hxxps://eu[.]icp[.]ids[.]api[.]iris[.]microsoft[.]com/api/v2/a/c?url=https*3a*2f*2fm365[.]cloud[.]microsoft*2f*3fopenAppStoreOnLoad*3dtrue*26amp*3bfromcode*3dcmmccvltg1m*26amp*3breferrer*3dutm_source*253Demail*2526utm_campaign*253Dcarplay_email_qr_code*26amp*3bocid*3dcarplay_email_qr_code*26amp*3bpt*3d80423*26amp*3bct*3dcarplay_email_qr_code*26amp*3bqrversion*3demail*26amp*3bccac*3dtofqrcode&d=AIAACKQZYIPZ7OQRE3Q7SGS3NV2BLRJGSGYKVVIQW2G66SATAISET2OKN5BNY7AGE53A7VTW7EBULVDKUTKA5ML6ZNNYQJY33D4CHX3P3YI7XVEZN4PNC7LO42SCN6AF3S6GP2PMCR466B2YFY4YOPPCZRQBRFULFXPMZVCOCWMJ2ZWXNVHPECPOEVMBNGE2HUUXIN4A5HZKNUVQQ4HNH276WDROMMSQDGK6KVRRLT75PERIOUQPYANMS6PRYHWUQ6ILY&i=AIAACRYB72HLOGFRCKVZA2436NBNH6BHPMHDPAGWKM2KX6UWI7YJDKMQLUT5VCX4INDLU26DN3YLQAGQPRLTDDTGYNPSLDA43PA46BQQY5QD7UXQM6YUMKXSO56EB7QKDS22VQBF4PH53NLIZHWKWAIIUKCTLRRQIDNHXZXDQKBZV4YVRAXMFKURX5NNIKNPZN6NZ2WCDUJYYETM3VZULHSLC4LQ2RXUX5QJ2VFVRGB7RAAVB27WDRAW2NXLDQI2FY7GMKMFQ7T3FUJXKPJUNWXAZRWTEJH4XJ2VWG2JGJA5TPGXFFIGAJJTBO5X2JYJLFQAGY3LNGL4CSBCGB27N3NU6KNPQ5NKUUU6OVDCAZGTN7XCBMVNLIMP73X6TUKGYM2EGUXXW6SIBBORVKHY6KDHW3LUSRI5G3MHRJWSAQYCNGYPGPPG3DH5WFYBJQAVOV45RIGI2DNNUFPXB4JDJRB7DRW674TGQRFKW6FWGMP4JFWEI34L265V2DOHJBOW233QXVFDRW467G22DRLOLQGH2P2QCJY&s=WDP5M4APXCWFRWVS7MAGWAJWTKB2ZC5F6FB2ZXXOAA3VUPLCTOWA

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eu.icp.ids.api.iris.microsoft.com/api/v2/a/c?url=https*3a*2f*2fm365.cloud.microsoft*2f*3fopenAppStoreOnLoad*3dtrue*26amp*3bfromcode*3dcmmccvltg1m*26amp*3breferrer*3dutm_source*253Demail*2526utm_campaign*253Dcarplay_email_qr_code*26amp*3bocid*3dcarplay_email_qr_code*26amp*3bpt*3d80423*26amp*3bct*3dcarplay_email_qr_code*26amp*3bqrversion*3demail*26amp*3bccac*3dtofqrcode&d=AIAACKQZYIPZ7OQRE3Q7SGS3NV2BLRJGSGYKVVIQW2G66SATAISET2OKN5BNY7AGE53A7VTW7EBULVDKUTKA5ML6ZNNYQJY33D4CHX3P3YI7XVEZN4PNC7LO42SCN6AF3S6GP2PMCR466B2YFY4YOPPCZRQBRFULFXPMZVCOCWMJ2ZWXNVHPECPOEVMBNGE2HUUXIN4A5HZKNUVQQ4HNH276WDROMMSQDGK6KVRRLT75PERIOUQPYANMS6PRYHWUQ6ILY&i=AIAACRYB72HLOGFRCKVZA2436NBNH6BHPMHDPAGWKM2KX6UWI7YJDKMQLUT5VCX4INDLU26DN3YLQAGQPRLTDDTGYNPSLDA43PA46BQQY5QD7UXQM6YUMKXSO56EB7QKDS22VQBF4PH53NLIZHWKWAIIUKCTLRRQIDNHXZXDQKBZV4YVRAXMFKURX5NNIKNPZN6NZ2WCDUJYYETM3VZULHSLC4LQ2RXUX5QJ2VFVRGB7RAAVB27WDRAW2NXLDQI2FY7GMKMFQ7T3FUJXKPJUNWXAZRWTEJH4XJ2VWG2JGJA5TPGXFFIGAJJTBO5X2JYJLFQAGY3LNGL4CSBCGB27N3NU6KNPQ5NKUUU6OVDCAZGTN7XCBMVNLIMP73X6TUKGYM2EGUXXW6SIBBORVKHY6KDHW3LUSRI5G3MHRJWSAQYCNGYPGPPG3DH5WFYBJQAVOV45RIGI2DNNUFPXB4JDJRB7DRW674TGQRFKW6FWGMP4JFWEI34L265V2DOHJBOW233QXVFDRW467G22DRLOLQGH2P2QCJY&s=WDP5M4APXCWFRWVS7MAGWAJWTKB2ZC5F6FB2ZXXOAA3VUPLCTOWA
Sample260910-hpxm5asvht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4924	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334969443854066"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
820	chrome.exe
820	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4252	2236	chrome.exe	89
