d6de7925195e5d9b27d2504751adb89eaa93dbd74a5f4c74288401587a481f5f

Analysis

user interaction
yes
max time kernel
79s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 120KB
Sample260504-aam65sat2s
SHA256 d6de7925195e5d9b27d2504751adb89eaa93dbd74a5f4c74288401587a481f5f
MD5 8d7e7b100f81574f52a67037a9bf3639
SHA1 d186c5097a97a265772874837e39bf5238fe581a
SHA512 e5e6b08f7071a2cdddf61a0264dc3f7ff3f795280554615e95f5f38c4def73dd8d22ca8ab6650650757df8e924119e8283b86ca6a947ae03303908dee51faee8
SSDEEP 1536:VrEWN4sCGwmtUD3MenvS68JMg+iHF8khMBe3eFe4e2ehe9eveBe0ePeXewZe6eHZ:lCtmtA3HvS68JMYF8khrH
TLSH
T165C3612173E0721F5A1F95D993212FAA5ED2402FC7120458F52E22BF4F5AD9A8C33A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5828	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223264822478170"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 5036	4724	chrome.exe	86
PID 4724 wrote to memory of 2332	4724	chrome.exe	87
PID 4724 wrote to memory of 2332	4724	chrome.exe	87
PID 4724 wrote to memory of 5828	4724	chrome.exe	88
PID 4724 wrote to memory of 3760	4724	chrome.exe	91
PID 4724 wrote to memory of 3760	4724	chrome.exe	91
PID 4724 wrote to memory of 4216	4724	chrome.exe	89
PID 4724 wrote to memory of 4216	4724	chrome.exe	89
PID 4724 wrote to memory of 760	4724	chrome.exe	90
PID 4724 wrote to memory of 760	4724	chrome.exe	90
PID 4724 wrote to memory of 2220	4724	chrome.exe	92
PID 4724 wrote to memory of 2220	4724	chrome.exe	92
PID 4724 wrote to memory of 3932	4724	chrome.exe	97
PID 4724 wrote to memory of 1960	4724	chrome.exe	101
PID 4724 wrote to memory of 1960	4724	chrome.exe	101
PID 4724 wrote to memory of 4016	4724	chrome.exe	102
PID 4724 wrote to memory of 4016	4724	chrome.exe	102
PID 4724 wrote to memory of 5600	4724	chrome.exe	105
PID 4724 wrote to memory of 5292	4724	chrome.exe	106
PID 4724 wrote to memory of 4184	4724	chrome.exe	107
PID 4724 wrote to memory of 3516	4724	chrome.exe	108
PID 4724 wrote to memory of 3516	4724	chrome.exe	108
PID 4724 wrote to memory of 2764	4724	chrome.exe	109
PID 4724 wrote to memory of 2764	4724	chrome.exe	109
PID 4724 wrote to memory of 4576	4724	chrome.exe	121
PID 4724 wrote to memory of 4576	4724	chrome.exe	121
PID 4724 wrote to memory of 3756	4724	chrome.exe	122
PID 4724 wrote to memory of 3756	4724	chrome.exe	122
PID 4724 wrote to memory of 4812	4724	chrome.exe	123
PID 4724 wrote to memory of 4812	4724	chrome.exe	123
PID 4724 wrote to memory of 3980	4724	chrome.exe	124
PID 4724 wrote to memory of 3980	4724	chrome.exe	124
PID 4724 wrote to memory of 3076	4724	chrome.exe	125
PID 4724 wrote to memory of 3076	4724	chrome.exe	125

