hxxp://avast[.]com

Analysis

max time kernel
900s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://avast.com
Sample260912-wsq7eaff32

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3144	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337862655019721"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
3296	chrome.exe
3296	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5108	2200	chrome.exe	85
PID 2200 wrote to memory of 2464	2200	chrome.exe	86
PID 2200 wrote to memory of 3144	2200	chrome.exe	87
PID 2200 wrote to memory of 2464	2200	chrome.exe	86
PID 2200 wrote to memory of 4848	2200	chrome.exe	88
PID 2200 wrote to memory of 4848	2200	chrome.exe	88
PID 2200 wrote to memory of 4724	2200	chrome.exe	90
PID 2200 wrote to memory of 4724	2200	chrome.exe	90
PID 2200 wrote to memory of 3068	2200	chrome.exe	91
PID 2200 wrote to memory of 3068	2200	chrome.exe	91
PID 2200 wrote to memory of 3280	2200	chrome.exe	93
PID 2200 wrote to memory of 1148	2200	chrome.exe	96
PID 2200 wrote to memory of 1148	2200	chrome.exe	96
PID 2200 wrote to memory of 4536	2200	chrome.exe	97
PID 2200 wrote to memory of 4536	2200	chrome.exe	97
PID 2200 wrote to memory of 2352	2200	chrome.exe	101
PID 2200 wrote to memory of 4112	2200	chrome.exe	102
PID 2200 wrote to memory of 4716	2200	chrome.exe	103
PID 2200 wrote to memory of 4200	2200	chrome.exe	104
PID 2200 wrote to memory of 4200	2200	chrome.exe	104
PID 2200 wrote to memory of 4136	2200	chrome.exe	105
PID 2200 wrote to memory of 4136	2200	chrome.exe	105
PID 2200 wrote to memory of 3296	2200	chrome.exe	106
PID 2200 wrote to memory of 3220	2200	chrome.exe	107
PID 2200 wrote to memory of 3220	2200	chrome.exe	107
PID 2200 wrote to memory of 624	2200	chrome.exe	108
PID 2200 wrote to memory of 624	2200	chrome.exe	108
PID 2200 wrote to memory of 4836	2200	chrome.exe	109
PID 2200 wrote to memory of 4836	2200	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://avast.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa48cc728,0x7fffa48cc734,0x7fffa48cc740
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,12021737029585640368,3799595029828894779,262144 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,1076264253034450393,5938089973507224906,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1572 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,251162696305837242,2379388062410347906,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,17058139096162574163,16104130795066526277,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,2397795125779235925,11526442701769466508,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,9936816818189923937,4725895346959967312,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5148,i,9205669869222983944,6177803696356208475,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3680,i,9848719036906153653,3349689238589378588,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,17581342818215044586,12631403992138686318,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,8081920834209873557,15442074542947972236,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,1892628966877130343,15166555293372994453,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5452,i,10371517851588905139,10452554672610038867,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=208 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5596,i,9155736933733559261,15679532475038515336,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5280,i,15662979592397999161,17552289277281164752,262144 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5180,i,2259155431489472212,18053491381064590300,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,10720359813398381197,16321656215627618018,524288 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3628,i,16296500648851747311,272010488431038558,2097152 --field-trial-handle=1988,i,10178000086953767184,15269972266526421444,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=732 /prefetch:1