PID 2236 wrote to memory of 4108	2236	chrome.exe	90
PID 2236 wrote to memory of 4108	2236	chrome.exe	90
PID 2236 wrote to memory of 4924	2236	chrome.exe	91
PID 2236 wrote to memory of 2328	2236	chrome.exe	92
PID 2236 wrote to memory of 2328	2236	chrome.exe	92
PID 2236 wrote to memory of 3684	2236	chrome.exe	94
PID 2236 wrote to memory of 3460	2236	chrome.exe	95
PID 2236 wrote to memory of 3684	2236	chrome.exe	94
PID 2236 wrote to memory of 3460	2236	chrome.exe	95
PID 2236 wrote to memory of 4728	2236	chrome.exe	96
PID 2236 wrote to memory of 700	2236	chrome.exe	104
PID 2236 wrote to memory of 4904	2236	chrome.exe	105
PID 2236 wrote to memory of 4932	2236	chrome.exe	106
PID 2236 wrote to memory of 820	2236	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eu.icp.ids.api.iris.microsoft.com/api/v2/a/c?url=https*3a*2f*2fm365.cloud.microsoft*2f*3fopenAppStoreOnLoad*3dtrue*26amp*3bfromcode*3dcmmccvltg1m*26amp*3breferrer*3dutm_source*253Demail*2526utm_campaign*253Dcarplay_email_qr_code*26amp*3bocid*3dcarplay_email_qr_code*26amp*3bpt*3d80423*26amp*3bct*3dcarplay_email_qr_code*26amp*3bqrversion*3demail*26amp*3bccac*3dtofqrcode&d=AIAACKQZYIPZ7OQRE3Q7SGS3NV2BLRJGSGYKVVIQW2G66SATAISET2OKN5BNY7AGE53A7VTW7EBULVDKUTKA5ML6ZNNYQJY33D4CHX3P3YI7XVEZN4PNC7LO42SCN6AF3S6GP2PMCR466B2YFY4YOPPCZRQBRFULFXPMZVCOCWMJ2ZWXNVHPECPOEVMBNGE2HUUXIN4A5HZKNUVQQ4HNH276WDROMMSQDGK6KVRRLT75PERIOUQPYANMS6PRYHWUQ6ILY&i=AIAACRYB72HLOGFRCKVZA2436NBNH6BHPMHDPAGWKM2KX6UWI7YJDKMQLUT5VCX4INDLU26DN3YLQAGQPRLTDDTGYNPSLDA43PA46BQQY5QD7UXQM6YUMKXSO56EB7QKDS22VQBF4PH53NLIZHWKWAIIUKCTLRRQIDNHXZXDQKBZV4YVRAXMFKURX5NNIKNPZN6NZ2WCDUJYYETM3VZULHSLC4LQ2RXUX5QJ2VFVRGB7RAAVB27WDRAW2NXLDQI2FY7GMKMFQ7T3FUJXKPJUNWXAZRWTEJH4XJ2VWG2JGJA5TPGXFFIGAJJTBO5X2JYJLFQAGY3LNGL4CSBCGB27N3NU6KNPQ5NKUUU6OVDCAZGTN7XCBMVNLIMP73X6TUKGYM2EGUXXW6SIBBORVKHY6KDHW3LUSRI5G3MHRJWSAQYCNGYPGPPG3DH5WFYBJQAVOV45RIGI2DNNUFPXB4JDJRB7DRW674TGQRFKW6FWGMP4JFWEI34L265V2DOHJBOW233QXVFDRW467G22DRLOLQGH2P2QCJY&s=WDP5M4APXCWFRWVS7MAGWAJWTKB2ZC5F6FB2ZXXOAA3VUPLCTOWA
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe455bc728,0x7ffe455bc734,0x7ffe455bc740
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,13837355857224271033,2338950787601329634,262144 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12158123470464751655,16907027555141057501,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,2990409863329085709,4985255404708159967,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,545033433047769601,6036448161761913531,2097152 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,16222829326031820928,795791128611964630,2097152 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,1067996369974145584,18254557208554160929,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,3982415094543169780,13871908597618567169,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,14412304421183264508,8476585291900867235,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,9375758805579055424,2817273962554050078,524288 