hxxps://s10[.]up4ever[.]download[:]8443/d/adoeslldpqy52ag4yvlecbdfhvgpxeiugdgvvd5objjz5i2xoutawnjrl5mdwkd3ersrg7wk/UnlockTool_Loader_by_Amiiz_30[.]08[.]2026[.]zip

Resubmissions

03/09/2026, 14:58

260903-schzbaaq213

01/09/2026, 12:00

260901-n6asks11d13

01/09/2026, 11:22

260901-ngqshaxgkb3

01/09/2026, 10:49

260901-mwr4fack9x8

Analysis

user interaction
yes
max time kernel
1800s
max time network
1759s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/09/2026, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://s10.up4ever.download:8443/d/adoeslldpqy52ag4yvlecbdfhvgpxeiugdgvvd5objjz5i2xoutawnjrl5mdwkd3ersrg7wk/UnlockTool_Loader_by_Amiiz_30.08.2026.zip
Sample260901-n6asks11d1

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4068	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327376192683694"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4372	5036	chrome.exe	84
PID 5036 wrote to memory of 1304	5036	chrome.exe	85
PID 5036 wrote to memory of 1304	5036	chrome.exe	85
PID 5036 wrote to memory of 4068	5036	chrome.exe	86
PID 5036 wrote to memory of 3956	5036	chrome.exe	87
PID 5036 wrote to memory of 3956	5036	chrome.exe	87
PID 5036 wrote to memory of 1080	5036	chrome.exe	88
PID 5036 wrote to memory of 3748	5036	chrome.exe	89
PID 5036 wrote to memory of 1080	5036	chrome.exe	88
PID 5036 wrote to memory of 3748	5036	chrome.exe	89
PID 5036 wrote to memory of 1424	5036	chrome.exe	90
PID 5036 wrote to memory of 1424	5036	chrome.exe	90
PID 5036 wrote to memory of 4636	5036	chrome.exe	92
PID 5036 wrote to memory of 3816	5036	chrome.exe	96
PID 5036 wrote to memory of 3816	5036	chrome.exe	96
PID 5036 wrote to memory of 4772	5036	chrome.exe	104
PID 5036 wrote to memory of 2560	5036	chrome.exe	105
PID 5036 wrote to memory of 5028	5036	chrome.exe	106
PID 5036 wrote to memory of 2560	5036	chrome.exe	107
PID 5036 wrote to memory of 1388	5036	chrome.exe	108
PID 5036 wrote to memory of 1388	5036	chrome.exe	108
PID 5036 wrote to memory of 4396	5036	chrome.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s10.up4ever.download:8443/d/adoeslldpqy52ag4yvlecbdfhvgpxeiugdgvvd5objjz5i2xoutawnjrl5mdwkd3ersrg7wk/UnlockTool_Loader_by_Amiiz_30.08.2026.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa7a8ec728,0x7ffa7a8ec734,0x7ffa7a8ec740
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,884930354835734873,15786579430387067700,262144 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,3845737375319603694,1537268588919942409,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,17033092453251635769,8055351878893214463,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,13615309003719341000,6356711344428233709,2097152 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,14165793812890510393,12247818392778048740,2097152 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,16970813546096347446,8128558944823345066,2097152 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,7782173298444219476,10420365944234567228,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5892,i,15241932587400992852,15009784407618676875,2097152 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,14925562423903912628,6015898919971678017,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,3067460770435935179,16242384548712627189,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,5630466448294210960,12941956395573834998,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5700,i,4348525501477674535,12107208578256040208,262144 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,2582061052400106033,2153832430074186842,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,13113217854483713814,446895724681852679,524288 --field-trial-handle=1972,i,16086183318578973630,2864626674489606275,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c884b9998c6d938245b21e09d3de4f4d8f9e162c74302471a9ee090660c8502
