50523550d74b79dd0d383dbb6f5629134085179c86e4290d63783b1a4dddf53a

Analysis

user interaction
yes
max time kernel
899s
max time network
864s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
about.html
Size 273KB
Sample261012-vb15lseb77
SHA256 50523550d74b79dd0d383dbb6f5629134085179c86e4290d63783b1a4dddf53a
MD5 9452c1ba20dc0af95e9beaa341be897f
SHA1 812c463ac84da4a1b2c785eabd405848562ccd86
SHA512 dbda77e14ad0d49b9a2a775e6e59a25ad787a9a6c04a7d9d75b657cdfc4878ecc1e88a14787b6d2b6a04bcb00d081a857fb77a215045e8865ead7531143f0d45
SSDEEP 3072:oZ9xRrUBLdAJtSoEgHsiM1yPYUM0owMZnFCmuaUab1vM6rD3vyxVRR9LSc6YRIBw:oz4gTM1yPYUM0owMZnFCvabtxjyV
TLSH
T1AF54E821F109E9699C5B7D4E613CBE7A514E937BC909D4B4F2ECCE18038B976AE835C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4156	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4296	1428	chrome.exe	85
PID 1428 wrote to memory of 3724	1428	chrome.exe	86
PID 1428 wrote to memory of 3724	1428	chrome.exe	86
PID 1428 wrote to memory of 4156	1428	chrome.exe	87
PID 1428 wrote to memory of 2792	1428	chrome.exe	88
PID 1428 wrote to memory of 2792	1428	chrome.exe	88
PID 1428 wrote to memory of 3332	1428	chrome.exe	90
PID 1428 wrote to memory of 3332	1428	chrome.exe	90
PID 1428 wrote to memory of 712	1428	chrome.exe	91
PID 1428 wrote to memory of 712	1428	chrome.exe	91
PID 1428 wrote to memory of 4696	1428	chrome.exe	92
PID 1428 wrote to memory of 4696	1428	chrome.exe	92
PID 1428 wrote to memory of 3504	1428	chrome.exe	93
PID 1428 wrote to memory of 3504	1428	chrome.exe	93
PID 1428 wrote to memory of 4656	1428	chrome.exe	97
PID 1428 wrote to memory of 4672	1428	chrome.exe	104
PID 1428 wrote to memory of 4672	1428	chrome.exe	104
PID 1428 wrote to memory of 4984	1428	chrome.exe	107
PID 1428 wrote to memory of 4984	1428	chrome.exe	107
PID 1428 wrote to memory of 2628	1428	chrome.exe	108
PID 1428 wrote to memory of 2628	1428	chrome.exe	108
PID 1428 wrote to memory of 3320	1428	chrome.exe	110
PID 1428 wrote to memory of 1176	1428	chrome.exe	111
PID 1428 wrote to memory of 2516	1428	chrome.exe	112
PID 1428 wrote to memory of 4640	1428	chrome.exe	124
PID 1428 wrote to memory of 4804	1428	chrome.exe	125
PID 1428 wrote to memory of 4804	1428	chrome.exe	125

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\about.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff68b9c728,0x7fff68b9c734,0x7fff68b9c740
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,15027391367686196461,17141875235216193209,262144 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,9349828380299545405,6062985744849806858,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,2608051401495848704,11511608762409858496,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,2679391260216343208,4065768982675696176,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,7044428201562786752,12576464715167322713,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,7247515808819559169,15410239850205530676,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,2001225832739022289,2391656835852608571,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,17944180661313131206,5191687366318539603,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5604,i,16810275300456935279,14754354681155067534,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3308,i,235264968375806571,12099259405324758682,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3432,i,3228921333227676614,7638823399050045487,2097152 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,13637318529282236511,15829294597737849398,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,10231637548856847348,2892077416518638692,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,4901378141453176202,14531698294372300,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,5251663001524572936,4905465686003042461,262144 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,18290969003871594524,4326455070570782714,524288 --field-trial-handle=2044,i,2051842228897646955,6556951445651342349,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

495ad20e-809b-4252-a7da-df6524116e37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\495ad20e-809b-4252-a7da-df6524116e37.tmp
Size 130KB
SHA256 3bed5a6dfb9110acaf8d33c970464964664c82602a5ca5c13ccd14ccc3a512c2
MD5 78232cf71ef10ba02f7ee243867714fe
SHA1 997812bd488b478c30daaff5ef1d243704b112bb
SHA512 3835818ecf795e1f5ce9fe60616fe9bac2d44f5d3c35871cf04945a93d4d3cf32e6d52a98378d1ac6a947d958ab23c0a693b223ee505bb7bfa4490532bc761fa
SSDEEP 3072:c+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:c+hFD+7t56OD9ZfSAppry
TLSH
T103D31233AA91D8BBC9BC6541B157A300DE666CED41EE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