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=728,i,10394616228460533261,17665460571387111318,262144 --field-trial-handle=1860,i,15056741668189994510,2166799891131108717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 51b1f5773d6cffb092656851992c569d9a14b9e959b404fb18d1f90f78f65c75
MD5 34aaa9acdc1a21d78c84bc8794854938
SHA1 619a18889ff9ec62e4db62308eb333f8210b718d
SHA512 7899b25734cdd4fafe5b9feca5b4af8376146732044f58943e1332034d3e516ae29e1a63918d00d1d0b1c8a3d0a5553a763c996ddc17ff0bc19771b456fd9e47
TLSH
T13FE02BAAD935BC371DF95B2C70441B4AE744135B3B80C94F363D810ACFB567A0146C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 90582a9ab7885a161432c792a3c43b9179217883a18769c61830b195c47746a5
MD5 55630972ba270f77b1151c3fbf754037
SHA1 a41933b4d3ca449e46227491205eb7fc99b78666
SHA512 e0b0ad3e241adf6a5e43118ad8f3bcfd1897878aee17689e3f409868ca43714195025da6ac4fa300fbf508a546c659f5c97487df2899b21f202bd48db04225f8
TLSH
T15F319BF783B4997E8A01D6F4EA156E1FCE6D0525131C786689D4AD2B83F38B2E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8e9729947a8bef27a96ad47b1a5c055b4ea7740eaea3f6e5ef08ad54f689067f
MD5 75f0676d8bdae0c9db6766be6050a578
SHA1 16e7ee0bd7fa26a38e9a53ec9397a2b7b020d42a
SHA512 1e01b3cc64af31e2fc2e86968fc22a39794a5ecf72dc42a23a70b7605b5b0aeab20d6689f6d3297beb415372e815e740f8b48edb5b8ca68cd0c2d30cd16680ed
TLSH
T1923166F753B0997E8A00D2E4DA15AE1FCE6D0525131C78A689D4AD2B83E39B2E10139F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bf7a61abd9def2b7f8940d97ea603125ac7301b39031846968b8f7add4ba77d7
MD5 393ec53c092cdf4813510347f68ffb54
SHA1 87d4bb40bdaabae259e9e526e8c48bd3e941a866
SHA512 c9486fed96ffb4f25a2b2326d8850db6ee8698f71756b06bf767c170c75c4a739f1aed57d070c45b5c39a5f5f3b53d8072df4623e25cefdfeeaa5060bbe1a566
SSDEEP 192:/R0+qzfv78pkPRpGni9DHsb+WNnVCcYu2hQeaQg2ttVyIsnAUgE:/R0+634kXx5wsy2uQg2t7E
TLSH
T1A042C63AE950693B6CDBD229F9657B67E3F6102265901E80EAFC892C15E75CC322311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6db254e9efdb26e85a7a64980d63126ee960074e38a11e9378e9c49a094c097a
MD5 4eece2fc9b250fb5634be1fd646b7d14
SHA1 f940e5d6988f3dd5d8833891fb26c95099e521c2
SHA512 b73ba6453163f5ebd9298f2f3baa6d6f68473244b019c6cf9e9fb33ecd18f93ffe6c2cd21fdc17503312fda26042d97af7c643ee6d11de8ddad32cb5bf987897
SSDEEP 192:/R0+xzfv78pkPRpGni9DHsb+WNnVCcYu2hQeaQg2ttVyIsnAUgE:/R0+134kXx5wsy2uQg2t7E
TLSH
T1A042C63AE950693B6CDBD229F9657B67E3F6102265901E80EAFC892C15E75CC322311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 82f7267afa9602e23cccc5aa96bfbba12846e40441b145723ce6110fd7718257
MD5 a308777f2284831d49e579752ed95e2d
SHA1 e717c665b1cf936af7ba0a4a85affe6e5d54e9c5
