hxxp://ogwta[.]com

Analysis

user interaction
yes
max time kernel
66s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ogwta.com
Sample260503-sagcpsez7p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5080	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222937270242889"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 5568	492	chrome.exe	78
PID 492 wrote to memory of 5080	492	chrome.exe	79
PID 492 wrote to memory of 5088	492	chrome.exe	80
PID 492 wrote to memory of 5088	492	chrome.exe	80
PID 492 wrote to memory of 5104	492	chrome.exe	82
PID 492 wrote to memory of 5104	492	chrome.exe	82
PID 492 wrote to memory of 3956	492	chrome.exe	83
PID 492 wrote to memory of 3956	492	chrome.exe	83
PID 492 wrote to memory of 4472	492	chrome.exe	84
PID 492 wrote to memory of 4472	492	chrome.exe	84
PID 492 wrote to memory of 892	492	chrome.exe	85
PID 492 wrote to memory of 892	492	chrome.exe	85
PID 492 wrote to memory of 1952	492	chrome.exe	87
PID 492 wrote to memory of 1952	492	chrome.exe	87
PID 492 wrote to memory of 3080	492	chrome.exe	88
PID 492 wrote to memory of 3080	492	chrome.exe	88
PID 492 wrote to memory of 2088	492	chrome.exe	89
PID 492 wrote to memory of 2088	492	chrome.exe	89
PID 492 wrote to memory of 4348	492	chrome.exe	90
PID 492 wrote to memory of 4348	492	chrome.exe	90
PID 492 wrote to memory of 4296	492	chrome.exe	91
PID 492 wrote to memory of 2280	492	chrome.exe	93
PID 492 wrote to memory of 2280	492	chrome.exe	93
PID 492 wrote to memory of 4332	492	chrome.exe	94
PID 492 wrote to memory of 4332	492	chrome.exe	94
PID 492 wrote to memory of 6124	492	chrome.exe	95
PID 492 wrote to memory of 6124	492	chrome.exe	95
PID 492 wrote to memory of 5392	492	chrome.exe	96
PID 492 wrote to memory of 5392	492	chrome.exe	96
PID 492 wrote to memory of 2420	492	chrome.exe	97
PID 492 wrote to memory of 2420	492	chrome.exe	97
PID 492 wrote to memory of 1872	492	chrome.exe	98
PID 492 wrote to memory of 1872	492	chrome.exe	98
PID 492 wrote to memory of 5588	492	chrome.exe	99
PID 492 wrote to memory of 2672	492	chrome.exe	100
PID 492 wrote to memory of 3048	492	chrome.exe	101
PID 492 wrote to memory of 3096	492	chrome.exe	102
PID 492 wrote to memory of 3096	492	chrome.exe	102
PID 492 wrote to memory of 6080	492	chrome.exe	103
PID 492 wrote to memory of 6080	492	chrome.exe	103
PID 492 wrote to memory of 928	492	chrome.exe	104
PID 492 wrote to memory of 928	492	chrome.exe	104
PID 492 wrote to memory of 5280	492	chrome.exe	105
PID 492 wrote to memory of 5280	492	chrome.exe	105
PID 492 wrote to memory of 5320	492	chrome.exe	106
PID 492 wrote to memory of 5320	492	chrome.exe	106
PID 492 wrote to memory of 4404	492	chrome.exe	107
PID 492 wrote to memory of 4404	492	chrome.exe	107
PID 492 wrote to memory of 4500	492	chrome.exe	108
PID 492 wrote to memory of 4500	492	chrome.exe	108
PID 492 wrote to memory of 1844	492	chrome.exe	109
PID 492 wrote to memory of 1844	492	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ogwta.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89379c728,0x7ff89379c734,0x7ff89379c740
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,12459703283151561993,1414147964649167398,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,15218794984571028720,2217343130502436044,262144 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,3938764688690288617,3424093735971830650,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,11641675861065054574,6311831377471706683,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,11012866041937548918,7328362488255147856,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,16356968430276251153,12179075836239031940,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4192 /prefetch:9
