hxxp://reddifmail[.]com/

Analysis

user interaction
yes
max time kernel
293s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://reddifmail.com/
Sample260503-e8pvvaft2q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222566477024371"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4548	4768	chrome.exe	85
PID 4768 wrote to memory of 3828	4768	chrome.exe	86
PID 4768 wrote to memory of 2924	4768	chrome.exe	87
PID 4768 wrote to memory of 2924	4768	chrome.exe	87
PID 4768 wrote to memory of 4544	4768	chrome.exe	88
PID 4768 wrote to memory of 4544	4768	chrome.exe	88
PID 4768 wrote to memory of 1688	4768	chrome.exe	90
PID 4768 wrote to memory of 4588	4768	chrome.exe	91
PID 4768 wrote to memory of 1688	4768	chrome.exe	90
PID 4768 wrote to memory of 4588	4768	chrome.exe	91
PID 4768 wrote to memory of 3740	4768	chrome.exe	92
PID 4768 wrote to memory of 3740	4768	chrome.exe	92
PID 4768 wrote to memory of 3552	4768	chrome.exe	93
PID 4768 wrote to memory of 3552	4768	chrome.exe	93
PID 4768 wrote to memory of 5868	4768	chrome.exe	96
PID 4768 wrote to memory of 3316	4768	chrome.exe	109
PID 4768 wrote to memory of 6120	4768	chrome.exe	110
PID 4768 wrote to memory of 1544	4768	chrome.exe	111
PID 4768 wrote to memory of 4484	4768	chrome.exe	118
PID 4768 wrote to memory of 5284	4768	chrome.exe	119
PID 4768 wrote to memory of 5284	4768	chrome.exe	119
PID 4768 wrote to memory of 5724	4768	chrome.exe	120
PID 4768 wrote to memory of 5724	4768	chrome.exe	120
PID 4768 wrote to memory of 4128	4768	chrome.exe	121
PID 4768 wrote to memory of 4128	4768	chrome.exe	121
PID 4768 wrote to memory of 1900	4768	chrome.exe	122
PID 4768 wrote to memory of 1900	4768	chrome.exe	122
PID 4768 wrote to memory of 4264	4768	chrome.exe	123
PID 4768 wrote to memory of 4264	4768	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://reddifmail.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9ddac728,0x7fff9ddac734,0x7fff9ddac740
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,15227611823580826962,1375552181454554626,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16774522458588935719,17903857817162452962,262144 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,16422055694834058845,11126755292873584521,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1884 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,9774336825007087056,12584544702076492906,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,7875383822999428845,9918591166282969466,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,5370839789053986991,6054934196648276595,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,10722786352574784245,1259490346713475671,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,13262408817613467235,15593400030211319164,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,8454379134467194907,3540319746553296106,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,3632671750257384068,4489145765997871031,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,17414522217808790145,18428908374708265059,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5564,i,7851906207639374764,13132175015578911690,262144 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,17641253147429603316,14428519684967303841,524288 