hxxps://track[.]carregosa[.]com/web/link[.]php?kS3DEzRoNOshw4efk5YpT0DQoaYalJrX6MDsck1k7YOJakp67ESgLAt%2FVR1Ur1b254RreGdjtcP19cLQ8kaxytEZdv%2F4k5KCY%2BIskVzBoirbiNEH2FW9SfTieC%2BMnUGM10tfR%2ByqwtWvZtirOYxotowc5dWK%2B6VdRYgYEGpFSD%2FBFzaMybQhxQbm24z1UnY7uNoFAlQrMb7BV2LEnPalx7IlNmZ2xbKNhL9WpMPFLMkwmUFbM03pJROySHwuIS8j6EHJoXce6fn42sZKtP3YovkMVx3cAF94siSJCFG4K31Eqhk3xJcVfknye1b2SEhoRBEbjj2dfS5VyndGaNe%2F08eGe4NNwe9xoSPvHumWhxA%3D

Analysis

user interaction
yes
max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://track.carregosa.com/web/link.php?kS3DEzRoNOshw4efk5YpT0DQoaYalJrX6MDsck1k7YOJakp67ESgLAt%2FVR1Ur1b254RreGdjtcP19cLQ8kaxytEZdv%2F4k5KCY%2BIskVzBoirbiNEH2FW9SfTieC%2BMnUGM10tfR%2ByqwtWvZtirOYxotowc5dWK%2B6VdRYgYEGpFSD%2FBFzaMybQhxQbm24z1UnY7uNoFAlQrMb7BV2LEnPalx7IlNmZ2xbKNhL9WpMPFLMkwmUFbM03pJROySHwuIS8j6EHJoXce6fn42sZKtP3YovkMVx3cAF94siSJCFG4K31Eqhk3xJcVfknye1b2SEhoRBEbjj2dfS5VyndGaNe%2F08eGe4NNwe9xoSPvHumWhxA%3D
Sample260930-sraw9abd23

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 5076	2508	chrome.exe	86
PID 2508 wrote to memory of 4280	2508	chrome.exe	87
PID 2508 wrote to memory of 4280	2508	chrome.exe	87
PID 2508 wrote to memory of 4204	2508	chrome.exe	88
PID 2508 wrote to memory of 8	2508	chrome.exe	89
PID 2508 wrote to memory of 8	2508	chrome.exe	89
PID 2508 wrote to memory of 5040	2508	chrome.exe	91
PID 2508 wrote to memory of 2056	2508	chrome.exe	92
PID 2508 wrote to memory of 5040	2508	chrome.exe	91
PID 2508 wrote to memory of 2056	2508	chrome.exe	92
PID 2508 wrote to memory of 4828	2508	chrome.exe	93
PID 2508 wrote to memory of 4828	2508	chrome.exe	93
PID 2508 wrote to memory of 4200	2508	chrome.exe	97
PID 2508 wrote to memory of 4200	2508	chrome.exe	97
PID 2508 wrote to memory of 4040	2508	chrome.exe	98
PID 2508 wrote to memory of 4040	2508	chrome.exe	98
PID 2508 wrote to memory of 548	2508	chrome.exe	104
PID 2508 wrote to memory of 4800	2508	chrome.exe	111
PID 2508 wrote to memory of 2164	2508	chrome.exe	112
PID 2508 wrote to memory of 1204	2508	chrome.exe	113
PID 2508 wrote to memory of 4696	2508	chrome.exe	125
PID 2508 wrote to memory of 3200	2508	chrome.exe	126
PID 2508 wrote to memory of 3200	2508	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://track.carregosa.com/web/link.php?kS3DEzRoNOshw4efk5YpT0DQoaYalJrX6MDsck1k7YOJakp67ESgLAt%2FVR1Ur1b254RreGdjtcP19cLQ8kaxytEZdv%2F4k5KCY%2BIskVzBoirbiNEH2FW9SfTieC%2BMnUGM10tfR%2ByqwtWvZtirOYxotowc5dWK%2B6VdRYgYEGpFSD%2FBFzaMybQhxQbm24z1UnY7uNoFAlQrMb7BV2LEnPalx7IlNmZ2xbKNhL9WpMPFLMkwmUFbM03pJROySHwuIS8j6EHJoXce6fn42sZKtP3YovkMVx3cAF94siSJCFG4K31Eqhk3xJcVfknye1b2SEhoRBEbjj2dfS5VyndGaNe%2F08eGe4NNwe9xoSPvHumWhxA%3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff5d86c728,0x7fff5d86c734,0x7fff5d86c740
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,9870058534439274532,11530474139433147796,262144 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,9780199287627360529,11109059768597716178,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5806208537625869240,1343334386574626360,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,16171647651515992095,2055047014653218164,2097152 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,3005122591507777744,10619623623836601118,2097152 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4100,i,514263369795691973,15523561344109964538,2097152 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4112 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,6325714709695019223,835312205874453562,2097152 