hxxps://docs[.]google[.]com/spreadsheets/d/1O1tQYMx4aFh90v6y3VxQ3c5AbybUfDrdp8yXV-KkXPw/

Analysis

geolocation tags

asiadelhiinindia
max time kernel
22s
max time network
24s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/spreadsheets/d/1O1tQYMx4aFh90v6y3VxQ3c5AbybUfDrdp8yXV-KkXPw/
Sample261102-2cefkaxtcs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1116	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 1592	3352	chrome.exe	81
PID 3352 wrote to memory of 1688	3352	chrome.exe	82
PID 3352 wrote to memory of 1116	3352	chrome.exe	83
PID 3352 wrote to memory of 1688	3352	chrome.exe	82
PID 3352 wrote to memory of 4200	3352	chrome.exe	86
PID 3352 wrote to memory of 760	3352	chrome.exe	87
PID 3352 wrote to memory of 4200	3352	chrome.exe	86
PID 3352 wrote to memory of 760	3352	chrome.exe	87
PID 3352 wrote to memory of 4452	3352	chrome.exe	85
PID 3352 wrote to memory of 4452	3352	chrome.exe	85
PID 3352 wrote to memory of 3812	3352	chrome.exe	88
PID 3352 wrote to memory of 3812	3352	chrome.exe	88
PID 3352 wrote to memory of 4152	3352	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/spreadsheets/d/1O1tQYMx4aFh90v6y3VxQ3c5AbybUfDrdp8yXV-KkXPw/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8265dc728,0x7ff8265dc734,0x7ff8265dc740
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,8715743693394588162,4877736380011445955,262144 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,6932881406895938603,16424581267331377052,524288 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,15113931480339155906,9941865298021684049,524288 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2664 /prefetch:13
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,15099405446010647898,11126079832382204705,2097152 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,9322689717474388607,4547548558815521398,2097152 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,2687301760054467299,5301214604271383342,2097152 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,3302231820644796221,16662382558240395278,524288 --field-trial-handle=1936,i,739870643619282364,6240201553399543862,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

001373e6-b967-4c67-beff-8755f9746b71.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\001373e6-b967-4c67-beff-8755f9746b71.tmp
Size 130KB
SHA256 f42596cb4f36e21b05a435a7f30a71d7cfcbf98c55cdf3daa88154f4ebd39c4a
MD5 8440018a70f6cf54998deaeacba1709a
SHA1 5d3522bdd85ed4fca8b9489994e8740bb8ce004f
SHA512 eebb866b706ba8edf224c6517cda6bb6ddc7b928678a29ba126ad94fed00f71ce72ed261da1a0db2e6554bddaf9219efa662a43ce0469966b3005bd5e37afc1b
SSDEEP 3072:RzH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:Rht4fLJ0L6nGJxi3bzqapJja
TLSH
T14DD312F1D1E06C7ACBF7EE4045796E908E71D5C689C9BE2409FD881816CEA344A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b9143cb-50d2-4f32-81fd-1beb9e225897.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3b9143cb-50d2-4f32-81fd-1beb9e225897.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6f22e560-59a8-48ca-b0c3-f5ee6de825a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6f22e560-59a8-48ca-b0c3-f5ee6de825a2.tmp
Size 414B
SHA256 666bd6af6c99c9654aac70b362f193df49b678ae5041c99ce1863afd385b8f9d
MD5 4516e7cf8baad4190c7ec70a19e6798c
SHA1 312efdfbeb9250c6caa6c5101877c9dca0a93b2d
SHA512 69268d2067846041efa470060c166bcc5761d60cfd647cabfaff72fa6813b219e00042ecc4cd2362cf0929324b0677664a24a5f49817bb82f631a41f39fbd98c
TLSH
T160E02BF9DD11ED2B1CFC176954614B49D66113572A40C58F3B3C96088FBAE2645C689C
MD5 SHA1 SHA512 TLSH