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,4571418001580199729,14870578385831323203,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6124,i,9033850235248145136,11437425771562112651,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,182277888124875957,2191713824228896010,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=732 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,16146855520394320989,11160316022861270449,2097152 --field-trial-handle=2052,i,11290071292893174030,10743683405441856891,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 457f25441452bd933e2cb764f41b4611f98efffd992adc3d623dbe2e8ba07666
MD5 0ceff323d6b9fa275404aaabf18c144b
SHA1 515fee579d1883541fc1ce395c47b256b4ce8f72
SHA512 3fe2227cd51ffbdc3095455fc9ac0b12d162ee1b8d512813be03814e525e0aa91812a124c1aeb3a5d283a6cd40f484388b70bae59ad5d0ed1b14a3f0a3353d1e
TLSH
T1A9E02BA7C856EC2708FD1718A054470AEE2513272B41594B7A3C860D8FF063B45C285C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 08a73548acbf82a1f7c8f4de0a5a9202b0531e7147f1833c35d1f9082259553f
MD5 d22aaca8e51249baf11c7e7c876fc9a0
SHA1 f06913dd430fb754338738c5c745aa2fb890eff5
SHA512 123bc84402b298d0061fdefbda3f71e0e3dfd6e7b7972b68edae59366611025cdb6e0549bbae589764c13be111397e5f9b497673eab96418d77613645ebb0363
TLSH
T15951CEF793F4C97E861196E4EA156E2FCE6D0525032C7CA2C9D4AE1B53F2872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fe2c95acb930e0324acea7237e650e9db2a772920973548bfabe9e76890ca099
MD5 427e1836c64e4079ff1066a4026347bc
SHA1 1cf657e69ac2fab53357d57e65000c643540058c
SHA512 0c8b9eb311fb1311e1df7b63d790c7597d32e55ae854da121c3ab0e0b6e58d9d86bf88f0ea6c5760019fecc758ebd6b78c039e3b816fb497cb2f3cbf81270fd6
TLSH
T13E419BF793B4997E8A11A2E4DA156E2FCE6D0525031C7CA2C9D4AE1B43F2872D20038F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 784b5b1a729db2b114620edea68bd85b42ff567943956c703dc852dc5ba24b60
MD5 cbd52e4d4c00c229e1871adfe64fa9a9
SHA1 c02a773c690bb89425af8de7ead57d8f45acfe02
SHA512 c3bf79eadf4770be1163e310b93352cf9f452ee688fb28b25b17879edcec6d728c3eed05e9741ea5bc86ed6e22b545c41c451139d5e8d09746088a8e7ca6bc7f
SSDEEP 192:KRlhVSszqGbVv7japdPRpxUi9mHsb+WNnhIk4YJ2jkv7Sckwmba1DVyIsnAUgE:KRlhPblanXZIwhfV2gvLwa1lE
TLSH
T10052F82EA810693B5DDFD229FA657B17DBF5102160D42EC8E6FC8E2C14EB6DD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 74c500d160e4dd36ba50c02b86ee2e29d22dcdecbbeeb5bb770a2d23af6d60c1
MD5 1b634b2231ee528ad4fe735c6f5453f3
SHA1 eb0f2bfb0d50e26be793a10b6c0aa5ea571c87f3
SHA512 c15b4e44a1f202ffc8be36a9c21d342ffa925314b0c918b91df017d633a7345f179dfdaebcf0ef0c9bf996091213a1e4d1485c76d7a7d6a5b6815cbfa9875df2
SSDEEP 192:KRlW8S1VSszqGb/v7japdPRpxUi9mHsb+WNnhIk4YJ2ijkv7Sckwmba1DVyIsnAI:KRlW/PbXanXZIwhfV2igvLwa1lE
TLSH
T1B8620A2EA8146A3B9CDFD229FA65BF23D7F5102265941E84E6FC8E2C04E75DD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 34d2532ed6b1cc05363adec9ef0a6dc60473707ed690e933b67cbceba0289c56
MD5 79a9cedc903a4b906ec443a993e8a96d
SHA1 90c69eb0f006c58d4eaffc95461b5279ff5be9da
SHA512 92fd3580ea88ce3fd7f537b04360f8ddd2b8b5a42e222d2a8df1151278be0d10d14aa5a9b5d5b6d511613e22b6cfa8f0aa5dc25e7b2f7989e90faf1259670f49
SSDEEP 192:KRlW8pOkILVSszqGb/v7japdPRpxUs9mHsb+WNnhIk4YJ2ijkv7Sckwmba1DVyI4:KRlWJPbXanXbIwhfV2igvLwa1lE
TLSH
T16B62092EA8146A3B9DDFD22DFA65BF63D7F5102225941E88E6FC8A1C00E75DD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 fa1410b21244dfe29e3a8599bfc96328fcb10070b7626ffb1bc5a3d73d719056