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3244,i,10937444418286681823,18063080858671019090,2097152 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,16246645435305317353,4740315426237307709,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,12677081157127006132,16145065751135643223,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,1490354620417699793,17955408938878511016,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,4113329658070702735,13264331270536950733,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5484,i,17155861292601721680,610191835702315477,262144 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3188,i,5048919005480671010,12318383307354747963,524288 --field-trial-handle=2020,i,9062527611993570097,9918936737239906267,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:3200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 81a07d83065cd55455334b28e7c5f21e2a4b3bc580280fc8c0e7642cfa4edaf0
MD5 598b8af922c606e39c4aa6ff0917bdc6
SHA1 ece9d5feba570ab37695320ea7e979bb83dcc561
SHA512 cce2cda27bf79caa3708b95f5d0eb43615610b1c294c36e3f00e81e3f8acab7be1f42be9253d9decf3f7684f7050b7c1910040a737b5b8cff9e03f9fe74bad6a
TLSH
T1BFF028E5CD20FC3B18FD1B296064074AE740135B2A80899F3B3D911D8FB063B8A8695C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 be8920aac12bc0bfd9dcc3baa150fdd82955c6938c1e517ec6055e5b2b7a1bc3
MD5 5435d99f3245277f893f796a6adc9683
SHA1 b68300606d6e61b5c2269138532a7a7783cb2d4b
SHA512 f668a3d1ec433cbcbdceb1baa4fdec12d846e3b87830688997b2d855ce5bd078d9b5182a7932c9949777fde1c3f76f5b42c6b2c77cd9b34780688c9f222f197c
TLSH
T1A4E05200E7C84752EF048A3108A80E2B5228BA954707CB03BDA1F8C83C9FBE0F802346
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bac5db66e6540695f5bf68f62af2bed0f5aea613923608dac0f2d947bb84c013
MD5 e049f5f964590393c32deebacd77ac7c
SHA1 6d921a00e55fbb279801d062307290b1b321fb26
SHA512 b74236337070687de5228785df47bbf77b82266db402237434ff40cf19594928970d0355f09b4723f7071b62c4b921c2da4e25409151f865c0be8d17024742bd
SSDEEP 48:YALl4hVU4hVDLhSRYJ4hVBCsRRswfoKsFXLsufsposnKsA4sAgmzsGRLfCUjB5sS:DlOLsju3AXuAxtNBe9BP1C1SLK
TLSH
T1A5919CF3C3E8C62DC82116F5A7156A1ACE6E0E58522C3D5AC8D4EF5B97E1871E34064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 69848aedd5046943577879ca63055bcf3b108fa9b58515da3f88a74ef2676d52
MD5 d617b55013e70d1f5490f3c3b8cc6ea2
SHA1 d40e27956c487837ccaf5848cf9eaeaa509ab088
SHA512 59410b9cebb105bf8f334d2cff2984b425372e64a524382c44fc29b3b24e0c1f59369534d501178afc47949af416fa1b7e0270990f169461a17e0eef6c09856a
SSDEEP 48:YALl4hVU4hVDLhSRY0sRRswfoKsFXLsufsposnKsA4sAgmzsGRLfCUjB5sRf4hY+:DlO7ju3AXuAxtNBeGdBvSBK
TLSH
T11381ACF3C3E8CA2DC82156F8A7156E1ACE6D0E58522C3D5AC8D4AF5B57E18B1E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1919812234f3c2fece70d0a8d513539fb1a1648706462815393f67582c4c1579
MD5 3774eb5eb5389ab8ff0e463eeef2d75c
SHA1 a84e0ed2cebeee36fc999835d884583f16e1c1dd
SHA512 77b5f3defd67c30d060ce7ffef81a218007dde9f3ff14d1a1852c34fa5dde0e60344ccf110aa9528f6f4293af70c624b821cbc32e0647775aa57362329140ac2
SSDEEP 192:wRX7P6opAsvv7D0spAPRp2ED9+Hsb+WNnbgt/c2jNWockwzVyIsnAUge:wRX7PV3nvjUX/Uw8628n1e
TLSH
T1A642B32EAA10757F8CDBD22AFA627757D7F5102520942D88DAFDC93C14D79CC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2a83dfce4d1aa08ddf2b5c005759156f25b49bc3b3d76526a1a913d9d2041808
MD5 603e882b33e1d0af0a71d72575cf0162
SHA1 6a6143a7029587b407967edba4ad2449316f03fe
SHA512 e8965575e691a6fd11062c2999ce9fc631fc20d5fd5fdda7cf024e8d4b70ab698df439b11aee12b10e5948fb2402b71d31a24f903e0bb6c85ca8bf9f62b9262c
SSDEEP 192:wRX7P6opAsIv7D0spAPRp2ED9+Hsb+WNnbgt/c26NWockwYVyIsnAUgE:wRX7PV3UvjUX/Uw862dncE
