hxxps://freekrab7[.]live/

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://freekrab7.live/
Sample260428-tr655afv2p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218667276609939"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
2756	chrome.exe
2756	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3972	3496	chrome.exe	87
PID 3496 wrote to memory of 5068	3496	chrome.exe	88
PID 3496 wrote to memory of 3808	3496	chrome.exe	89
PID 3496 wrote to memory of 3808	3496	chrome.exe	89
PID 3496 wrote to memory of 2392	3496	chrome.exe	91
PID 3496 wrote to memory of 2392	3496	chrome.exe	91
PID 3496 wrote to memory of 4584	3496	chrome.exe	92
PID 3496 wrote to memory of 4584	3496	chrome.exe	92
PID 3496 wrote to memory of 868	3496	chrome.exe	90
PID 3496 wrote to memory of 868	3496	chrome.exe	90
PID 3496 wrote to memory of 4556	3496	chrome.exe	93
PID 3496 wrote to memory of 4556	3496	chrome.exe	93
PID 3496 wrote to memory of 1116	3496	chrome.exe	95
PID 3496 wrote to memory of 1116	3496	chrome.exe	95
PID 3496 wrote to memory of 4028	3496	chrome.exe	96
PID 3496 wrote to memory of 4028	3496	chrome.exe	96
PID 3496 wrote to memory of 4288	3496	chrome.exe	97
PID 3496 wrote to memory of 4820	3496	chrome.exe	109
PID 3496 wrote to memory of 2568	3496	chrome.exe	110
PID 3496 wrote to memory of 4188	3496	chrome.exe	111
PID 3496 wrote to memory of 4016	3496	chrome.exe	112
PID 3496 wrote to memory of 4016	3496	chrome.exe	112
PID 3496 wrote to memory of 2008	3496	chrome.exe	113
PID 3496 wrote to memory of 2008	3496	chrome.exe	113
PID 3496 wrote to memory of 4632	3496	chrome.exe	115
PID 3496 wrote to memory of 4632	3496	chrome.exe	115
PID 3496 wrote to memory of 4080	3496	chrome.exe	116
PID 3496 wrote to memory of 4080	3496	chrome.exe	116
PID 3496 wrote to memory of 2756	3496	chrome.exe	117
PID 3496 wrote to memory of 3720	3496	chrome.exe	118
PID 3496 wrote to memory of 3720	3496	chrome.exe	118
PID 3496 wrote to memory of 4736	3496	chrome.exe	119
PID 3496 wrote to memory of 4736	3496	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://freekrab7.live/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe101cc728,0x7ffe101cc734,0x7ffe101cc740
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13630118475904426133,10059165067232394415,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,9221911018571617375,8647947076409697028,262144 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1259936721517119966,14800023651625217971,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,2860684417926679663,15541361202255527500,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,9579973653791089854,6964652405611232537,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,2699011735090118776,10435032899197840814,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,544377395115490131,12174883124354930654,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4892,i,17769718925930341374,12809785358464569520,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,7709964976471980861,10368992308336619074,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,6727124100380720317,10488494451296975189,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,6021472946560864792,15481244152757582815,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,4010197579827528684,11902947428393444765,524288 