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb16d0c728,0x7ffb16d0c734,0x7ffb16d0c740
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,1392044537288307571,10704267961568196940,262144 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,5513892957323528452,6036558503650111936,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,6706399064275724470,3586790324426678309,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,1991782123154315543,16709362816821509289,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,18408698409391069726,15509016048869684057,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,3571048599523280827,8327987900485640026,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,5963371131745852040,14110894605882761592,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4880,i,12745701494763075109,8097722358619595281,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5972,i,13712240139255304019,539176626346843893,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,13064753525221980403,176197430139382467,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3152,i,5336781120344972133,4158421436679534738,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,2332286528375353794,7428115296825549180,524288 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4456,i,2841959391654428179,6996836961298838419,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4940,i,3715981217749460622,12582928071335106189,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3916,i,8073128581261710037,6398320258919163792,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5972,i,2965136839432922225,7446585152682707951,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3644,i,15862315748205283987,7138693310229528165,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6100,i,14555026447926126918,5401244398783936096,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6068,i,11445656610513158706,2216365583555242663,2097152 --field-trial-handle=1984,i,16790523077570751345,5448677942786423214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e60daa79748d49a641c58bea95d081e6b3ba372f12c25ef2c80f70dda6ff9b01
MD5 0b4736534a0b8da1fcb6a7a7d2c31bb1
SHA1 0e9b45c3547656c50ab33f53890345edad08e790
SHA512 bbad51990e2f917e48b38296f2e23ea6320f7ca2e7082e118a39e7bf9eafa75a2f5158df9c2025bb816cdc3eaefdf83059dc03096503d89a76adc7ce6b7c63ba
TLSH
T1E9E068ABD862EC2B08FD5B296454474AEF0513576B43990B7B3C860C8FF423B8586D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 16KB
SHA256 0e4c8483e91039738e0e9e77cf711e4ad645fd9f2aeb98b84af6dcadeaeefc7a
MD5 d3e682fb9b5d33168caca7c577e97a90
SHA1 0185bbae781527bae669b533bf09fb6fc7b3dd6b
SHA512 39186d2d34deccde94aaf07684fcce5a69505ed7bf775eccdcc53ce08c0a7c7eb29df112846db296202a800b54cabc65a5396439800866b2ac103e6f2ed5e344
SSDEEP 384:jnoBd9YGMfEzbLTBJp845U28BTHm9fXWaPtB9ayp2DKthjC:MBd6MzXJ845U2MyZPvp2DKtBC
TLSH
T17A72DF9ABC113DA42B6345AD8E893EE7458900750632531665FBF5DB04F2BF894BC239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec6f0002b059581e_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ec6f0002b059581e_0
Size 232B
SHA256 5cc4167b2107287f1daf08be294a6bebdbaa1d3a82b1c7cb48b16fd0d1bf3ee6
MD5 8ab0c956b462f9f7feca88089ed2e10b
SHA1 6d6393e49f4c86f02a798375e9601211b927ed0b
SHA512 3a57ff48426643ccd3f5c34bb74631dc92be1898378fc5e628f7a1307fe01a925902525a0cf9838bcac11638868858386825430ac2192fb41813d89a842e9bff
TLSH
T136D0239715315510D27D55F1876FD19EC613C34C085C45B757D7F48311951B5C300409
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 47a903cd6c249c12de92ca530aed5840492c565fc067456f8a0822d50352723f
MD5 a86bc2d026ecf8e6395e4adf8a69ce38
SHA1 c2227e82ed9d1a07356deb72a3939b17863c6f25
SHA512 1929e1b86b3c306548bd1eb4ed3f404034e50e499f13af3f082bd84b38e072fed2ca294d30ccf24834b1c8d3b6d8423d675d086d6a152a81d5813113e127e812
SSDEEP 192:D8ZlVWhf7SaaIiuijJeaHSpRiYQ0dYIZiMuEDUH:D8ZlVWhf7SaaIiuijJeaHSpRiYQ0dYI6
TLSH
T1F3E19EF3C7E4C66D9911A6F4EB147E1BCE2D0A14031C3D56C9D8AF4B93E2972D14264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d9abeac9b84a522ff2942a461c7fd28dcbd4d280ae2c5e33c1933ae016861943
MD5 9a995b037ac89d4a2f4d7be791623b2e
SHA1 5e8d3a895289fe676c925862b49c4cfe59cdc9cd
SHA512 bd2fb75b3f77be1f43da6e8505826eea8c5a47448861b5b2a7a92bcca0da1864e2d3d2c423712807d464bc1233b35e2727b98de6b1e0ca6866fb21bbc793dbd6
SSDEEP 384:KRmd49q2TAnmaTA5Nn/aUXWQIwmDPPrFapIse:5d49q2EmaTA5NnChQIwmjPopIl
TLSH
T10442E92EB914687F5CCBD22AFA66BB57D7F5103120802E84E6FCCA2C15DB6CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 67fe6d793a749b5c06a43fc966e91fd06e785da36e87689b3a2710e28dfec7c3
MD5 8efc894ca0fc87e22088dbb9c7357fe3
SHA1 6fab05a942ffbcdb239dc4bd85c9112ef023325f
SHA512 dcc16c89381a96087d9c34589188ff737fd87056225f8022c8d32724a98d13aba83c131e63960d6a86900b839ddd3a858a57eb5926932527590a69b5f8d6caf5
SSDEEP 384:KRmd49q2TAnmaTA5Na/aUXWvIwmDPPrFapIse:5d49q2EmaTA5NaChvIwmjPopIl
TLSH
T1CB42E92EB914687F5CCBD22AFA66BB57D7F5103120802E84E6FCCA2C15DB6CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 20ff16b70cd9f1ea39287c4aea2236b60ff7ab96fd1dafcf3ddf9770dc8160b2
MD5 3b0381a9d96931fbb1c9f90166bbc688
SHA1 5c815b0402487b0017aeeccf03fcfd4e378b7f81
SHA512 2c0350036233f583044687c69a229c29f102231abad8d4b7907ec910db9f92b663060c0428961f8de8553cb24575eccef338de41cf048f41543a4edfba694ae3
TLSH
T18CB0125084026602C00312F41182048D3154EF209705130293F46971A876190A126251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c3d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588c3d.TMP
Size 96B
SHA256 b17b3ccbd273964315901ea75bb2fe31f66e359dbc993eaff854f864e243fcef
MD5 aa9a3076fb11709b05fbc1b57411124b
SHA1 c1e1f537654f8add1b7838d07fad49f86e5d39f2
SHA512 ab7d6784183feda991b0086e2766ed8680abf1baef327cfd5a63de196ea3b451e35eb3f35e1765006c9275d027dba2a815e9b010b4a0c6aa66a5a80ef4216c75
TLSH
T193B00275C5136223C14203F02995A6DCB260DF25D613221B97F11E6ADC66AE0C5B6560
MD5 SHA1 SHA512 TLSH

