hxxps://www[.]google[.]com/search?q=keyhole+surgery+to+reduce+reflux&ie=UTF-8&oe=UTF-8&hl=en-au&client=safari&udm=50&fbs=ABfTbFXmzBGw9LECshVETHbdczUeUpWjpTDdKTtF_RlGr4gcWwmeFYnLl5U1CMVHAQRsEOkKmahp_WG0naVbNFXJZ1aYhgDKSxsysEhfqnzK8EelsUhG2dNMjBJL_AAP8QPLW2aaypr3JPqnX_ctqqpNRvVIAVD5Tfe-rkddbRXlK8RU3Diy2MQ494sp4TCwg5NnCEsvokAUyK6l3A6pPszgUPhbyIetH1_DmKcWdLCW_Z4DlO8zQuQ&aep=10&ntc=1&sxsrf=APpeQnslZfgSNxo4vx8ZDMP-z0CK45Ahdw[:]1792716363630&mstk=AUtExfDdNWagZux19VMhyDJZiyd6RgvwzEk5CBZ_Ch016ZS55cBYQUPjRy7ko4DIsSkjktMtFkYGbRyPA6ydmgH4iSskvwhpS7tw_7t7t1FgbOAyFhg_dPY88fIzxYNYOhVj6tvYEWEQ_ImkPDv16MrcilcY36rD6PcOlo648mD3DXYo8AY&csuir=1&aioh=1&mq=questions+to+ask+a+gastroenterologist+regarding+this&ved=2ahUKEwiyg8Lw9M6XAxVXafUHHWF4MdYQ7tASegQIAhAR&iga=1&utm_campaign=safari_share_1

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/search?q=keyhole+surgery+to+reduce+reflux&ie=UTF-8&oe=UTF-8&hl=en-au&client=safari&udm=50&fbs=ABfTbFXmzBGw9LECshVETHbdczUeUpWjpTDdKTtF_RlGr4gcWwmeFYnLl5U1CMVHAQRsEOkKmahp_WG0naVbNFXJZ1aYhgDKSxsysEhfqnzK8EelsUhG2dNMjBJL_AAP8QPLW2aaypr3JPqnX_ctqqpNRvVIAVD5Tfe-rkddbRXlK8RU3Diy2MQ494sp4TCwg5NnCEsvokAUyK6l3A6pPszgUPhbyIetH1_DmKcWdLCW_Z4DlO8zQuQ&aep=10&ntc=1&sxsrf=APpeQnslZfgSNxo4vx8ZDMP-z0CK45Ahdw:1792716363630&mstk=AUtExfDdNWagZux19VMhyDJZiyd6RgvwzEk5CBZ_Ch016ZS55cBYQUPjRy7ko4DIsSkjktMtFkYGbRyPA6ydmgH4iSskvwhpS7tw_7t7t1FgbOAyFhg_dPY88fIzxYNYOhVj6tvYEWEQ_ImkPDv16MrcilcY36rD6PcOlo648mD3DXYo8AY&csuir=1&aioh=1&mq=questions+to+ask+a+gastroenterologist+regarding+this&ved=2ahUKEwiyg8Lw9M6XAxVXafUHHWF4MdYQ7tASegQIAhAR&iga=1&utm_campaign=safari_share_1
Sample261027-dmv93aa12p

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
1656	chrome.exe
1656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4060	4916	chrome.exe	84
PID 4916 wrote to memory of 1416	4916	chrome.exe	85
PID 4916 wrote to memory of 1416	4916	chrome.exe	85
PID 4916 wrote to memory of 5048	4916	chrome.exe	86
PID 4916 wrote to memory of 4264	4916	chrome.exe	87
PID 4916 wrote to memory of 4264	4916	chrome.exe	87
PID 4916 wrote to memory of 4228	4916	chrome.exe	89
PID 4916 wrote to memory of 4228	4916	chrome.exe	89
PID 4916 wrote to memory of 2128	4916	chrome.exe	90
PID 4916 wrote to memory of 2128	4916	chrome.exe	90
PID 4916 wrote to memory of 2140	4916	chrome.exe	91
PID 4916 wrote to memory of 2140	4916	chrome.exe	91
PID 4916 wrote to memory of 2648	4916	chrome.exe	92
PID 4916 wrote to memory of 2648	4916	chrome.exe	92
PID 4916 wrote to memory of 1884	4916	chrome.exe	98
PID 4916 wrote to memory of 4840	4916	chrome.exe	102
PID 4916 wrote to memory of 4840	4916	chrome.exe	102
PID 4916 wrote to memory of 3640	4916	chrome.exe	104
PID 4916 wrote to memory of 2744	4916	chrome.exe	105
PID 4916 wrote to memory of 2316	4916	chrome.exe	106
PID 4916 wrote to memory of 1656	4916	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/search?q=keyhole+surgery+to+reduce+reflux&ie=UTF-8&oe=UTF-8&hl=en-au&client=safari&udm=50&fbs=ABfTbFXmzBGw9LECshVETHbdczUeUpWjpTDdKTtF_RlGr4gcWwmeFYnLl5U1CMVHAQRsEOkKmahp_WG0naVbNFXJZ1aYhgDKSxsysEhfqnzK8EelsUhG2dNMjBJL_AAP8QPLW2aaypr3JPqnX_ctqqpNRvVIAVD5Tfe-rkddbRXlK8RU3Diy2MQ494sp4TCwg5NnCEsvokAUyK6l3A6pPszgUPhbyIetH1_DmKcWdLCW_Z4DlO8zQuQ&aep=10&ntc=1&sxsrf=APpeQnslZfgSNxo4vx8ZDMP-z0CK45Ahdw:1792716363630&mstk=AUtExfDdNWagZux19VMhyDJZiyd6RgvwzEk5CBZ_Ch016ZS55cBYQUPjRy7ko4DIsSkjktMtFkYGbRyPA6ydmgH4iSskvwhpS7tw_7t7t1FgbOAyFhg_dPY88fIzxYNYOhVj6tvYEWEQ_ImkPDv16MrcilcY36rD6PcOlo648mD3DXYo8AY&csuir=1&aioh=1&mq=questions+to+ask+a+gastroenterologist+regarding+this&ved=2ahUKEwiyg8Lw9M6XAxVXafUHHWF4MdYQ7tASegQIAhAR&iga=1&utm_campaign=safari_share_1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8ef2c728,0x7ffa8ef2c734,0x7ffa8ef2c740
