Windows Chromium Session Restored With Crash Bubble Suppressed

The following analytic detects a Chromium-based browser being launched with both the --hide-crash-restore-bubble and --restore-last-session command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session without showing the "Chrome didn't shut down correctly" notification. This activity is significant because browser hijackers and adware droppers forcefully terminate the browser to tamper with its preference files, then relaunch it with these flags so that the victim does not notice the interruption and lands on an attacker-controlled page. If confirmed malicious, this could indicate that the browser profile was modified to hijack the default search engine, new tab page or to side-load a malicious extension.