 e8022e95acb7951dfffebb58d16a061e
SHA1 caa2566f75a13c2b11a56bd99e784020c0761692
SHA512 df5a8124d3f0a3935c427601e9a31924c4dce1494c5c4635e5b7c8e3fd07687a40e2a7ee1047f852197dd7fad0799544eb37e28f89431dee4f82a7ddb5b30c0a
SSDEEP 192:pRicBz4aJRS/3cv7LympCPRpkMryl/95Hsb+WNwcmVH7Q+0jeuN2aAkwjaxVyIsv:pRimz4b3IXiX47wasJeq2TDaXE
TLSH
T10252B62BA960397BADD7C31AF9127757E7F5102625942E84EBFC8A2C14E75CC321B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 752bd5861a009fc3a7441bc9dc1ffa69a16da028611345feac0d02ad601fbcf5
MD5 c921a4f2a7a83e9f834059d2f76ea185
SHA1 87bc78445fed03c596a7de5e7f4d2b6197545a9c
SHA512 dc6fbd44eef46b4dcb96a7f8910d5a5379318120c995c189528033800a52f4f6a7113195573f7b3bd25dbb055f7dbc37235f0bf55d83b91e2db69f13e19792eb
SSDEEP 192:pRS4cJRS1hv72ympAPRp29l/95Hsb+WNnmVH7Q2rN2aAkwjaDVyIsnAUge:pRS4HxQUX87wAs2p2TDale
TLSH
T17442B82EA964797B9DD7C31AF9227753E7F5102635842D84EAFC862C14E75CC222B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d5d7573f9b319991603503f5dfcd97342ca35ffdbffdc62405c6dd4886f5cf54
MD5 ebd478070818fc15c629107cf4facfd9
SHA1 1727caeb781bbea94836507c5489c28bdbd9e2ee
SHA512 867bca890b97b5565d66345665e53d9fa13b6129cd895daf7929f7ea389c66f931195648fa197cddf4c2e1458c3fa631c2878064917a41cb4c415dd1d4837941
SSDEEP 192:pRicBz4cJRS/Gv7LympAPRp2Mryl/95Hsb+WNnmVH7Q+8D25N2aAkwjaDVyIsnAC:pRimz4tyXUXe7wAs52f2TDale
TLSH
T10A52A62BA960797B9DD7C31AFD227757E7F5102625842E84EAFC8A2C14E75CC221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 59d3937d7ea3ab7b2bb5ee487034a0dc9dc0546f42217a3ed001834089c7c7fd
MD5 63b265fbdb422661a248c32a0d1c64cf
SHA1 cc3a5c52775bbe260645c0bfa1efd80f476a42a0
SHA512 288a648d88a4c85db92a7a2c4754dcf7c3b9e7873cfb55acd6352a601c1f94a446b9e3fd0dd1f7fbbdd46bacff67894d9aab32d185375514dc3635dc0c0e6f8d
TLSH
T150B0125180416541C05602F81182288871589F15B60B1B1D93E4696788355508514070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58509c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58509c.TMP
Size 96B
SHA256 3f070fff2ae9c4b8296c8787b83ae05d5ba24f9f5acb17ea433b254f4d8f8c5f
MD5 8d41959155877a2032b11b50fd2a3767
SHA1 a3be93528d149084c6ac8865e26fd35283b70939
SHA512 22a7c18647b099c3d52bb14975bffbfdf61dd4f99e5ccc1bb45cc6a46ffebe5a406c08248a8cfdf411816d8e029666e19f1fef6c49a78210d65dc790f3aa5f61
TLSH
T107B02222C2022322E0C203B028E080CC30E0CF38CA03222B83E00AE2EC303A02020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 724d4ad27508931fbc44df334dd85c3e0ed1526752ce1eafce9c7a119b2e4d11
MD5 cb728b27f209a4e0074281a578e1eb58
SHA1 08048a6727ba5973ca2657d1baa4cd51b4ace5f5
SHA512 4714576beda0c70fa1d9d8ff955ab6a1daebad26ae8455fe1429883ddecc1119ba4f1dc8a6ef8e17ce4f90652dff5fe8360c1541c01ac029bd03fdb720ec2ad2
TLSH
T186B0118220822E02EA382BB0B0E220802A20ACA883A20F0222B20A08AA03228C200200
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 17e3fc6d719bc4d614f8268e72d29112368b05077741485417a9ca21422ea363
MD5 95fe55db651a8b9e8c06c327f62ebe9c
SHA1 183a53cb9b5b78382c744e9eb48e89464d8bc575
SHA512 fd8d8e8b41ac0ca9fe77f638a6f04a5c9a6b95910bab96f1493eac38dbc61c8085d2c7fba3a2ab7e0cef00c10ac7213574a6e88971b6044764d2e3d82dd08355
SSDEEP 1536:lBGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:LMqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1BCC30237DFC61E339DD2DB60B9130ED793F604A99034D305EA6D7BAB6C83495A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b398ac3ae85024b86ecfdc121bc7b23b82493c954dc802851dd49420782a31ff
MD5 aaacecb6113a05be2471352fad00a741
SHA1 b76453b71dc4939db5cbc99a061104372d436c55
SHA512 6c5bfda75d285b325624641967dcef51fb62e7e06c47b8278602b06c24216943f5ac8e40cfd873756250b2fa59cd1101cc94881a533e27c20751179f58d6f0f8
SSDEEP 1536:TnQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:2qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D9C30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3e0789148dcc4e7b3e6f234fc8b9cadfcda17085cf0b6c57e5f8a72c07a6189a
MD5 de6525bb573a500cd0a6040e2095365e
SHA1 db2f093ff73b1ef1862706da4e173dd4a3a13b4d
SHA512 48e972326482fb75ca008db0520eaa5a6822fdc887a97b2c48d2fd4ee510345a563cab784ddb566cbd45d8108f03eb8ba9121633a98503f88b7101719fb699f8
SSDEEP 1536:NJx1yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:J7qfd7NtZL8cHQRZEQ6Spsk
TLSH
T14FC30237ABC61E339ED2CB70B9130ED797F544A99034D301AA6D3BFB6883895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f793660ddcd34286ae789408b70c62b6cb51e8c1455885742262581240be7ed4
MD5 395199089c3c58e6b3548200314a21d6
SHA1 a9e5ef4727d650e646c0572ef227f4a820f92424
SHA512 6ec88aedc675fa591dbb277523c2f0b32d1be4bb6046059cdc5b2d311ebcfc773e505718525f87db985b58e38d0797cf7a9359e4c1908c5a846c5f9012b6da17
SSDEEP 1536:MJx1yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:Y7qfd7NtZL8cHQRZEQ6Spsk
TLSH
T154C30237ABC61E335ED2CB70B9130ED797F544A99034D301AA6D37FB6883895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 203bd183d7418df68f0679e79fa6959d1472435b538aa1da2641b07ee0efab7f
MD5 751f8f1f2c638fb53f5c9baa3730c5fb
SHA1 248ab5e615464089c22a123f43891f4943515d35
SHA512 2102b564e828644913c6f49de658e8b0cca4e69707a26994ed4c54e402374df8d12d3d7c87c2fe7220474ed140b539a00cafa1f139ac4657c1bc0d094d989517
SSDEEP 1536:NBGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:TMqfd7NtZL8cHQRZEQ6Spsk
TLSH
T19AC30237DFC61E339DD2DB60B9130ED793F644A99034D305EA6D7BAB6C83491A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download