  2⤵
  PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2274d51a5befb0df3a20e1dcc39a65aff8b21ad5fb4a9e607f4bcdc45a8d4a21
MD5 06bbd37ddbc5a9f93b5d07746b939042
SHA1 3d00eb77d69eb9011f9acc08af38fc0f8b0e0108
SHA512 98c5960b0c76483199307e33b3168a8696d9bd00fe22f290d7b3d4a63ee4411280815e70ee3232d90bcb65e097af4fd1d33f00ac3150e8bfd1f278f59322b2c6
TLSH
T1D1E02B99C821ED6704FD475E64580742F751135736E0880B3A3D920A8FB113AC589C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9374137dafefb00d8e8a6c4534d8059ade7a4ca229be7d79cf283df5cae8afdf
MD5 6ac0cf8ca0f95b5b87b73cc404fe73ff
SHA1 2109c56bc250f58eb2d02a6db7aa28d91089ff04
SHA512 6bcfa144832b89b30033fd6a6892a312346711a8ca7c5ddaf3dbd06ff5b69db243110c4cb6c3201e4cc2c627bf6fdb4706b763ad37499d0889b3f8d8fdd6be3b
SSDEEP 192:XR5ObByv73pAPRp2m9vH46b+WNnBZPRZegVyIsnAUge:XR5OVebUXphlLPLe
TLSH
T194327329AD20B97B5CDBD22AFA667B53D3F6102274942E84EAFCC93C14E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a7e6c135c8639bc4ae74efc6ab3de733690fbe8258bc248608026a1c3a8bc457
MD5 b56ec157d01ec622dd3449d55134919d
SHA1 cacc2e68f341452d83f86710e02637bb3b56e5a1
SHA512 76f784f8c094e5b3c42723d5413a57f509b5625ea5cdc4f00023759eaa3a22b83f16ff8055bd6aac12be48937ae27bbb2f3c7fa38ca1f59ad80646aa333fb92f
SSDEEP 192:XR5ObByv73p/PRpKJh9vH4Cb+WNnBZPHZeEVyIsnAUgE:XR5OVebpXChdLPnE
TLSH
T111429429ED2079BB9CDBD22AFA667B53E3F5102264902E84E6FCC93C15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fefcfa02cc060b3fcbefa1356362e96c6b1b20d8597eb87aba611e64e40f1597
MD5 86738ee46de36b55a2ec1260e976315e
SHA1 9ca83e03b64baf08ded59d29b917e76e46c050cd
SHA512 574f1d97dc1f4744208c8c7ef876b743b882fde68a143efeeb7788aca718043f02d98ce4bd90214182f92f8651689a8580637ce38473c2c348c381353484e2d4
SSDEEP 192:XR5OhByv73p/PRpKJh9vH4Gb+WNnBZPHZeEVyIsnAUgE:XR5O/ebpXChRLPnE
TLSH
T131429429AD10B9BB5DDBD22AFA267B53E3F5102264902E84E6FCC93C15E75CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 19601cb8a01155bcc63e55ff6ba2db76512048743cdf931442e7d6cf3bb161d8
MD5 de1dc91ecb483b93000400bdbf32fc2d
SHA1 7e455a6d4ccf2c9090f203a1e10a21e998e4e91f
SHA512 43c4adc748fb2d0bbf4a150d9732a6e395bb5f68730825a59ad6e4e0fb23cdcd6e3b6a79fa2259edfc46dca9f30d3e771f7ae9c3dbcfff10d6f0163959175c62
SSDEEP 3072:Ld+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:Ld+hFD+7t56OD9ZfSApprZ
TLSH
T139D31232BA95D8BBC9F96541B147A300DEB668ED41DE3A0944465F8EE09FC4C07A3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 692e59a2df81a850f8c80b57e9a9fd39f430af3dca2b128b5626cc669bc85676
MD5 0c38b055ca5fb0e534104e9031bf5b7a
SHA1 70bbe84a3acd6742b6d6503f8ed671c09aa1f682
SHA512 bd9a62d78046e7fcd57bbdd7ef83010fd5534fa4d8b59ee4bd7936cf741079896f5a97d7e4bd773997c37744cc66fe56648e87b2d79838ed5caec13066133438
SSDEEP 3072:K+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:K+hFD+7t56OD9ZfSApprZ
TLSH
T11BD31232BA91C8BBC9BC6541B197A300DE666CED51DE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 1f1a187077b24f4521fb30060cc0ec406d771e7f4d79ed76529a9670eafee348
MD5 3ca3649f6fd78923f051844e76e0814b
SHA1 1d5adb74b2e72ed96ba5ecc20ae0430354b0e61f
SHA512 912d348608b3c05c83d54cd4c8259ec720173af3a646da55a5ee7cb96dc186de9bcf972d661fcd5acd0d09377580673c56ae5b2740ec94f213ad48e0416c2f11
SSDEEP 3072:Us/O6ANhJz+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:Us2rx+hFD+7t56OD9ZfSApprZ
TLSH
T138F31233BA50DC7B49BC7141A687B314CDAB68ED45DE760D4446AB8E50AF84C07A3B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 26229a2dfb9af48fa7208d48b32d740c0ac1f922ccf123fce7b31c663342fc05
MD5 d0ca2572342077649263016463c4ecaa
SHA1 55643ff06e30662f01ae1134a9b0a85a43fa7f6c
SHA512 6924c0735d86fdc548f68ad6224c075b20c5e6e908dc8cf670f26250464f72743dd394519a3a89cc2013b2066bc5c3fb463905dffc949b56844b12a3fa28913e
SSDEEP 3072:cd+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:cd+hFD+7t56OD9ZfSApprZ
TLSH
T113D31232BA95D8BBC9FD6541B147A300DEB668ED41DE3A0944465F8EE09FC4C07A3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download