TLSH
T1E442B42EBA10757F9CDBD22AF9227757E7F5102520942E88DAFDCA2C14D79CC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a9cc0fef983eaa28f26202906b69bd2204a738e897273ca3c77aca548ef2987c
MD5 a9082135d0a3aee681d8d0d22835c2ed
SHA1 cc25493be64220577e0ad4976de78fac61170049
SHA512 3a97c80de381f5907e8e5ebd37e3b4c00650db313f5ad476727ea5cad4f46e31e4fdd8503f416f837a5d65987e6acdd6035f4cc7e90f816d3a3f9e6ccd9fe924
TLSH
T196B01205D0412302C00103712154D46432A08F38E21313CE51E04D069832271507714A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591042.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591042.TMP
Size 96B
SHA256 3b18f0dacd4ce5e69809def83e4ec029592f477863aa192f1b6a46eaa25e605e
MD5 af39930908432bb7e5694a528baf410b
SHA1 700e3f8e2cbaa6b7bcd3a92d32ee53e8a04c15db
SHA512 b18f63d6ab0cc40edb0ea07ac830aacebc7ca64ac9ad1c24abaa14d12a46783be0191e326684cb14817d1af76fbaeda918daaf45ca6b914999bee05d5e4ccd8d
TLSH
T1E2B00259C5A77213D04607F525FDA6E87170EF75C603122293E01FA6EC75A714535162
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 50faea1f7e3e7460d20694f38cde679a4aa606a947230512d02847377b36b41a
MD5 d7074b67387d491ee0097a9866cdf47b
SHA1 da64540f2241297ec2adfab9ff90992d977e5028
SHA512 7dde642bd0a82e0e70602e82af742cb8b07bb291869487791427b93392d0e29198f37dc23cd03945d5e04ecfbfceac4ebe0d24ca81e1702c44b0552969d11b5c
SSDEEP 3072:/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:/+hFD+7t56OD9ZfSAppry
TLSH
T1FCD31232AA95D8BBC9FD6541F147A304CE62A8ED45DE7A0944465F8EE09FC4C07A3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8ea2dc7529153de20cdfa64e693a8959c2285e85fc7532caa00fb825241f6bc6
MD5 1623258025e0aa05a5b99730b6976c14
SHA1 432b7416c0fcb161acc1e4c862aa14e3b1b2aaef
SHA512 2cd2e6395bdd55ec8b043f2640091d9279b9e814d64e75da9004a9ad38ce180c290628e3fd39f09463d65d42925f3af4b100334f3f784f1532d3eb04f45ec960
SSDEEP 3072:g+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:g+hFD+7t56OD9ZfSAppry
TLSH
T13CD31232AA91C8BBC9BC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 7c500ab8b3bd80e3a67cce0c24756eb2d5b593ce0f923e22cce0f04b12eec5d5
MD5 4d97c9048a3f592b6abf437964e87d0d
SHA1 f362520414f9a6cb918b86c48058cdf718048159
SHA512 30111f98f54baa267a2b5b2e3b2778c27c047c8ed8144a2ad7cf779b624d2a067d094d528a24ec31fa41f751f501020bbe65b4d01e5cc69e377af918504f2614
SSDEEP 3072:Y+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:Y+hFD+7t56OD9ZfSAppry
TLSH
T18CD31232AA95D8BBC9FD6541F147A304CE62A8ED41DE7A0944465F8EE09FC4C07A3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3db85f9f0f8c60d4aa6d86d46e4e5b2bbbdc961474d04c6da821d814ca0a9230
MD5 c61f027dbaa46548ebde76b703d04441
SHA1 e129f79c33eb3754a989fad3700e16da2390fdff
SHA512 be840eedb33c1079e31c81bb6d3f46bfee49a6fcc16aefe5d88f2099e0a7eef1d24c30c211cc1285fb55eb9cd4de9738dfc4934d62e33846ca48f0275937fee0
SSDEEP 3072:m+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:m+hFD+7t56OD9ZfSAppry
TLSH
T17FD30232AA95D8BBC9FD7541F147A304DE6668ED41EE3A0944465F8EA09F84C07B3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b05c7105bd7c24587f39536a6b34870172a01e855f9bc3c33e867574b26d9519
MD5 e624368cf01652c8bab5935e1d3ab712
SHA1 4fb729b5434a466b69d5e98c905e128089ab5e12
SHA512 69f8fc76c9444596a8cb91297145d8105e8ee6da7deaad34e0f625f6be8307655a00e064eadcd1fa27e843d39dd92220336b2d8a395d128fb807339c1b7b1117
SSDEEP 3072:m+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:m+hFD+7t56OD9ZfSAppry
TLSH
T146D31232AA95D8BBC9FD7541F147A304DE6668ED81DE3A0944465F8EA09F84C07B3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download