hxxp://sabzsaze[.]com/wp-content/uploads/2023/08/concrete-sla-regulation2[.]jpg

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sabzsaze.com/wp-content/uploads/2023/08/concrete-sla-regulation2.jpg
Sample261102-w8tbpscv61

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4144	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3452	4268	chrome.exe	80
PID 4268 wrote to memory of 3424	4268	chrome.exe	81
PID 4268 wrote to memory of 3424	4268	chrome.exe	81
PID 4268 wrote to memory of 4144	4268	chrome.exe	82
PID 4268 wrote to memory of 580	4268	chrome.exe	83
PID 4268 wrote to memory of 580	4268	chrome.exe	83
PID 4268 wrote to memory of 4072	4268	chrome.exe	84
PID 4268 wrote to memory of 4072	4268	chrome.exe	84
PID 4268 wrote to memory of 2132	4268	chrome.exe	85
PID 4268 wrote to memory of 2132	4268	chrome.exe	85
PID 4268 wrote to memory of 2604	4268	chrome.exe	87
PID 4268 wrote to memory of 2604	4268	chrome.exe	87
PID 4268 wrote to memory of 236	4268	chrome.exe	89
PID 4268 wrote to memory of 4076	4268	chrome.exe	91
PID 4268 wrote to memory of 4076	4268	chrome.exe	91
PID 4268 wrote to memory of 488	4268	chrome.exe	92
PID 4268 wrote to memory of 488	4268	chrome.exe	92
PID 4268 wrote to memory of 4996	4268	chrome.exe	93
PID 4268 wrote to memory of 4996	4268	chrome.exe	93
PID 4268 wrote to memory of 3252	4268	chrome.exe	94
PID 4268 wrote to memory of 1060	4268	chrome.exe	95
PID 4268 wrote to memory of 4660	4268	chrome.exe	96
PID 4268 wrote to memory of 4620	4268	chrome.exe	97
PID 4268 wrote to memory of 4620	4268	chrome.exe	97
PID 4268 wrote to memory of 4024	4268	chrome.exe	98
PID 4268 wrote to memory of 2224	4268	chrome.exe	99
PID 4268 wrote to memory of 2224	4268	chrome.exe	99
PID 4268 wrote to memory of 3400	4268	chrome.exe	100
PID 4268 wrote to memory of 3400	4268	chrome.exe	100
PID 4268 wrote to memory of 4660	4268	chrome.exe	101
PID 4268 wrote to memory of 4660	4268	chrome.exe	101
PID 4268 wrote to memory of 1812	4268	chrome.exe	102
PID 4268 wrote to memory of 1812	4268	chrome.exe	102
PID 4268 wrote to memory of 1492	4268	chrome.exe	103
PID 4268 wrote to memory of 1492	4268	chrome.exe	103

