hxxps://the-engima-cases[.]eu/

Resubmissions

23/04/2026, 16:46

260423-vaaahah17n3

23/04/2026, 16:42

260423-t77ftshz6n3

23/04/2026, 16:31

260423-t1eggaaz3w3

Analysis

max time kernel
1800s
max time network
1792s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://the-engima-cases.eu/
Sample260423-vaaahah17n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5504	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214366135404814"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe
Token: SeShutdownPrivilege	788	chrome.exe
Token: SeCreatePagefilePrivilege	788	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe
788	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2720	788	chrome.exe	86
PID 788 wrote to memory of 1284	788	chrome.exe	87
PID 788 wrote to memory of 1284	788	chrome.exe	87
PID 788 wrote to memory of 5504	788	chrome.exe	88
PID 788 wrote to memory of 2840	788	chrome.exe	89
PID 788 wrote to memory of 2840	788	chrome.exe	89
PID 788 wrote to memory of 5832	788	chrome.exe	91
PID 788 wrote to memory of 5836	788	chrome.exe	92
PID 788 wrote to memory of 5832	788	chrome.exe	91
PID 788 wrote to memory of 5836	788	chrome.exe	92
PID 788 wrote to memory of 4692	788	chrome.exe	93
PID 788 wrote to memory of 4692	788	chrome.exe	93
PID 788 wrote to memory of 3284	788	chrome.exe	94
PID 788 wrote to memory of 3284	788	chrome.exe	94
PID 788 wrote to memory of 5520	788	chrome.exe	95
PID 788 wrote to memory of 5520	788	chrome.exe	95
PID 788 wrote to memory of 3348	788	chrome.exe	96
PID 788 wrote to memory of 1492	788	chrome.exe	99
PID 788 wrote to memory of 1492	788	chrome.exe	99
PID 788 wrote to memory of 1872	788	chrome.exe	107
PID 788 wrote to memory of 3668	788	chrome.exe	108
PID 788 wrote to memory of 1336	788	chrome.exe	109
PID 788 wrote to memory of 2492	788	chrome.exe	110
PID 788 wrote to memory of 2492	788	chrome.exe	110
PID 788 wrote to memory of 4608	788	chrome.exe	112
PID 788 wrote to memory of 4608	788	chrome.exe	112
PID 788 wrote to memory of 5480	788	chrome.exe	113
PID 788 wrote to memory of 5024	788	chrome.exe	114
PID 788 wrote to memory of 5024	788	chrome.exe	114
PID 788 wrote to memory of 220	788	chrome.exe	115
PID 788 wrote to memory of 220	788	chrome.exe	115
PID 788 wrote to memory of 1188	788	chrome.exe	117
PID 788 wrote to memory of 1188	788	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://the-engima-cases.eu/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd8f5c728,0x7ffcd8f5c734,0x7ffcd8f5c740
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,8533638253773799775,16032923232584510340,262144 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,5503431083077150141,1981161821983127065,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1948900791675750805,9270867750630727605,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,7091150826354176289,3542400705092352442,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,1296950484255400496,5237741073070028591,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,10059408909584015954,14925751114861726869,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4500,i,9790732158211431150,8194044046076514249,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3268,i,15650448616517933607,16049286847935584239,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,9743462576685206842,980665795104353894,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4688,i,9657095774886380462,8182883691503853744,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,12949600461140280812,12341462271819965495,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,7518592045693648718,11553139891972932173,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,14359283456696625729,13694089286227971836,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3276,i,16203943239646077523,4361060003115517688,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4752,i,18430084961414737432,2288751772825891215,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3244,i,1191983923438144019,14414237503968441893,262144 