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,17642382001141505354,10583782845461029892,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5020,i,13707652294020739327,9952220618836179918,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5176,i,158025719604164176,17766215600480193251,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5360,i,8662319157297556958,7836608086064052755,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,8270635276183139580,6021304785974663553,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5192,i,1416434724244363827,7988326456309693276,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4728,i,3689572871030266366,6870711090721710245,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5916,i,2341856052691369356,12830379312614338412,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5324,i,16059550511415238740,9907318778806010525,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6036,i,16288254351061540160,9009431965918427344,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5324,i,11941299412357055507,8879353462908153238,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,18026619060813281143,2737082756881104832,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,9061037944564559744,1292014376053200805,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3084 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,5603450092215704689,1269643231706270265,524288 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3368 /prefetch:14
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5428,i,16502170251545510354,2076198077146589961,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5036,i,13292076849721826039,6211535930983880779,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5332,i,15556604255221830354,3311959443653648252,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4984,i,932072202622027476,15505973365609907721,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5384,i,10881536469381963553,11538995588416260570,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4704,i,4909992426206102959,6659821992804952500,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1064 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6120,i,17524202613798916626,1464683178804127524,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5080,i,3459413083768138258,593097363659596599,2097152 --field-trial-handle=2072,i,17787215994502548670,7010635072768308556,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 de062afa9a1191eef51bf26107ac91d5fcf887f236e41a02ebbf90b39247f0ac
MD5 c8487e47b108176faa1dd0325efb022d
SHA1 240865392a92464b4f9d00c6c7103c9fe1dd34f7
SHA512 dec2c7dcada2ed4f7d3d4520c95c511d219bb4248f63a55934aa949f17bf008ea5ae79f38548ade501b0cff6be08d8c75ee82ad82a5cf7cda8326de1e5baa7be
TLSH
T18FE0E56EC820AC371CFE071860944745EA6123572B90894B7A3D82088FB063B0586C1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 21KB
SHA256 b5d33659516352cbfac430df45f962291cc6703b63fe778523161eedf1e9ede3
MD5 19c81ee20b27f4c7c24b6f46df27c097
SHA1 10378140a566a62328022e49e2b3866ec7589d30
SHA512 59b67c702e8d479b41d534a16d7344b538cf1511742c7897d905e19f38f0e865cb9fd0c22a16f02b79b336f10a1b1b5285019abef8f64b91fb1bf6ec119b1239
SSDEEP 384:SjdMsFUQLubAvYOxIqF7cAZkEU7nXxw5s6hfDkQjuEdjcErV9MvwZJaUrkzt+3Sz:KnYKYUFwbDBw5VRj5cc3ZJRu83C
TLSH
T12CA2E1EA340E0D86833523AD3905BBD52B36BDBAB83542D67A18CD471E176D8B1C6CDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 58126f3fe4e4ba471c12da072e25555c989961ec7676e432f56281b76719103f
MD5 1c32c68576f00443de0834cce84a2f5d
SHA1 086035452d429017df2c42d131f8d2378373cd13
SHA512 78f81c0f8766e4a3512328399d12c3a94dec384eeab82bdf71a691f4c7a9c140a3e5701d9778bdb15cb815f613f7b5b8da1516104efaa1ec77b5cbc27f847423
TLSH
T1CDF0ABCD05E25E45EFBB1FBE21810F5A22687092D6C31663CD4683E06327A997155D88
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 952e5c90ae2c3d2c80eb70f2bd89f8ac821060f7c1be8f76363137b58e0089f8
MD5 a772f7c07dc75bbb14ac62ca3a9a606d
SHA1 1a152739502065362d8a75accf3e95aba4027ab1