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,15406279377331932263,15071691912508517640,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4972,i,6743879199071670577,9198378117533676303,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5688,i,6191749635274117201,14243953846706978137,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6120,i,9175392679060655293,10311797448370252944,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6304,i,18350942010236479174,14712603252905976774,262144 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4704,i,11405635030764180293,15555042929268030147,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5576,i,18039889143802466258,8060736300131933228,2097152 --field-trial-handle=1984,i,15094838732099942519,2134629346926605537,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 621dde23c44e244ea30755394c8deea3b6aee2768ea9ecb8fd88813d54a6c8eb
MD5 4ce6ce58dc5c2f086e9cdf26288d36f0
SHA1 020e1aaf552d820abaedda62a15045b4215560e7
SHA512 ee46f8c08155828ad00b5119c883748b3b6c8fc6f0470e1fb093326856da90b641c6a6b9f4eba46b872d3106f54a75bd369d78baec5fff693f2ebe356bcb807a
TLSH
T137E022EBC925EC2B19FD071920D4534AEB4513AB2B82994F3A3D820C8FB06BA518681C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 8f2bc3391ce3406cfdd239e6faef40b73940549bf31d54210e8e2730194bd6dc
MD5 c81a0af5af8fdfb57b84338240f90def
SHA1 f348da7f65055f1a8f397236d72aecaaeaf8b8fa
SHA512 5093cf54ac75ad99d5ec4d5c70034a7a5689a438715d65937235bef51ccffd811eb625d7970bcdc775781746a2a3db47df1c9103299b19149f68269ebc143de6
TLSH
T108B0222B23C0000AC383033038A22E8C30300F0C233A2283C0C000CEA8A23F3EC8B3C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d31a2e9f1ad3b5c0bdbc91a46281f97cdd353c1ba8c4d6700d38cec7a02f5f30
MD5 592ca6617a4bec4f7eff2bc79cb22ba9
SHA1 47cee1b28fecb754f6f5873bc7633ceb55dd523f
SHA512 8c52eaa653c31d59bb50a4ed3d7aeb55c0c184ba033cc072a92b5fb5dcb2cc5e54e2376ebfbce1a0b89e661ab9cce654386e91fb27feab385bc44df5e5214fb4
TLSH
T13FC0922962A4201AD381123130E298A425340A0C62273967C2EE409AB12A2A299892E2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3b3cd2e3590b349e16a5415e97e63872acfbbd1bb67854091f8262ac3816166a
MD5 89d3e0c4a82836edea582929bd1d776a
SHA1 557e1fb9bb2f53258db6f5016e3dcfa3918ca88c
SHA512 46a319c6973077cd6d5dd841ce28c10792c0077b21893242802bb7bd3ef81d5ee93251acac67eb1d42bab169ad5e045bda99afad67124a72beee42547688b1e4
SSDEEP 192:DuvVWTxrYmzaIaEg70HaQf5dhN6jKsvTdfZb:DuvVWTxrYmzaIaEg70Hac5dhN6jhvTxF
TLSH
T1E6D17FF382F8C62E891152F1BF146E1BCD1D056447297C67CAD4EF8B63D66B2D200A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b88bd6a7079754e9b268ad7d4f0588d4aa9ef11774ea3e3de08dc88d30a55f2a
MD5 335e41eee5bf280c775698c67b807b06
SHA1 52e6c4127184b3422204fed1046cb5163614ede1
SHA512 4aeab1a6d2e913748b97f1f505f6b4a39e81ae924e35f455740cdbde641670f52b3b8bbc24efd2a446b861ac2e4f00b6989b092a645fcf2aecced6c2a5c171f5
SSDEEP 192:WR8pGR/Zav7rpAPRp2H19+Hsb+WNnezNKw2Det/PrVyIsnAUge:WR8p02fUXEEww72y7e
TLSH
T16A42C81EA908BA3B9CDAC21EF9657757D7F5202171D11D84EAFCCA2C14E79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cbfabec1b8d9274708bd5f541165c0245d301fdd4f57d16b7490c66a4b098a9b
MD5 b1b5a9e3c31feb39136ccf9509091b17
SHA1 9fe44e4107626ddc47d15f572b86ff8f7159d035
SHA512 74be9df7cb9f1f092cea91b66625589a33aa705a2e3502b99a0d824a687af30aac45911d868a5985ac819616222d085301f25447fb4e98eef3b6ca119ae85cf9
SSDEEP 192:WR8pGR/ZUv7rppPRpFHJxs9+Hsb+WNnezNh/Ywet/POVyIsnAUgGkw:WR8p0QffXXaEww/YDAJw
TLSH
T16752E91EA908AA7B9CCBD21EF9557B57D7F5202131D01E84EAFCCA2C14E79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27ad1d11f6b4eb443ed746a2b1bb67d25bc7e154757e16984c61fd67c9bcb930