Submit Download

7b85250e-3c2d-4a8b-837d-2bf26a5b8651.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b85250e-3c2d-4a8b-837d-2bf26a5b8651.tmp
Size 12KB
SHA256 d87cb73bfabe2ef62fe432200b2a65e6d36ae833278b22d6c1c7318e6fc53577
MD5 e629a6031e72cb229a0176b1abd2a1db
SHA1 185aa8a4e55715fa089d4f69459b1d5f58b1a30d
SHA512 2bc440f72b69186a029d85f30a996d8105fbb6abce1eb4c9aca9d958e2fa6620a6044dfcf14fe7434565509f0434f847f53a46aed27834aafcc5fa6d7fe3426b
SSDEEP 192:kRc0ndx1iv7BpAPRp2IQ92Hsb+WNnmx5fX23n0D00RVyIsnAUge:kRc0hudUX4wwY923me
TLSH
T1AC42C66EAD14393B6CDBD22AFD257A67D6F6102130902EC4EAFC882C15E79DD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0eed5c12-b2c2-4cae-98cf-6bf35c023031.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0eed5c12-b2c2-4cae-98cf-6bf35c023031.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4082c12-2417-42a9-8400-5d07fbeb02b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d4082c12-2417-42a9-8400-5d07fbeb02b9.tmp
Size 2KB
SHA256 cbe378bd01b3afb3a8ee59f25279147070e1221f3f8ebc4fa29d2d4820b06e28
MD5 73a5834ddf4d7eb8873b427a10d57388
SHA1 5f7bb29eb6286eafd4df1cf284cba2e6d0b8578a
SHA512 eeb07a96945d351ea2c2050f24edab6d7447af45854e7f0cb0cfa851c417353af21bc1ba65789ba3f48ae033fee644b44b7e6b44da05b62a02312bec26e5d945
TLSH
T13F416AF7C3D8867D8900A2F8A7256E1FCD2D0A25522C3C56D8D4AE9B53E28B1D25055E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 4f0aa3228d0532f91aa94ca8c88bd047cdd371b11fb91358045fa9fdaceb6fdf
MD5 541793e0b20b2186f05924ac05bec64b
SHA1 3f857455d0ce02018a241a4062214a6a915d4157
SHA512 3f470c6d0939431c7cf3e995e2450035af5ab9e44d1a367fbc4495961e66de9809fd1ee009b867bd253303739c12e09b0735ebeae45741addafbe1d309a4adf9
TLSH
T1DAB0125580415302C0A202F812A4189C7995EF10A605130641F00D218835650901F055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f267470a922d3785ad889831e1df1aa3b21067a0f18483145cd139669204b84f
MD5 173adeaa526913eda6abab05e5e27d71
SHA1 2b597792b9fe364068555424d123b56563371b74
SHA512 1a6f4cdddc585f0191646fadc3d7559b9b6ff25d57bc8a57a6044e8226cbf400146a3ec2d6cf4f087f7df0718664ae011c290001d9a25a4bbaace0ef07e7ad13
TLSH
T1DDB022AAC3023202C00303F038E080ECB022CF23CA03020282F03A3ACC20B208022032
MD5 SHA1 SHA512 TLSH

Submit Download

fb15292d-a55b-4a78-a15c-d8d53705dadf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb15292d-a55b-4a78-a15c-d8d53705dadf.tmp
Size 17KB
SHA256 6b7cee8b1a5eb6f1d44c20ace754a545db0a1024ec3af9927adcfd7fb5491934
MD5 6ebf767a844f07086ae64536124c4a52
SHA1 dfdc2ed2621b56af7ab86ee74a08835c5544579a
SHA512 3d3a2843ec32079f785bc015a3dfab1b143f21902675eeccd9fb84c1a22147178feb9f7d146c1c8203d46344ff8432180128aefaab9fd51e9a50a3c74b2f5ee5
SSDEEP 384:Uijon7KxkXqKf/pUZNCgVLH2Hfgsl3i7pLuLceSijXODoL+ErU3pTHGsUXIoi0lA:Uion7KxkXqKf/pUZNCgVLH2HfgsFi7p9
TLSH
T1D1721A677C4C993B0F94C9CCDC2A7E4FADB5024B61E9886483FA5C2A03D5ADB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0f1b9a9-f5ed-432c-9e42-9314a3874158.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c0f1b9a9-f5ed-432c-9e42-9314a3874158.tmp
Size 131KB
SHA256 dd4622427de771cbbb01bf9bba5c500a587c83448dfe92f80e997088c1f36d2a
MD5 b5cf9162c05729f3907502c9892bf4a1
SHA1 5fe79f1ec138b16c43ce4e14b3e551bcafc7bb4f
SHA512 a34b52cbb1f8523d8e9d0d007123339f4e63c395b9a160aee1f03d6672a7e3a79d24e6f2be17166030cdac90f8ba6f75759f283f870c4cb59abdc2805a525f6f
SSDEEP 3072:6bH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:65t4fLJ0L6nGJxi3bzqapJja
TLSH
T17AD312F1D1A06C3ACBF7EE5145755E908EB1D5C689CDBE2009FD891806CEA384A17EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download