MD5 a8bfaa3beb441a93a6796cd55944c1fe
SHA1 66b883a39a3c66f5c58f42b3a298fca554c70cf9
SHA512 f35c1801bda1b1133458d3e73b74dfa09935a5d1429b1c0ba08839d39d199a916fda0f781d062f890f45033062a4ddb3f8363410faf5a5a02281a76db401afa7
SSDEEP 192:KRlW8pOkIlVSszqGb/v7japdPRpxUs9mHsb+WNnhIk4YJ2ijkv7Sckwmba1DVyI4:KRlW/PbXanXbIwhfV2igvLwa1lE
TLSH
T1C562F82EA8146A3B9DDEC22DFA65BF63D7F5102265941E88E6FC8A1C00E79DD3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 70fa18f9ea659f9752611a770d7ccc7ce2dd05ec1906056d7bfa50f007d6e176
MD5 b93773df9e07c22c59adbc48115e6d69
SHA1 7fe4da0d32f20f37bb733496bed2f50d07b1a512
SHA512 76312dcc6d218aa4c1c0bfa6140f2334110b51dcd4cfd32286f7ed71b795076cfa37d84bd207eeb73104459e31c2ff3760ec14aad3a06c96365e1971c58a5e77
SSDEEP 192:KRlW8pOkIPVSszqGb/v7japdPRpxUs9mHsb+WNnhIk4YJ2ijkv7Sckwmba1DVyI4:KRlWZPbXanXbIwhfV2igvLwa1lE
TLSH
T10D62F82EA8146A3B9DDEC22DFA65BF63D7F5102265941E88E6FC8A1C00E79DD3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d1ef2e5abc68cd8e3be768fe934daa826c88ea36af81616d6cbbebdcd12cbafd
MD5 b443cbeee6be0e7f85491a40f77cfa7b
SHA1 6adf09a9f3f2c4936933b4e9888594b982ffa64d
SHA512 b5c52cd4159f6cadaf35469352b9347c2676341fc2986655e1423b814f7fcb9a6962693003e706cae376d5fe2ac5c87be9dc400f1459922333c9216a8e54e754
SSDEEP 192:KRlW8pOkIMVSszqGbIv7japdPRpxUs9mHsb+WNnhIk4YJ2ijkv7Sckwmba1DVyI4:KRlW6PbUanXbIwhfV2igvLwa1lE
TLSH
T17362F72EA8146A3B9DDEC22DFA65BF63D7F5102265941E88E6FC8A1C00E75DD3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6160fd3cdf716d4675d2e01cba4659e10a02801b33dc482649b6bf0b0abc5fc6
MD5 6bea038cfba1538737ff5bc6777e682b
SHA1 c2894776321373320e48db49bb19926eeb84a542
SHA512 1a09605d381ad1f896104bb86374bf62d7ff74443246284d0d9c814abc39d2057f4ed8dc5e0ec4709f578a00317b63854ebb70d4bfebd48fea88a26491ff955c
SSDEEP 192:KRlhqSszqGbhtv7japAPRp2Ui9mHsb+WNnhIk4YJ2Qkv7Sckwmba8DVyIsnAUge:KRlhObhNaUXeIwhfV2pvLwa8le
TLSH
T1E842E52EA910693B4DDED229FE657717DBF5102160942EC8EAFC8E2C14DB6DD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49892362cfd5a361727f25b0509670e875c00830fc95e5ddb05eab9d5ead493b
MD5 8206acf8e3a570cdbeec7e06eb144982
SHA1 dbe93353e4a9d8d3ca36fe3c589241a608cb7005
SHA512 3101a4f0be6e9a644110541d13e9a55f1ef74837b75f4bbdac1368aaecb63f62e001fbe3a78dfbe9a142994b1d3b5053359bae30b7177d52533cca49109e932c
SSDEEP 192:KRlhqSszqGbjv7japAPRp2Ui9mHsb+WNnhIk4YJ21kv7SckwmbaZDVyIsnAUgE:KRlhObbaUXeIwhfV2qvLwaZlE
TLSH
T19B42E62EA810793B5DDED229FA657B17DBF5102160D42EC4EAFC8E2C10EB6DD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6844691c1c9859b6c9b740cca4dd4ebc7ecf4ec9de063baa3eb615e118d18025
MD5 83436d6279968a2f96410d113be62572
SHA1 51842444c0dddea0cee012d65209b4a7dc7f6c8f
SHA512 759cf7a8fecae8f1e3dcf3b0b964286975f06d3a9473af254cf6c8d96352321d276c347a1a8c1ccf88eebb1004052c7de0963a44b6b0af138c9e2fb7264504aa
SSDEEP 192:KRlhqSszqGbVv7japdPRpxUi9mHsb+WNnhIk4YJ2jkv7Sckwmba1DVyIsnAUgE:KRlhOblanXZIwhfV2gvLwa1lE
TLSH
T18052F82EA810693B5DDFD229FA657B17DBF5102160D41EC8E6FC8E2C14EB6DD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0b074829022adcfa4f852fbc232b6a9d10a2c3fd94773352bded7076f3757d72
MD5 9844db8b9935773cac348add12e9e82b
SHA1 2a22ac34b77d80fd43b955c5915204dc57f4aa7a
SHA512 ecbac95196cae7e8524130b3dde7ba13a892aaa7599619712fea57e84777f8937c3aa7cffdbd9230f2420cf2221b36e595e2567bfcb3b53534bb762281b9aa05