MD5 1a4c0ad279490260f340c9e4765d119f
SHA1 22b4e54c2747be37ca06515ec4d08b826e64fb78
SHA512 a5ec1517b18d99cae726251fe2df0008a1137ab274491665ca561cfd79e34e5b497d7763604938e17fa8b926946a9fec29706fcee717e03613ec504344171f80
SSDEEP 192:WR8pGR/Zlv7rpAPRp2HJxs9+Hsb+WNnezNh/Y3et/PwVyIsnAUgGkw:WR8p0VfUXiaEww/YuuJw
TLSH
T1F152E91EA908BA7B9CCBD21AF9557B17D7F5202171D11E84EAFCCA2C14E79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 32cd63d16772edcc933dfe353a910bda56fc688128d3409455d2b700028c4b4d
MD5 f9b9e1a173d91525e8ef9de28c27d66e
SHA1 949c00a1842ce1bdc1130206abf003edf0ed8dfa
SHA512 19f23c8c84ed7ac6249969affc12729cab8e1cc69581f2232563b7bb0bd65e9b42fe8d9aba2dfde2d089c045e819f1dbb077314d5c6dca2901ee90978a8f9b9b
TLSH
T152B0125180019601C04302B42182148C31249F199709530193F07976F82B5A24014290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5847b2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5847b2.TMP
Size 96B
SHA256 235dedb1718f09f47230c3019170c31d9690b63875b6d9e274fee7392638c0b2
MD5 3fa1c5e3ef3dc2c2934a72266ab085fd
SHA1 a2a87343bab9c168538d3d8a0f97aa9b1f618165
SHA512 e9d057338fc241952bbff40291ed6d181c1f1517991397645e1287d9dfed7b04e1d8c0cc3c63c4194ee6527026fbc01707816320d3458d9ff2ed9b55b23979bc
TLSH
T18EB00295C102A623C0C343B1359599D97170FF25C6032322D2F41A77DC29A7245272B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 6213916d86b57d7a34a485d71f5bc5e26f941b710ec9ac8b69b632ca98ad75f9
MD5 3750a8b6f54ca55b70536542172c351b
SHA1 e3aae033cc045e20feb0a3be1090cdddaf25394d
SHA512 123d1d5fef4c78b7488d9dd6c9b424c2b7a11a762adc06a584ecfb3310b6ea3a70efac704fbd8f00e014a7d5dd815315474f1eaeae606da0059738f52defd737
SSDEEP 1536:KVGMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:QGM3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T11F9302BA9E2A49F795BD5A92769A7809CE13130E70AF688C719C534C21D41CC2F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f606d27e81c373171d61c9f01f87b1f05648f457e1bc903219b3e816706a7a7e
MD5 c6d0ecdad0fd5379b8c95d0b5b65448a
SHA1 0be768dc25e4b34b25c942b382b36628237d135c
SHA512 dbb711738e3c0f94392a2a6459ea75fd1e50cfb904f69e3d0e1f4b75ebd357abe964c7989ce6a163d94db55598bd27ea914dd95eb9f4949c7be44e610bb90002
SSDEEP 1536:KVYcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:QY3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1559312BA5E1A45F7997E46D1769E780ACE22134D309F698C629C538C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 878641975acfb98503f0809aabd3647f5c57497059dd07e059d74c60c6755d07
MD5 4a07451d0f8d55224af802208be6bf49
SHA1 c0338951302f4ffa8608126f1ae3fcecb279c763
SHA512 eed73ed47d9ae7b7744026bf8d4a99a19c9e6a309e573ea62f9e5f0206dde922571de483b23896fe51c6f23fc8e5dd0665923e484d50380ae55865efb7fd3829
SSDEEP 1536:rVYcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:ZY3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1499312BA9E1A45F7997E46D1769E780ACE22134D309FA9CC619C538C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 fb20727547b665321cf7833a59b1744d359f9842e06d5340328d529df6d478ff
MD5 72d14016011ebba84329bcbd94f5760d
SHA1 df0acb2edb34e27e3e6b4e768574443a5e0c36b3
SHA512 8e24e57cf4adec9be9dd28a2bdc2047ce899dfae6c6b164509ea723048c25b541760f8824b2069ed4da486c91d5fbb6f73ff29f1a50deb2c70944409db47e6ce
SSDEEP 1536:jVlcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xl3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1A19302BA5E174AE7957D4AD1769A7809CE12630D70AFA8CC319CA38C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download