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,4157195802906519469,12698892555067240051,524288 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=1488,i,14734834711322074737,13205526356525531590,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4704,i,1519408697853543789,13550911100859862048,2097152 --field-trial-handle=2004,i,15522554481397918751,12628907014871090421,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a068952ea1288e18683533d9b94361dc5aa623c4315781a2af4f7bd63a6fe6bc
MD5 97558b82be1233114bf7be5d9ba9e3f4
SHA1 a167221932613c5b8d21f7ae507138b0cf603232
SHA512 a5a5e9e8bea3b1fa31aeda0527c25dfb3362a77c2031553e476749ffc3c814bfe8008a5cf5fad1cb7c22e4647d7254ca99200218ae65bae3c85ad32def22645b
TLSH
T18EE02BAAC921EC3714FD1B6870440A45E74413473B51894F3E3E820C8FB863F4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7bb9fe58d68d800e54f2f964cdb38447837f8440caee7075f487c43b5fe68039
MD5 bdd7ab003aeaa7b6d54045f55b30e861
SHA1 fc4b03ebb64e10b02127453ef98592fa406547b3
SHA512 f4746692d149fd992ba0e5d57a2aed429471ef80a01fd2d440e9c58de67df419d88270b09ee3fe5dd0e4c2397e14d00bd041ccacd9142e88a768ac8940bbf318
TLSH
T186418EF793B4997E891196E4DA156E2FCE7D0524031C7CA289D4AE1B43F2973D20038F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 68101df0516bcddb13a27d49f855c9f28e6253744baf4032b365e6ea0d573505
MD5 391c45fd50afde4f441d5ead083eeb6b
SHA1 b68a5ddb9a5c05727d5c54b5f54aa4e3c995eb38
SHA512 b16d4fb7c4005f6793ecc78faecea90e1211f9172d9b34311c99dff997e82ca5c4dab04a84753f3fffa57db656ad7667d65a948128cde50c2de8dba57902fe90
TLSH
T145517DF793B4957D8A1196E4EA156E2FCE6D0924031C7CA289D4AE1B83F2972D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eba2fea68928a90e56927b0c257ff7a0ce0d2a2782f44385442f2c1c45bfb5d5
MD5 01b755406b0c627840b5a265d3f4d511
SHA1 e908629e647bacc84d5a552d1df7598088a3ebda
SHA512 b01c284ef566e621aec99a6e03b17cd08e11d866ad14e9a4cd8ec15123af79b0a06128a5fb0ce04cc393618288c45aa06bb54b9a502a681b15b204c29202d3e3
TLSH
T1A151A0F793B4957D8A1196F4EA156E2FCE7D0924031C7CA289D4AE1B83F2972D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b8bc1d52f4a826c77adf7b4c541f1839686c430a07603967f38253f33ed2c5b0
MD5 3eaa6d18903baee2ddc76a355cfda1c6
SHA1 78985f59263d5fb508127b4951fe0454773f1a5d
SHA512 b999558e8a0c84ba68e3f69672d97e88af0129409d667ca6c5070ad5ad4706d0701bfdd12c221aa72767775cf30bd0db8f87437e9cfdce74fc6d2a5d67086359
TLSH
T180418EF793B4997E891196F4DA156E2FCE7D0924031C7CA189D4AE1B43F2972D20139F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 274a58705274dd82b25de93aaafe047e8d99a9a84e52daa26017abb06b750a29
MD5 258d10ac6066a68c67c0ee9774e95fb2
SHA1 80617380c04996bc79a26185f9a7528b21241cfe
SHA512 925c4255253a9eccdb6f92a04146137fd98825169b3e3d112a2d227c10110d42278c7a890cd20c0f8b2a0277e7fddb0dfb892d2cf8fc25b1153b15206a1abc3d
TLSH
T12351ADF7D3E8977D890196E996253F2FCD6D0A14621C7C57C8D9AE0B53F18B2D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 586b5ca0bb9943856e53dc2e91a53a91640450dba6c64ffde7d54eae54337aad
MD5 b5884b3dd06409c997b88ea8e47161e6
SHA1 df4b522ea0018b4830d69cb7398cee77fb4429ba
SHA512 46a81eca6ad031bde9a33c1f0a673a02c34596fdb5649a774454ff0c276fa62591f6ec7f91dc66b47539972fa1c7ae9e11092fb40486004e3e1a3d84eed79cf2
TLSH
T13AF0506BE33E741B10FC45AB5D00B80559B5E83006C114E4CE6B416CD0455F70F03453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a1f42f945922b65acb093c796358399de1bed9895f1634b6682876b58c29ac00
MD5 bd0b5c268c9df1fd0b5fbf24a379347c
SHA1 98c82c972e1e4075ea6a77afe8c3dae9e31674e4
SHA512 5cb3b75d9487823efc039572197a44810163c55b54e7c0d4aeada187775f3c26fc10fb65eb5192cd8d37bca04c75edba806d062b563ddafc283acec2acce2b5d
SSDEEP 192:VOR7TN74DYdgWrv7tYpLPRpPhvJ9CHsb+WNntsPSnV49VaVyIsnAUgE:VOR7TVThYZXZR4wqPAAaE
TLSH
T11552D62EA910393B9DCBD229FD617B1BDBF5102161A42E94E7FCCA2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 89656ac77307206e56ad05ba8f8d94e955d538960683ae48d704c79ba961e854