SHA512 d4da4551d000f0ab9f311fae75733e50f95f6fac4ea82fa6a5a8bee4bfd2cb4e13980062ff762da293e20e101e7201623988128b903978e58381d8a5f60fce86
SSDEEP 192:ERLe0ePSJIDU/mn/f3xetua4ov7pFpAPRp2H//9YHsb+WNnmT1Uj2jo2gZaeg8JW:ERa0em4QbUXqOw8e2M2gZY8le
TLSH
T19F42C52ABD547D7B5CCBC229FA257B57E7F2102221912E84E6FC892C14E79DD322341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6f1cc819edda9bf65100a4bacee07bcb0a1577e0a735b0255195560a14af7c9d
MD5 fc6cd60f461a3e665663518c8e4f8480
SHA1 1932e63ec9351a320fb252ff7d8efa0447d1f1e3
SHA512 633e380ef6c6424c7b31c18b0638e80c0a1655f09fd95f1947228c40e0aa1c4c6dbae3e651d7fed305ec1182e42816bddad2810ea169e086156ce45a35f46fc6
SSDEEP 192:ERLe0ePSJIDj/mn/f3xetua4ov7pFpAPRp2Hwd9YHsb+WNnmT1YXeGo2gZaeg8Jt:ERa0emTQbUXlOw8Gej2gZY84E
TLSH
T17352C52AF9543D7B5CDBD229FA257B57E7F2102231902E84E6FC8A2C14E79DD221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bf819f4fd0ebf20e16de52c545d5661cc3d6c9f0c5c8942adc892e46088a3bcd
MD5 c2e1166728bea9704bc29b43c37f290c
SHA1 566518a84ce61c2b1a802caafbe513fb492137b3
SHA512 f4b6054715b44fc17c130757bb8616bba0a5b391db8e5155c50863cb7d78c86fdde14686c8b93d281467721e3c140a86822c3767e11bd5006207bbdf79965c66
TLSH
T147B012A08001E951C05342F5118308887154BF148705330573E0A971D8261908014191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5864ef.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5864ef.TMP
Size 96B
SHA256 d6f0e12dcd5c599343bd15ab58f1a12223371593368cac3568bacfd193e76547
MD5 e1ecec42fe3ef0050a89c611ecb7f8f6
SHA1 9fb87916369bed51cb7032edf93d9abee56ea4e7
SHA512 4ef850d167406cf0e3e8c1d4a0c91cc07466287f8f920a91a3c40464a08b2d7483576db592e00ecb158b752f77c604c6f63ef37577931bed0914611bd786fd4f
TLSH
T1C5B022A0C0032203C20303B22A80C0FC3022EF30CA03230A83F00A22CC302200022820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 74c74d8cda602f4e9b8ddd2d243e59a059d12fe4d19b97a1d78e769605607f9a
MD5 a26e3a897528b0d87164dacb8235da28
SHA1 564e084cd7c2fd0102c28a4acde8eb97d2d6b1ba
SHA512 d4010b10e8a59650acb480602732aef7a31d7d1eb6dcce59d1826ecdf4c6db3bc9c03836e3b9828c40f7f02fbf3becfa294fab6b2631c637a0fc6ca812e3920b
SSDEEP 1536:rhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:l++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1F59312B99D1EBC35239FD6A690079CAC4CE38CCE1614547C30C75F1E14FA3A2A34B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 95c5e3d86461973f49d4c10455a00674da2d6245bf4d5924ad5dc41ca5227d78
MD5 587ba3c5f61d5783f39b1c9879e7ec61
SHA1 69eb34ac4c6f1f5ad121d37e1bf6dc5f06ac7523
SHA512 8f2d93208e822b8659a245ef30a8c01efcc77b95843bce0fc03c8a99278466501191380c0057a8e8ede7434fe19134e72ba424e63eefce5c8511c4c1a6bd8095
SSDEEP 1536:S4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:h++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T16F9312B99D1FBC79636EC69690079CAC4CE39CDD151414BC30C75F1E18BA3A2A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 383ac6b11500ee20ef9af435b8c537a8ed12186f2172fba83c02804298f0ca41
MD5 5eb7e94d30604f3ae10926a65b7ae5db
SHA1 236c54dd85a8f226daf8fac4fbd1a622b8cd68c6
SHA512 9d00c934a60731b8ea27b4efa3c7e9ff84355d8c3e59c83432d3c378bb8d3d94014c56eddadfeaad57ca5d8ab002010162c004ee1c21f85e0c5ca4a36bef24d6
SSDEEP 1536:I4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:h++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1749312B99D1EBC35239FD6A690079CAC4CE38CDE1614547C30C75F1E14FA3A2A34B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 c758292fed0ea181b10b5c4db0fbf75308c54fee98b9c337bc77d5bd54ee032e
MD5 0e86bd1a9d5bb8d6629bee0df5ae5e79
SHA1 812ef97efac28fcd2bbe6b4366abdc5a130a6110
SHA512 9a6d22fdcb4b90a8cb3327ca1b55c00cfe788dd640056e6805de00c1bb64a6465accb6ffd8972e6ce05d243c6ee9650569f3d31d5cae31c76b8edade35b29155
SSDEEP 1536:IlP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:6++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1C19312B99D1EBC35239FD6A690079CAC4CE38CDE1614547C30C75F1E14FA3A2A34B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download