787bca96-ba03-4497-b1ba-812c32c428f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\787bca96-ba03-4497-b1ba-812c32c428f1.tmp
Size 131KB
SHA256 57c9f7f3dcb83d3d7b0d7e93877f02c53a68a968ef9760e24f36e9fb2dbf5f3f
MD5 87e3f2c18c163f1368eef9cb00618646
SHA1 01e52ff5f09c5c8d9224a7e99e488fd366a811e0
SHA512 79f6ed721c1e0dbf30a3f208a5588e620dfcc8b5c3b754ed31683fea06cae1e29df335eb90f311fb84781da6d858eb3633aa562cdbaaf0e042db0a2b0a0867f9
SSDEEP 3072:A+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:A+hFD+7t56OD9ZfSAppry
TLSH
T12BD31232AA95D8BBC9FD6541F187A300CD626CED45DE7A0944865F8EE09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96eca36f-c98f-45dc-b6b2-7d8bcf3d6de5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\96eca36f-c98f-45dc-b6b2-7d8bcf3d6de5.tmp
Size 131KB
SHA256 81e8e610c6862d6b0aa5cb79e63653a6323f95d67d819d214d3743103b0dea9a
MD5 735799056b9af77c89345df7fdae8a9e
SHA1 42b28c591f64dfab5e646605cd3ad8c7ca5b2725
SHA512 32b6ac00c9731f2668a37c727af00e464c7a294b60817b1c87faf7c4858afdd3da72649ecddaf848e6d0a299e56572964e289727250df944d49e1fb158d84583
SSDEEP 3072:X+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:X+hFD+7t56OD9ZfSAppry
TLSH
T170D31232A995DCBBC9FD7541F147A300DE6668ED85DE3A09444A5F8EA09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bd906f5-b4c6-4d7f-86c2-8877de48f94b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1bd906f5-b4c6-4d7f-86c2-8877de48f94b.tmp
Size 12KB
SHA256 dfcfc5cf8570834d36653fc2ac1b4a0005523a8c377b1fc5b9ccdd95f2ee3131
MD5 43d2474869781a1dc776759a8806abc1
SHA1 37150b35ef7c6a6499559f6fcba86f5b0029a830
SHA512 efddd9212d267b5a1a677f79d54902b37b21d09db3fcb802fb33e513ea2207e7e23b4c44ee1fe367c83a93d31f7c4e4143cd5442de100041740311fcc6cd2efc
SSDEEP 192:wRqyh6SHcFZRv7D0spAPRp2Lz9+Hsb+WNnxuPh+e7r1B49+VyIsnAUgGg2:wRqyhLoBvjUXYUwUPdr1g2Z2
TLSH
T15742C52DE914697F5CDBE62EFA663B57E7F6102524902E80E6FC893C15E79CC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61ce65fc-5653-440f-91bb-c248eed1a4c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\61ce65fc-5653-440f-91bb-c248eed1a4c9.tmp
Size 414B
SHA256 27ad0d3a12b0c7dfaf3b6f8533aaad36cbd3bf6ef4e3a49ad684186dc67825f9
MD5 5da1a991310b90830fb12ed78c2508ba
SHA1 3bbb283fe379079ed7e9b324b733872ac2e1dc94
SHA512 e08acc114609eb90d993320f0228ed9e4513a4bcb159f192d806dbe4eab7890df3a9976ef647838b4fdca389507d6fc656bb1c2b7cb8c1e3bcb23e225795085a
TLSH
T1AEE02BE9C960ED3704FD173D90941745E79003572A40554F3A3C901C8FB067B498695C
MD5 SHA1 SHA512 TLSH