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,1522216764360803270,9939569815541041963,262144 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,7040380166906074001,15212127023729527166,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,1738777900907954742,808789364340077721,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,3036195475685794863,3848411217447750276,2097152 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,13325713821857428659,9078956194266581884,2097152 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,3932018895419093647,11841172651776016777,2097152 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,11268976505002554928,10999258749579898941,2097152 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,11631124076137861797,13344725477881565479,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,15463382096947601654,6871451706962231700,2097152 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,1487775647470205512,16136728103007286834,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,7583447314669668637,16898906655641568260,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,7485454132183808037,7650347104773101784,524288 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4472,i,18382708573810046185,3049748802310929323,262144 --field-trial-handle=1928,i,17756972421097489035,4429228159251436599,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23567c51-a1e9-4e2c-9c89-7d12fb1bcf2a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\23567c51-a1e9-4e2c-9c89-7d12fb1bcf2a.tmp
Size 131KB
SHA256 e5673965f269efa335e618be8c0411bc6a1c2c2d9bc90f6cc362849f2545a465
MD5 ab5d0effce67d6b9110a58ef3efca1c7
SHA1 dd7341faf2dc9ca9bab6c91b63f5c1e2ed23a6eb
SHA512 1a75d816e1bed8d7c89c69cb1ef84f8ef1280ef61d064c06b3a12a374dc1af9cae2629c87ed4890c99006749302dba142c59319daecaa2d1ef3e8a958f4828fd
SSDEEP 3072:ky+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:ky+hFD+7t56OD9ZfSApprU
TLSH
T104D30232A995D877C9FD6541F247A304DD7668ED81DE3A09844A9F8EA09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e4da6bd-21b7-4d5a-8e44-a96a80187f84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e4da6bd-21b7-4d5a-8e44-a96a80187f84.tmp
Size 131KB
SHA256 5b43f7653542331472eeff8e4a122b76eba4bc72b6b3a2dc19e10a4838d1bc07
MD5 643b26efbeff146108bd2da9ad663aa3
SHA1 61fbbbbe9f411da93ae7fcadf69d371069ea7c63
SHA512 440f6d6142d2b7c69983eb14effc7210ea738383c1f6567530fdd6805ea5f9cec83d84c3ae2761bfe399bfe5e44ae7547c02bd055aa45c7717f3892217c9bc13
SSDEEP 3072:z+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:z+hFD+7t56OD9ZfSApprU
TLSH
T10ED31232A994D87BC9FD6541B247A300DE76A8ED41DE2A09444A5FCEE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73e62b51-f242-4b28-93a7-70e0365d6818.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\73e62b51-f242-4b28-93a7-70e0365d6818.tmp