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sabzsaze.com/wp-content/uploads/2023/08/concrete-sla-regulation2.jpg
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfdf1c728,0x7ffcfdf1c734,0x7ffcfdf1c740
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,587718382512962890,2397435984129233595,262144 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,11248838924362840297,14792877868373263231,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,9478793699799034254,6672428605220842048,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3056,i,832031292975702866,14689904043872539122,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3048,i,10941395690459436061,881218623672579134,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,6956852857820947479,4092621414344511241,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3940 /prefetch:9
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,380722900650595309,11124033580634175446,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5888,i,17413118519838779913,16552168361087492322,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4596,i,15882863532879116533,12900641268732796373,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3288,i,15009956749780904075,9926673770691426251,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,12511143343865457606,1288489288360783069,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,5372504083791201022,15900575144671848288,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,14388905325430311414,4457354428013974475,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4440,i,15012214836301234888,15806669483794162971,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5664,i,7472701058666427709,7527939800717300928,262144 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,3739534160392780908,15586573766213709749,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,7310443480011825603,529283596065643871,524288 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3252,i,6679022726366034961,3241447610636230569,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4608,i,8775775150573504291,10199132311308630669,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5968,i,4215456718301318481,7833596558857590644,2097152 --field-trial-handle=1944,i,16569918648238700764,10311811915480475707,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05fd2e53-6248-4fd2-9ddf-7a267d5e6cfc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05fd2e53-6248-4fd2-9ddf-7a267d5e6cfc.tmp
Size 132KB
SHA256 2fede1e2062dd4f0f2564460f92d341e675ed70de637889c07d8afb75b6e5d4b
MD5 de6914860391b737fbe7dc68b6d8b8b5
SHA1 35e06cb0a2f72495c97a3244d0070ec56bda48a5
SHA512 77dec02c5221874642c1b8f8c62ebe145bcc81a46e5642878600b53a5d97a08d950a776031a92c62db45c4ac635b3138fb0eb3c17c4223d1b25b411c37b6a34c
SSDEEP 3072:hedH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:hezt4fLJ0L6nGJxi3bzqapJjP
TLSH
T156D302F1C1A06C7ACFF7EE4145756E948E71D5C7898DBE2409ED8C1802CAA784A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65ded0bb-8e0c-44d3-803a-0c277f7ea227.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\65ded0bb-8e0c-44d3-803a-0c277f7ea227.tmp
Size 131KB
SHA256 f527e7a8eff7dcf45b07daf649fa07cfad69d5bf0ed45a259cdaf8866e8b159a
MD5 1a1ef1165befd83aa9591305c519e173
SHA1 c897e3a94a2b85cdcda2f76d51219d290362c5d5
SHA512 e15f7486b35d4dbfd8001514bb7104b843de4ebf87daa0583caaaed811d06f4bb388a08718ca5d528ae064214e146c93348c7640c587cf08fc35f08e75a43ec8
SSDEEP 3072:magH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:maot4fLJ0L6nGJxi3bzqapJjP
TLSH
T105D312F0D1A06C7ACBF7EE4145756E948EB1D5C689CDBE2409ED891806CEA340E13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16b6f1e9-8e30-4006-aecd-4decb0c9d629.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\16b6f1e9-8e30-4006-aecd-4decb0c9d629.tmp
Size 13KB
SHA256 f299ded800ba58b386af33ace44d53f29c61202788333acb9718f9f02c24d7f6
MD5 fecc4a81b4116799a8b1bde9c2de8a93
SHA1 8b1f4c811d5e156374c73df1e7b2073ec3d5b0d1
SHA512 39374a2e5ff7fff770aea7c1e5bcfd3f8b74038eaf7431bae841fb766de7d13b952c25a36e5cd136933a4ed32f4523f4a4a4f001234bdabb0cb5503208b35118
SSDEEP 192:xRUt8choNfGIv7fpEPRpX559UHYNb+WNnjDPgTHaKVzeVyIsnAUgE:xRUt88Uj8XHWsPPkaZE
TLSH
T1EA52B82EA910397F6CDBD22EF9627B67E6F5102520A42EC4E6FC893C15E79CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c71f09d-de33-43db-8d1c-1c272dd3fd72.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c71f09d-de33-43db-8d1c-1c272dd3fd72.tmp
Size 17KB
SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
MD5 4c845b2618eefdd47280df258df1e5fa
SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
TLSH
T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41d0b036-2fb3-458d-a2ac-a553946e132a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\41d0b036-2fb3-458d-a2ac-a553946e132a.tmp
Size 12KB
SHA256 7b1789a5760c860a6f916e3a3952b2ab78b985aff67e0ef8ce2df607be517031
MD5 cf68a9a2af246d4b494c73946444e1e4
SHA1 3cb9462eb3acda60da403a172330d919129e3b81
SHA512 da91e61ca55234657789df4fe34c30df808f766ea039cef5e90e8102a16ccdd113d5edcdfb4d0e67fa731c83ca915f4a4ab74fa0184011c36cd3d6908511f207
SSDEEP 192:xRUt8nhoNfMMv7fpAPRp2G9UHYlb+WNnjDPHTHaKVzTVyIsnAUge:xRUt87YjUXBWMPPTaIe
TLSH
T19C42B62EA950357FACDBD22EF9227B67E6F5102520A42EC0EAFC893C15E79CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49a3737c-3059-47c1-8500-999410a4823f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\49a3737c-3059-47c1-8500-999410a4823f.tmp
Size 414B
SHA256 a995cc51ebd7f3e9952ce3d01edd5ef80733beea62aced4f0a898a0545b9f237
MD5 537e0408818b7c318d7c20de89786b4f
SHA1 9fbf61104dc95bf2fdefe644f84a88bf9f8b16b0
SHA512 0255203cf90c92e5a378a12ffa21f214993fb5fac57c99c3d5775d5d8e615260e9f480cb0b274bf7f563ddb133fa8b25ba051a1f87288a8f91eddce38589fd2d
TLSH
T1DFE02BE6C921BC6B18FD1B195055060AE65023172A80CA0F773DD11C8FB1D3B11E585C
MD5 SHA1 SHA512 TLSH