Submit Download

78fc83cd-479c-45c2-93c5-c666b2621a28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78fc83cd-479c-45c2-93c5-c666b2621a28.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9044f3d6-3a0e-4029-94e5-586e0e000e35.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9044f3d6-3a0e-4029-94e5-586e0e000e35.tmp
Size 13KB
SHA256 7c34bc58e3e692eaad6c3c9c0daeafdb6d16d5663feb85d5648e37fb53b81342
MD5 8cab33d10f511b5c07c3a21d5294431f
SHA1 e188a37a1f659dd825b2d402f8022c947f82a7ae
SHA512 03097c050fce92932a4e9471e6df0df95fffbf27f571ea5700eaec1fc708c5b4eaeaeb3a2c0bd781005ee1434ad78780c6f1231f3ee54c46c222a37ea7a698d8
SSDEEP 192:wRqyhZSHcFZRv7D0spwPRpyLz9+Hsb+WNnxuP1+e7r1B45+VyIsnAUgGg2:wRqyh8oBvjwXMUwUPJr1K2Z2
TLSH
T19352E529E914697F5CDBE62EF9663B57E7F5102524A03E80E6FC8A3C14E79CC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 467KB
SHA256 980ff73a969bca995cce2a922c56886b69bff0296f078eaf83352c52144c6b9b
MD5 dbcdb51ac97f13746079201e1769586f
SHA1 fa2e0921b743640c883ba2369ff52be2e29c09f9
SHA512 b7b82a3bac48ee25b7344da6cf70bd149aea9b9efeb1a8fa29be76e64cb6c8dd6a3db88b8a3c0b3e909296c0a98a211bf2697e79b82e3ff297cde115f483daec
SSDEEP 12288:boPUKvSMC/7UTKa4qMTQ7q/nolq75SKPRe7FlHBhw4JqFRiSfX7C:UP9vyna4qTA5Sc+FEF5X7C
TLSH
T166A423BDE9F3A53E6CC78882A368918A870363447B0577524C8F0BB40D968FF787995D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 474KB
SHA256 fb61d5a263355728d239e2aacd6066fb96a74db4cc1c28664498ebb147ee1caf
MD5 2aa6a091988be6365f6f410ce60c42a9
SHA1 4cdcf9de3b61da010448e0f4540685c6dfc3fe53
SHA512 1b79cda977db4d15a0e2713781480b56518f157de986a8d14a31212b7b2821921dcfc47f677953a6578b5c70e395b81fd71e28ea9479cf33ca510e8470e4cdf5
SSDEEP 12288:80b5e7JJRAdiZyWAJytoX0pIXqkWr4S7xKhKz3rP9:8q5AJRAdv4tlkW0S7xKE3r9
TLSH
T1CDA423A5CDF400DA6950B27745F88803BF76324B1ABB566F2B8AF2744E1217017E5BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10079899-0d9f-413c-922d-62c97bd47ed7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\10079899-0d9f-413c-922d-62c97bd47ed7.tmp
Size 3KB
SHA256 ddf7d67818912e4e90acc1fa90ce86d3bea90524ba6b98b1f46d4cf7869a0465
MD5 02873e2bfe421974679f38174eb31f5a
SHA1 d336308dd963d3661e343e5832d5e362daab471c
SHA512 68def6a114815ab869d7e73cdc31a27aa516503de0a04cdaee4c4d036b55ae78186c576d036b6f740e51ffa46ea0bbec3e54bb81257f217e0ad5d8e2a274763b
TLSH
T127619AFB83B4867E9A0192F09B156E1FDD6D0526432C3CA689E46E1B53F2972D14138F
MD5 SHA1 SHA512 TLSH

Submit Download

2e29a840-0025-407d-9899-43ad3eed20d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2e29a840-0025-407d-9899-43ad3eed20d4.tmp
Size 3KB
SHA256 604484dc6d5d2c1278970a8d4bca789a61bcb848d3c5983cca9ec9b527bee632
MD5 2d4ee31bd2f6f887b555a26886322d1d
SHA1 c2a9e5e6c30a98b40c80375cec66b480c9e2707f
SHA512 f76f6da2f8848d22b2316b686f5d15a3be215f6260fb63befcebcb8fd85451d7684e05f479eb838e93c14a0544cef74f4458778063487d3d7e19e470f137ff0f
TLSH
T12C71CEF783E88A7E950192F09B256E1FDD2D0526432C3CA689F4AE1B53F2971D24138F
MD5 SHA1 SHA512 TLSH

Submit Download

74338910-80db-4002-9de4-e8751e49524a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\74338910-80db-4002-9de4-e8751e49524a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