MD5 7f60e957738c7cb4b01ee408a1e99468
SHA1 d70140c89ba3edd1bff9755e0ab88be06b287f6b
SHA512 f6ff35db6b011002101b293f86105db60ba6bc52b37e9893d402a4622e31a31d5eb4678d83ce68933f085d75e30c2edd1c7453f0543f2a15d61abde26df362cc
SSDEEP 192:VOR7To74DYdgWrv7tYpAPRp2hvJ9CHsb+WNntsPEV49RaVyIsnAUge:VOR7T2ThYUXeR4wqP4iae
TLSH
T13442D52EA914393B9CCBD229FD617B2BEBF5102161942E94E7FCCA2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8501eed5d2009f064806b55eac9f58d22820ae508036e56c7486dfeecbc7c7ca
MD5 e97edab8783827860da449189e836027
SHA1 0ec36a1cfb89000b22cdcbdc67b40a5be305787c
SHA512 72c7d81108097062e8d460adc109db780d7f6f8538d2ea0d073a2059b307e01afc32e99e01725f919a15f8b404c70846bea5c2f6d359e027be47810a32f897c0
TLSH
T18DB012608002D601C45302F41183288832149F20A709170153F06D759C371F04115170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5860c8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5860c8.TMP
Size 96B
SHA256 5ed51e4d6e1015a2e02a30e5587730e7ac670b212c14bfdceb080a157d822c22
MD5 9be7dd1adf78f85df5552cd5ec0c1abe
SHA1 28ce2fa6514cc62d0d805ac4807d133b2a43fe2f
SHA512 c7e5b4ed6e30fad59d72b4df2fa04684cdd65136e025751db2aff5221c2cef17db2942df31e3638636f5464babcf5017ea8532041680bc06f3f3e1d7504b737f
TLSH
T1B6B02200C003A303C00203F028AAA0C83320CF28C2030A0AA2E02A22EC2023000200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 fd668f84f8a0ef517438d11d690397c0c45213321d2145a4fe7182503daebbe1
MD5 9231fb7a721bf09fb3ac604ed6fc9100
SHA1 feb59908bad576d36cf3b4b1ccd443c91fef892f
SHA512 e3013a0aeb5e76a89f52824116d3ed95f567b1f2f7433b037ac7f4168859a6057e0e3e8b24364e712732b4e3fddd44380b5fa4fe3d4c5e8f38185180f0ff016c
SSDEEP 1536:L5VcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:FV3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1CB9312BA8E1B49F799BE4691769E7809CE12130D70AF798C716C634C21D41CD2B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 66296903d12822b7245c3902957f27fc450042cae3f0c8c6f45668b87dc866fa
MD5 014ebe86d4012e8982a2a4e878a7e6b3
SHA1 d209a50f273305d87892683bb6fac572cc5fe087
SHA512 93f1edc46679b5cc7db15d4be0258cb4bb0216a12f092ed5e12eeba105b7575b20d23410402e113b499ecb26c21f4b6b935b41d8ccbf70d617674769e9a7aaff
SSDEEP 1536:j5VcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:9V3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1A49312BA8E1B49F799BE4A81769E7809CE12130D70AF798C716C934C21D41CD2B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6efbd154faf21a0a15f50938701bcd32a9f6da610bc04c24eddb274de82995ae
MD5 40df6d9c5f00a8138d699845412319f4
SHA1 c5f8724c4369cee34c07add353f13b0daf66e118
SHA512 cb3887f96b728fd6adb0a7fbf67ce2c3956af50999494ba919d4a554daa8b1a9f5b9c03ccb10793ec1dd16391fac73cda8d76aa83c7a37703e73641fcd45e9af
SSDEEP 1536:jCcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:O3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1659312BA5E1B4AE765BE4691766E7809CE12130D70AFA9CC726C634C21D41CC3B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 23fe34d4a4a465f011db4f18dc097c503ab9e7b1755d8042a0ed1020180bcbf3
MD5 923a5f1316951af08d6f8b4dad376128
SHA1 570547585730562644dde1d725584d0517a3f884
SHA512 9c4d4094b9e6d22f3bdbd136dcfc08fa6799d6ca7ed125fc2ccbd75b55ec58e53c307d203f0c92559136053a4af0f1ceb26253a475f36df883b5327503593be5
SSDEEP 1536:oCcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:D3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1259312BA5E1B4AE765BE4691766E7809CE12130D70AFA9CC726C634C21D41CC3B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 13cd74ea04ae5ca2257e9b3660748920df695bb864027e7056dadc67f29488da
MD5 2b1e9eeb9bb9548ce2a47d1dbace04c4
SHA1 541aee0a5338b6c3971cd882f91f6c133ca10a88
SHA512 06d486d8da2f8b899ce70920bb69ef1a41b01cd3dd8d4048b31a55a7fcb73a929ca56071f8e136c758bca3725aa474ac5ba5010d5daa11c2a8b0babc5d23853c
SSDEEP 1536:0N1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:I13Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1479312BA4E1A46E7957E46C176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download