MD5 3f1dc0a825f83e69fb6086dfc54187f0
SHA1 f8e23274903da83c95654a5f79b1cc9d8836d468
SHA512 66e6793ffe467a3477ddecf4c87529f93dead65483ee83466308e4494917e4774466b7ad2f4f0b8dcc9ac0dc468ce07528e6723d691cc1885a72c37a0c4af1fe
TLSH
T126E061B9CC61EC7754FC075A50184B83E75513172740994B7A3C951DCFB173E4595C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f6c423257562d85282a86ee4a7485461e4fd2481c4522a97e097dac6b59dc4d7
MD5 5eefa98591a7b5729c82d1266934c00e
SHA1 0b7866d4f963803ec1e88b7ad156dbf695d86d3d
SHA512 f6189e412aa73bdc326d432f198372385412e462fe2f8d953707cc23dd8179177ba3d5798eb7b8c7372ec4294e1f6006bff1e2cdd6f5eac11615e78471365800
TLSH
T19D419DF793F4857E8A1196F4EB156E1FCE690524132C3CA689D46E2B83F2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dc6fe824a97c819a9e83e82e7fe449f893d275c338deefd293ec4dbdd39e5426
MD5 13214621d6cb84dc886d1e6b33f3f86f
SHA1 92dc6e609405e26597732abd17262d2b91bb39ea
SHA512 f12a77fd0c4d0703b110006d6b7329c7f64868bb196d6091e4fa3be87dfba216803afc2997f16f27e60aed469d6d84850e2cf9913ae36b9529a9a5158fa47d4c
TLSH
T15A418DF793F4857E8A1196F4EA156E1FCE690524132C3CA689D46E2B83F2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 db0b67bc09d25e94b04100744138abe489c1d5116e1ccc3364e3092a0fb471ca
MD5 fae4cad5d6aeee4a3258d8c29dd32f06
SHA1 35fcd397b303d753bb22a166bc3a4f2857ef9551
SHA512 764154b036b3dc296fbc2966be9e88906b8421f339fe469c189920e6fe50a0fbe6f9e2c97d022a91b03b04673dd781fce56ff2d9993ffcd31dc57eb247d4ec14
TLSH
T180F050F7E779745750BD49EB1E04780A1C767430124169F0DF9A417CE0815A31B16453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8826766862d16493ffada4de00d315fa5b1983ffc83a1d14b0eeb7f0ec869b3a
MD5 e215b3b31dc13a3fafb6a3f1974a5a19
SHA1 82e91441e7e95215fbb96c88139075060f1e56e6
SHA512 60d05cf50edcaef88f12d85f068917c13b55d785abe1e8407276e38fa14588803eb2e7e98bab77213ebbe2723fc8a435c5bd97ec968d65aeec8af32e79267e11
SSDEEP 192:ERrepW7gCRCv7PpAPRp2r9YHsb+WNP0r1rQPXI2+bEdVyIsnAUgE:ERremFOjUXIWwcqP42+sE
TLSH
T17F42C71EB905697B5CD7D25AF9637B57E7F6203221902EC4E6FC8A2C14EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c88dc4e6380eba852ea888c9692f1137cd1453c5228b157beef88ecfd189300e
MD5 f045dec6dbd32bc07fac5e0ce9aa855f
SHA1 7dce5b401f7aeca240022ddb761eaefb78b9b4a2
SHA512 c5aacef543d8e44f4c2136ab597e301d7ef2abd095603ef878ad71584efd0e83ca0a3e51e605034b0650b31594360183ea5abc9653e1d7172d6f1275c807be7d
SSDEEP 192:ERreIW7gCRwv7PpAPRp2r9YHsb+WNP0r1rQP9I2+bEpVyIsnAUge:ERretFsjUXIWwcqP62+ge
TLSH
T1BC42C81EB918657B5CD7C22AF9637B57D7F6203221902EC4E6FC8A2C14EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ea1b12ac25049f4880f8537eaf60c4a8fcb4904a5994698f8b71478a5440c1a
MD5 cac4751a7f9d2d7ae0bf91851750719d
SHA1 27a6fa1f2a4aca0168c1a9ea9088a189b4754d85
SHA512 42af5854b6acfeee6123d18070a7795201670fee997daa15f6948f10731394da8877dc6daa3feb6dce65bd9699f7105094f5539b4963c2339d3a0c6a757d0dce
SSDEEP 192:ERrepW7gCRnv7Pp1PRpJr9YHzbDHsb+WNP0r1rQP0I2+bETVyIsnAUgE:ERremFvj3XZUbrwcqPB2+AE
TLSH
T17352EA1EB904697B5CD7D25AF9277B57E7F6203221902EC4E6FC8A2C15EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 837780aeeb943e0ab05b441fded00d1a34fafc2aefe40666f2b4082daa7083c1
MD5 b25513fbfc9b15e06b22ec4b14e42aa3
SHA1 ac0cbd5c1be7a545141e9914cdd76c35cdcc4551
SHA512 baec210a1909ddfc75a4cf7839a3bf24debe5d8a58f0f0d3812c4e650c325783dd64de3429332ff3f79cddec015fb2c4b29c774356fa7589f4b682b34fd6a961