84062e11-f2cb-4399-a38f-f8faf8052e19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\84062e11-f2cb-4399-a38f-f8faf8052e19.tmp
Size 511B
SHA256 a8330de3ff60a3beca9fb093b33e4c37b5c73560de2ce401f8a2a4660c02f36a
MD5 233fdeecf3abe8289d736e3054701bcc
SHA1 dddee0479e1fa533c3b33b53a0be31078213f238
SHA512 7e3700df0f4cc129d7ae87c291010f0bfcaef4e557fe2bbf494992e020ac609d926fea70620cdf7a36ca81cf410469e715b3aa5c006602cd72ec142df25b0a60
TLSH
T124F09EBBD67F7567507E447B2E04B80526B6A875114178F4CF9B92ADE0E10E71B03017
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e75789f912f59b9a6f663e0494d468a61511e287068722eaaa21c7361d925816
MD5 2c52deb92558a418871f530a85402849
SHA1 e955a3f251c1309ae59fbaeaa2c610e486bd64e8
SHA512 2e9b32f5f426d6dbbb847b764b4a7433cc8c11ce25fdb55552186c784e4b51acb432fb6bbf2f12cd8eab826faff73744869479284ab42b7de6013955cbc026c6
TLSH
T1F8B01205D0417701C40503B01551E06432B08F3CD212338541F00E1588362F0401710C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 81ff8e11bad2e1b5b0a9bf091418fddb19ddd93118bc1483e547b2d329cd9a7a
MD5 1c6d98e37c8fbe4682e0b24ec0f563e3
SHA1 fa70adb3828c6b0862da22de6298aa8cad5035a3
SHA512 028215a3f80ef03ebb385d85144ca663ef86cc7e481df828cd98b3409f5b46f6190c424c8989fc0763886bb7819735653a72050fda9d9a118d1947e913ac36d8
TLSH
T129B02220C3022203C00303B028E0B0C8B2B0CF28CE03A30382E00A2BCCACA30002C228
MD5 SHA1 SHA512 TLSH

Submit Download

b40fcda0-1b3f-48bc-b1d2-c5128ddefb1d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b40fcda0-1b3f-48bc-b1d2-c5128ddefb1d.tmp
Size 12KB
SHA256 8ddcd5942cd50669eb081500d3005a62b7c6bf7659421768049b7d3d67d88935
MD5 377628be6bcbdae36466c5ebf596b893
SHA1 fb9f19d90fbf69d70f2caafb8cc06e73b484cd98
SHA512 a4578dc72bb32919ccc67dba3050b37145ddea61e175803dd58a88220e54978450e05adf94c101741ef98bae4bcf88871b58b306fcd83995c4a005c42a25de41
SSDEEP 192:wRqyh6SHcFZdv7D0spAPRp2L29+Hsb+WNnxuPu+e7r1B4O+VyIsnAUggg2:wRqyhLodvjUXVUwUPEr1L2L2
TLSH
T18F42C52DED24697F5CDBD22AFA663B57D7F6102524942D80E6FC893C14E79CC222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efed5a6c-58f8-41bf-83a7-ce4579249018.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\efed5a6c-58f8-41bf-83a7-ce4579249018.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c032b70e-00bb-4c3d-86f8-0378cb8c2a13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c032b70e-00bb-4c3d-86f8-0378cb8c2a13.tmp
Size 131KB
SHA256 aa9682706ebe9a488801e1832398eb21d8914cb374d964b296007116e57e569a
MD5 fbce7745c210d4bbe4b14a70d59516ad
SHA1 a174a7c5936903cfafb60b1457936fe16a518144
SHA512 5e488b98c760950f942534183a11e2956d50c863e060b2ff24e0857222e29a4fb403acf2d46d13fc11bc29003e53c438ce3e614d6733e502fae4af72b8ec4572
SSDEEP 3072:p+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:p+hFD+7t56OD9ZfSAppry
TLSH
T1D3D31232AA95D8B7C9FD6541F147A300CD62ACED45DE7A0944865F8EE09FD4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f53a71a5-471b-46a4-a680-3074db0dafb4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f53a71a5-471b-46a4-a680-3074db0dafb4.tmp
Size 131KB
SHA256 37850569536ed2b4a99cdb154abbff8fe6c43a1f7c91db71d403fbe4a8323c2f
MD5 9a91b5287d67f1059a97f3b7a0612b45
SHA1 e73e2f1ac0d1273fa8439041f7f372a3e6e76e46
SHA512 6a9f14acc2988f1907a9d5b65327cd025b8ceb8a5fbb7c9b5ecbf40d09be4d8fc61f12235e7a4aad8ab473c1f2b79571adf9177fbfcdb925e34bf28e0d4799b6
SSDEEP 3072:b+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:b+hFD+7t56OD9ZfSAppry
TLSH
T1D9D31232A995DCBBC9FD7541F147A300DE6668ED41EE3A0944465F8EA09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download