Size 12KB
SHA256 1f5aa8cd64e1e1b61f0de923c92c98286120a9e60b04eb4ad6e9a1fd9f41df6a
MD5 c4ae9723e0753c7f516fc12ff4827744
SHA1 9eec7a2526aeb6cd38d9b9806f120de5fc2dc54b
SHA512 2be2712e1357734fa0914a7386a58151fa145de63f87883787c6048234be75322ddd6cc211d3e8d37e7d819d54f1812b166c24c18902e94d062e3e2b1b72cf8b
SSDEEP 192:yR4cBzkzu/rXWn6Yhv7TpAPRp2WQI9WHsb+WNnZSZ3r2mI2ytYXauIVyIsnAUgE:yR4mzkq/rZYxvUXJUw8h2P2CSahE
TLSH
T1D352732AEE14793B9CDBC22AFA167753E7F9102160952E88E6FD893C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a141f87-1120-40c7-be8f-057cecbc3a23.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a141f87-1120-40c7-be8f-057cecbc3a23.tmp
Size 12KB
SHA256 c52ac1f618b37df786108f57434a6c6716b3d4bcebdc809d379d4cfcf095ff05
MD5 bc298765f966a53f8dea3afdb5707e98
SHA1 8ed17873c422a6bc9a7006135ab9c29ff6c7920c
SHA512 019e496f13d4b2ad1113e6167e7341cafd25cb3f247dcb7ea02855379953ca407b685f91a683899995c9a379c485abfe74314195560d57c6b941d9db44b57056
SSDEEP 192:yR4cBzkzu/rXWn6YVv7TpAPRp2WQI9WHsb+WNnZSZ3r2tI2ytYXauWVyIsnAUge:yR4mzkq/rZYlvUXJUw8h2m2CSabe
TLSH
T19442822AEE14793B5CDBC22AFA167753E7F9102160952E88E6FD893C15E79CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c3c5835-0d45-4d3f-a61a-97be4fc0bacd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9c3c5835-0d45-4d3f-a61a-97be4fc0bacd.tmp
Size 414B
SHA256 3e62df4db6e57cb2a47d6ffc08606445423ac0bc341aad8c70f948e72c1c5050
MD5 877175bb387ad30f012f5b64b8524db5
SHA1 f369abad29e3b930ee8b38bcb0ddf71ba8d4f2e3
SHA512 bafba5cbe3354410c9911e115c1747c6b97e0e98040c15a21bf9e8ed3ffd3bb450cccec664acaca575662f3379c2f55e0f723c3906b7c494780e6b1b734845fd
TLSH
T16AE0EDAACD61AC2709FD572814454689FB5423662B91844E3B3CC1088FB1A3A4A8A82C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 960B
SHA256 916552bb17545face75676129fcf2db41af71439b8d8648db2745ee984dfac9d
MD5 f04e6164bf61626495de0b5bddbdebff
SHA1 c711a19a55321562136023379e498257e97260ae
SHA512 83d29305578b056b3bfb649474b9a72e7fb7bd7fdd8cd10fe6e438f059408bf905a0998c0d378d84cf1bb32cd181040332b7575b7d95b03e745642c1247ab7f0
TLSH
T1A71197631C821548CFE8EBB543A6174167E32A46833E0297C9C2D9F969B17F371C83A7
MD5 SHA1 SHA512 TLSH

Submit Download

4784561b-d5fe-4167-950d-9d7c7665cb30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4784561b-d5fe-4167-950d-9d7c7665cb30.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9d05b992-5a4e-4b5c-84b9-2dd54317e908.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9d05b992-5a4e-4b5c-84b9-2dd54317e908.tmp
Size 7KB
SHA256 7cf91b177dd262a8215d9dc26a46fe6ec322695ce016cbf6b5c772901cfb11ed
MD5 179d1b6723a67011a870cc5b6356ca67
SHA1 e45e27c7733e731ad424464a72e4b30e678d95a4
SHA512 c43b9f1738176c901f18583839dd326b213205f66f00a54173ada6f3d353f5192c5e78472f7be0da7d7e148ad8525089f68477370d256b0441b42691e64ba66e
SSDEEP 192:DR3LA/Mrto/JaJcaIaEdSkYUaIuIyIEoPaPJv4fPUNPzIv9WR:DR3LA/Mrto/JaJcaIaEdSkYUaIuIyIE5
TLSH
T140E1BCF7C3D8C52DC94156F89B156F1ECE2A1A28432D3C26C8D8AE4B93E2871D25635E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 67ac783bfb54cff18a8e1c54ce3afeee4746ad7308ede17edfedb1b32aa4dcbe
MD5 85240cdd2a75a12845024810053c5304
SHA1 34ad13ae770c3b49c885513023c3665e3cfbdcf7