SHA512 a6b0c8911e0d6abd3e6555291f5d40292b43a693d30b1d845f3326d30fefc9da66b7d98915aada09669f41fd9f27b23fdb0e8f14ef59349e507b55d458c29a74
SSDEEP 192:/R0+xzav78pAPRp2ni9DHsb+WNnVCcYu27QeaQg2tPVyIsnAUge:/R0+124UXB5wsy2EQg2tpe
TLSH
T13F42B43AAA60693B6CDBD229F9657767E3F7102265901E80EAFC892C15D75CC322341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9e102927792a314a0ecdcf58e237fb59baf5622756c64d171d2c85138f557bdc
MD5 42cf3c0324e7696fc31c97d06ecfeb22
SHA1 799bfc9fc5d9f9a47f282ace84230db9ffafff51
SHA512 62901420bbd13df788f26671c806c342db83c85b69a3ba1d332c169e1c8d324cf63c82c392c1943d5e24eb9569ad4ac3b7019810d6619ba3575649a6bf4d7eab
SSDEEP 192:/R0+xzfv78pAPRp2ni9DHsb+WNnVCcYu2pQeaQg2tbVyIsnAUgE:/R0+134UXB5wsy2mQg2tdE
TLSH
T18A42B63AEA50693B6CDBD229F9657B67E3F7102265D01E80EAFC892C15D75CC322341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c77cdcebc7457558d33bd818f7ad3a3a7a91db1ae305819b9389bcedf6453e6d
MD5 ed14a258ddbcda0567f853360348e159
SHA1 e15d9cad4062fbf5113cc7fb5a10fa34b6ea264e
SHA512 ca442a1bcf25c75bfada7553c8ce2192cc964912b8d5f507af156b44780badf21c316311b31c0a19e0538ded933554ca44f0e1fd0283bda4b350651906c02ee3
SSDEEP 3072:kCGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:k1m7Rkm1tYpBeh2BAoO
TLSH
T1C5C3123B9D65E8375DA9BB1AB04E0B1F1DF24AA7DD20DE42C8D45A0433FA6CC1A45E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 de05d59377070280fec2b82afcf9feb352af0c8c8fb953067756d2dd94f6c123
MD5 95b70eabcfeff2f98cce1b7ce7631f47
SHA1 92a78d1d1bce5acfd25711be3f3448482da5569b
SHA512 fee26094b23ceb15c46419b5469cbdfe2fc39d1c2a2c856305fee7f6b1ca291c070be75e04db72439d300e35c448c1965990a34ca582271536ec48fc5394839c
SSDEEP 3072:a4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:azm7Rkm1tYpBeh2BAoO
TLSH
T121C3123BAD65E9375CB9BB1AB04E0B1F1DF14EA6CD20DE52C8D85B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e00ec85f3b9519e5a662a548cde61d4c9cb553fa663602cacc64c52009433e79
MD5 9a78d8932367c0fcb2c0aab2f19a5b1b
SHA1 6ba6e5f0ec81ced6fda66101b4dfa7b126712187
SHA512 eee3055f7dd3f592fbf8912700b5e92979da9a7832f4f830263c0aff8edcf34d0015587474ab7489d9a73ed63ca77a2c141a5a98533c755b0caad4b8556b9bd3
SSDEEP 3072:XGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Wm7Rkm1tYpBeh2BAoO
TLSH
T19FC3123B5D65E9375D78A71EB48E0B1E1EF24EA6C930DE42C8D46A0437FA7CC1904A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7db416cb1a23acac5d97e8da78bf9b002d3b852bafc10964d39b817112230278
MD5 918ba778ead033e65caab498c0e7716d
SHA1 6e317b584386919ff6fea943a499796a37f1eea8
SHA512 ffb86812fdf63adf8452fb57b29fc65dc741c5c285a86373ea6e3661c93bbe18d3e1feaa8e9217067f7a82d5125f2fbe28c3d0b368e0029b3d8ccdd5db7c159d
SSDEEP 3072:J4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Jzm7Rkm1tYpBeh2BAoO
TLSH
T12BC3123BAD65E93758B9BB1AB04E0B1F1DF14EA6CD20DE52C8D85B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download