Submit Download

83f6e656-b11c-4010-ab59-ac3bc7c5ea04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\83f6e656-b11c-4010-ab59-ac3bc7c5ea04.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b3b1eadd-2859-4a12-83d5-c7b422b2bee5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b3b1eadd-2859-4a12-83d5-c7b422b2bee5.tmp
Size 1KB
SHA256 7f493a90c2f0324f20978145aed7ca27cb22d110aa61c7909380b00ce4fde6b3
MD5 4014bf224671a58faf0f73abcbce8d5b
SHA1 ce204931acf27b48fb4b7d7ebe42c89e907c667d
SHA512 c27f88b932e7c0e3ca29ae143c0e43fa3127fb34347d8f7b5e7aad6a24881e25f09580f870ec0ceaf996054444f9c38950103e05272cd78fa4074b6547234a28
TLSH
T16B41AAF793B4997E8A1192E4EB15AF1FCE690624031C3CA688D46E1B83F2D72D10179F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 92a9b45d39e8e12a9bfb0673f6bca53abfb8935cf08edc940d7336b7c0f6aaa6
MD5 81eb26e58e6841aff7e9f1a392767e2c
SHA1 08156a84cbb055f78aed75cbc30a3167f60f8a39
SHA512 e01deef1c98735285976c199680b0e6117264f5a4be7619bab0b2ec261246d7e738219b4dcfb88d333fd1fdaee49615397d973035ea730a9b28b6ab2efc9c466
TLSH
T119B0120581416B21C01103B01190949832708F74D223138D43E00D2198762A0441F10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 93777d956842214ef96c829ea3673eea3401a20c9d6cce49bcf4e3acd5d9593b
MD5 465dcbe805b294f0464e76709d771fc1
SHA1 213f814b7454c0dedfc3ea1875a4e9b740d720ac
SHA512 26659b12667de09eaca2c6b6725951316843203c1566367fef3ed0b4b7011ab30b0267304e271adf94bbe6e110eaa0a87af04cfa8cfbffa5c61b90f7ca7ba185
TLSH
T1BDB002A9C6026313C44343B025E995D87970DF2DCA03125297E02B76DC256F15579564
MD5 SHA1 SHA512 TLSH

Submit Download

edec76ab-eafa-44ac-a7f4-31e80c9400dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\edec76ab-eafa-44ac-a7f4-31e80c9400dc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

da680014-dfae-4a10-a69a-865ef2541a8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da680014-dfae-4a10-a69a-865ef2541a8b.tmp
Size 130KB
SHA256 9c7e94a33f076b5e497b8f4126c181338e896968225012c76b08ae714070cdea
MD5 7d393d2d9d3629f2b3048024f4ff2efd
SHA1 422e97497bda3136f1159a3eb99ea7c6bb413b52
SHA512 fddb6c3783cec1cbb56ab7ff64eaf19ae1ba1d4c3bdbfcba7f9191e58961fe40e3131f7a024c5b1c13fef4bccd5eb9b77873110eef30b883373e21b5957a809e
SSDEEP 3072:4SH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:4Ct4fLJ0L6nGJxi3bzqapJjP
TLSH
T1ABD312F1D2A0AC7ACBB7EE4155755E948E71D5C289CDBE2408ED8C1816CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea1f02ae-f991-42b3-9c56-e5898d5488e2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ea1f02ae-f991-42b3-9c56-e5898d5488e2.tmp
Size 131KB
SHA256 bbbec047de3712a9305266fce0a35438bfce513a7cc303b826ca5c2517b67099
MD5 973c1a4865a99c19d9d3ab2d613519ae
SHA1 12c197ba116fb685c25ae83a89bdfc8df0154805
SHA512 2c367f4e78a4c4399da09c0f4ade0ed93f9254865150d73546e1448414e018a7641e7df01d581e8b9a7b1b1d33155833b422973e966a469a5de0e13d3fe4783d
SSDEEP 3072:NagH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:Naot4fLJ0L6nGJxi3bzqapJjP
TLSH
T1F2D312F1D1A06C7ACBF7EE4145756E948EB1D5C689CDBE2409ED881806CEA340E13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f64cd9a9-8c2c-414e-8cd3-94fcba043692.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f64cd9a9-8c2c-414e-8cd3-94fcba043692.tmp
Size 131KB
SHA256 1e2061e44e93116d7f9fb8225e4bec7fb1b29f91db2633de020a7a2c189d44d2
MD5 18affd5f6f9292b3b934679a5d2c2713
SHA1 8b786be818fddbdfdff1faddffef4995238218ee
SHA512 220da1b344f1347880dcbc5bcc78ff72ec5b0d8322f8546da4c72f6c0560eddbcd27e7fa0af5ca31ea484d24d55da76680e02b63ddb34bfabf9060c5302a7942
SSDEEP 3072:1edH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:1ezt4fLJ0L6nGJxi3bzqapJjP
TLSH
T1C9D302F1C1A06C7ACFF7EE4145756E948EB1D5C7498DBE2409E98C5802CAE784A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download