SHA512 9e4cd9db51d3947832550dbf93f80c8e8cd060ad26c62346a65f8d79f4c6fdf671bff5c1546f1102ea11a233d8ad55e60358f45ae113726cbb2574549c37e92a
TLSH
T1B5B0124584425301C04702F4135418883194DF20A615134181F00D518839550815B165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 24fdd2d2c5b400df414efb24a28c1f1a21cf0a77a80472720279ec7834043905
MD5 9298fbcea594b3d63f379499e2456ae7
SHA1 31586c13a32a39debe95b9d431654d3a5ec2939a
SHA512 9c3c2989f660c16869e5c9e46e7bcf86988f5bb18be3bca93cb2b796f9a60b4b57f1e5516f0ed82668dea07c3e053093bb092a6b75ee3ad2d71da81d0361c66b
TLSH
T112B002B5C2026722D08253B039D596D875F0DF2AC647A21BD3F49EB7DC3566045255B0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 1a6288c43ce8433de109873b2eafadbda1b0f64a3da03d875f66ef7b79431d8b
MD5 9f2bd7ccca9ef38094a11182c8751214
SHA1 8e87e5190d5e274fee0b9185bf93f0ee6213df5f
SHA512 116fb12d670484de55e03c9a5dc23f2197f403fa982f2df085f081e07ac4a7fe839e0ba19f9002f337e11c7e3c6a24780b5c26321d2fc8301a10c4f57acc7d2b
TLSH
T1E1B011A880022A0AE02202B082C00AC023A8A820230A8A00E0E2A0AEC000288820B30A
MD5 SHA1 SHA512 TLSH

Submit Download

ba9022e6-d19d-4ae9-ba01-ed3b20c59b19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ba9022e6-d19d-4ae9-ba01-ed3b20c59b19.tmp
Size 12KB
SHA256 b495dfe5fedea0bbe3324d1e7b235d610cd503b7fdaa534cf9b04ea3259399ef
MD5 4f843c10da2ad2ef30b7c9d316fbd1d1
SHA1 e9e87adfbc000517c0d4290c150f7047eac375c3
SHA512 a37699229a73c81e615ec7adaf36ceb3e1c12624b4d39aca8258e1cc753f5b4795fd92496cfbecbe5dc216d210bd126918fe4c82ee672ac4bcf24f6fe3fc789d
SSDEEP 192:yRQkzu/rXWn6Y1v7TpAPRp2WF39WHsb+WNnZSZ3r2tI2ytYXauWVyIsnAUge:yRQkq/rZYFvUXtUw8h2m2CSabe
TLSH
T15242932AEE14793B5CDBC32AFA167757E7F9102120912E88E6FD893C15E79CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e85905e4-0490-4d76-a086-20e66ef6f968.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e85905e4-0490-4d76-a086-20e66ef6f968.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5acf054-7608-4898-91e4-efbe67a34c20.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5acf054-7608-4898-91e4-efbe67a34c20.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 8554e66f3764c4323d53d3b19d4770a40e60a4b266ea1c27c6916984b3727f47
MD5 94da847007ad8f8ba03376c55e1c9faf
SHA1 7ef877d5de896becb8bf7e52c4207a8cb10b5f20
SHA512 f1d955c6b11317dcc5fc9b24b8e6be2cc387bd619d57c629e2c2f486042273c1f4dbc3153a71905e0a095d0a84b17a618eb1ac49487f9e1b7acf0916c16ec9d6
SSDEEP 3072:i+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:i+hFD+7t56OD9ZfSApprU
TLSH
T1C5D31232A994D87BC9FD6541B247A300DE76A8ED41DE2A09444A5FCEE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb0cd7e4-7b45-428c-9763-be3068bf1701.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb0cd7e4-7b45-428c-9763-be3068bf1701.tmp
Size 130KB
SHA256 22a0effa881f21d4acb1d918b5173ee837e6e760954f4219d3c3324aa11cc752
MD5 79262deed7701ce5f51d3b0dacacda5b
SHA1 a1d5bf7ac1b35490032d5aa7c783b50232a98ef5
SHA512 08ab22d82e43c21b20b7c634c84c23c853ca2efd9ee58f682c77690803fc7ca93db6d97f0b7ebec2ba2a5ffb902307bef57c0c0d9c2b035501715b1261d2f07b
SSDEEP 3072:8+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:8+hFD+7t56OD9ZfSApprU
TLSH
T171D31232AA91D8BBC9FD6541B257A300DD766CED41DE2A09444A9F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download