TLSH
T1F1B01291C00265A2C05302F411820CC871549F148706230993E46A75D82A2A040241A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f9d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586f9d.TMP
Size 96B
SHA256 77fee430c988f63d83ff39ace0ced87b5a232656350f537d46c06ae216702384
MD5 7cabd4dfca4369164c3fa23519e768ad
SHA1 d28da16375788e4471411082c580c43052a22718
SHA512 71c2a4f31ec0baf1689348617e6822c37ec0ce59a5c7fedc1599256aa6117e51e104c92a04d8e93db4298286e51276b91a4d6f494ff0ce426d5b51b811f9c4d5
TLSH
T120B00255C9077222C14713B03996A6D9B175DF25C6431326D3F81A66DC29B60463556C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 fbd0d31f393520df789905e22d9719ff5fbfa3c70f3f61869bd8dd6396ed3e6f
MD5 9457c7cee324dd2b9ff771df9e7b3b60
SHA1 4f5f064b7395f7c00b4f9269b2fe73f1f75a6f23
SHA512 2629cdac92e821a81b98989509ab8e62d98906578356d5908efa968173ae810dbf6d83d27b62417b1230f17376107add67d353b77e7ac090ff53323c8b57a11a
SSDEEP 1536:0XlCvAzjcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+62:0X4O3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1AD9301BA9E2A4AF799BE5681729A780DCE13130DB19F68CC715C538C21D41CC2B63E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 1e4f7fa7c93735cf4ece7e29a952a46a66cc0bf6b1b4c3c9e1e066d568607f86
MD5 71985fa8d76ba496a947357f13bd4f87
SHA1 bedb35945b525fd60568ef0c1f6702e496079e35
SHA512 48d1138d27dedb6406b89e402c7d67723aa659133fe6cc40aaea4ae44842847819521bfdc70b6dd7a3e3380f114a1b39d65f341f00f666571c0c4d63920e2d25
SSDEEP 1536:0XNCvA/cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jC:0XQE3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1679302BA9E2A4AF799BE5681729E780DCE13130D719FA8CC7158538C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 fa8057029cb52a0dbc4e6c96ba41746a4f682ea73f2ea9453f0741b57ec92634
MD5 f67586797fdd3620f0a7bb63d7318bd0
SHA1 80e00dea01bc535d5b4926743ff03b44124f0293
SHA512 b10ce37dc1ca8e8449266d8b87ec83d78a51dcc2c02954e596bd00a10c4514a2c0b205e1ab6783f2204f8d336114385df8f64e175aae2fb27d9abbd40186f3d7
SSDEEP 1536:0cCHbcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0P3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T13E9302BA9E2646EB957E468176AE780CCE13530D709FA9CC315C639C21D42C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 08a832091c25162b4054341f86b4bec722b995ecbdbda9d33228d4834ac33015
MD5 2d9487d9105d09bcc6451a7ba33b6525
SHA1 68c2aecc462bb9ef1f5a1c2ec8bdc3346911a65d
SHA512 ed240976680e712e17bff949fdbdc02db5e997816678b97b6fdc03adcc16e0e7d680c375a69047c403cf776c38dc490a73d4223b8d255ead4843d06643f7efab
SSDEEP 1536:0XwCvAs5YcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+9:0X/I3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1579312BA9E1A46E795BE4691729E780ECE13130D709FA8CC7258538C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 02d5426eecea56b53b327be3dd8d9557e25c82a64230ec3484e31156b9a12066
MD5 a0907e8f92df2f941cc34241a47c2d11
SHA1 3554a2d8a3a04d10f91da7170e1a82d75fc34e9c
SHA512 7b9f6d70a47db096b132084860d57e39f8f19d840176748e248bf61b872767734d1c04e9381dcaf6d905408b6643a5dddd46ac8110b8da8b20786f093cbc31c8
SSDEEP 1536:0XNCvAs5YcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+9:0XQI3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1CE9312BA9E1A46E795BE4691729E780ECE13130D709FA8CC7268538C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download