SSDEEP 192:ERrypW7gCRnv7Pp1PRpJr9YHzbDHsb+WNP0r1rQP0I2+bETVyIsnAUgE:ERrymFvj3XZUbrwcqPB2+AE
TLSH
T19352FA1EB804697B5CC7D25AF9237B57E7F6203221902EC4E6FC8A2C15EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0e55a60c96686cbf1411ee5bc72031a077fa0998f6e3fcbd61a7a4035e06dac8
MD5 8b2f36db6e8840b3b0498f25d2383823
SHA1 b27d34b1fed20e231a146a5b147934a0502864b1
SHA512 be6da76ba1471df1138a525beb49801c9ccc0d156ae28f01a52d3b80ea6002e3426f8250374625c771da7655b6f2f9f1f4f5beaf4803e5cf28e4a239d333863f
TLSH
T139B0125188019651C04206B4614224E8B1145F10960B171543E0B922D8251A180140D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587bf1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587bf1.TMP
Size 96B
SHA256 c20be4930cee99dab7cb8746558c821ff688ee6e123889e45f06d1d158602e23
MD5 430336b8772049d141d8170d7d9bd119
SHA1 3c8a752ab58e65e3764f4329e69e58c2fba82637
SHA512 4f8501553441f59c576e88d7b10cec6b05068937518cddb52d76b13ade666c1db550296ed97e12bb568a6dbba24d9242c899001a6ea1cb4b6c96cae142138fbd
TLSH
T1DDB02280C0022202C8030BB0A083E0F830B0EFA2C2030E0282E00AEAFC202320028020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 190b8375b391ce4b773ba87acee33f889bf3e82e8e40e29e7184f25aa3d3904a
MD5 3fbeb8f42ab1ffc789c49799ae8fcff2
SHA1 8b2e26e89462895bc922d2a6da6226c90210b65c
SHA512 fa236b84a57a229691bd564f635e48abe1fd5558f0798fd6f2a7340ec15eb32cdc4e5f7f3fed8d25d3eee2cd680f4f468861aa59c2a6c37ef5be9ac1018768fd
SSDEEP 3072:MZhW/q3MxxasNcrTwTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:MZg/gMxxTN+Twqm7Rkm1tYpBeh2BAoa
TLSH
T1A1F31237AD64ADB218B5FB2AB58F0F1A0DF046A7CD24AF41D4DC8B4833A66CE0945D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 49d9ffa6c3cb25d7e6ede2bf59b70184da4b1d5420d6e04216d54de3ce557c82
MD5 e31d6f7e77e77a5b184c9ba79758f536
SHA1 dd0bb2208e0331a227ce3d72ea557894cbb1ebbe
SHA512 a37f1f94cf49344289f2b4de467c8823cabd808365f1486ebf309f5c3fad2a394ea5fc08752625d55b798ac223a34bd2cfd3f7626530661c7d381ec5717b3c4b
SSDEEP 3072:ktCGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:kt1m7Rkm1tYpBeh2BAoa
TLSH
T13DC3123B5D75A8375DB8BB4EB08E0E1F1DF149A7D924EE52C8D85E0423E6BCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7866f96ae0aeb3b44744b3ccb98cbf9452794a3f8877e63258d04df2813a8eda
MD5 f746e4332b65d0998eba90f82ca69157
SHA1 1ed113b64194a90228c55f4582f1d6d540c88349
SHA512 4e288c84f39122c17e9d0e6110cb65b4627676e67985c767e1d175c97998d27460faea19261fa69b40c6bf82d6bb279c959b9f8903ffe78c0d828536183735d1
SSDEEP 3072:2EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2nm7Rkm1tYpBeh2BAoa
TLSH
T1FCC3123B5D75E9375978AB4EB08E0B1F1EF149A6D930DE92C8D85B0437EA7CC0A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d1e07c4ba4033c150ae044e17ef6bff6589a1950294c1856a2c4b3f20196c8bc
MD5 ebd22d82d1842dee538e59fb41b3949e
SHA1 9ede984f80ca9d294d83d04ab0e2a13479457270
SHA512 d17b1e11bded39da5052f4d7c9b4422364626b3f683b10a30955006acf2f31f777b791bced5a1f1ad8949f732b49134ff2dab4f2e35a0ac29065608ae58ee094
SSDEEP 3072:3WZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:3WYm7Rkm1tYpBeh2BAoa
TLSH
T17FC3123B5D74A87759B9BB4EB08E0E1F1EF149A6D920DE52C8D85F0423EABCC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 036b9f6f358d017027768469b7228b93f97a3cdcaebd87c59e5c077a7f8a8cee
MD5 0da7a5caaa71822482908f7d13bc71c1
SHA1 14e83e23b998c366645e57fc1294b6dcca9ee2d4
SHA512 e6a36a1c61e64708125f7281b2cf90bbef045638017c7441e32a2ca5399e12f4833d5240fb5f4d85484a3092cc4cee403b927c7c6e616f344815490d7cbe0c2a
SSDEEP 3072:MWZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:MWYm7Rkm1tYpBeh2BAoa
TLSH
T125C3123B5D74A87759B9BB4EB08E0E1F1EF149A6D920DE52C8D85F0423EABCC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download