Submit Download

ac03ae40-b1f6-4827-ab36-6b48f8676105.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac03ae40-b1f6-4827-ab36-6b48f8676105.tmp
Size 12KB
SHA256 d708e4b93c0fd244c8f58ad903c2eb3319840a8cc407f16f9a8aad3aa0f28859
MD5 469c5dbbbec1fa796fd176f5f2b35c4a
SHA1 c2fe1d1896ae8198f217116d61cc38d982f243be
SHA512 1baa28c098f5294a651cfdf0eabfaffa80e2d504a8d6b8c0b570919d2ab0edd257229028a5430b3b8b4d87daeb8379be2d7e2ad39ccf96eaf4bb5c7ace059b2e
SSDEEP 384:8XRmd49q2TAnmaTlw5Nn/aUXWCBIwm28nMO23VrrFaXIsE:8Id49q2EmaTlw5NnChCBIwm20MJ31oX6
TLSH
T10C52E82EB810687F5CCBD22AFA66BB17D7F5103124801E84E6FCCA2C15EB6CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 58d7cbf9e0198a8a82afd216f0c932f6982ccbdde95f9a5ef756dac74c9a2fe7
MD5 59bf87bb2050c9431e1c8b66d2142f4c
SHA1 c0caa32dde3ebb04d3c0e77c898e5def26860e39
SHA512 71f644e6ddc549a2f439f7d41ec21897ec10399746c2e2e58adaff1182c1f36a2fda27d77149c2597bd4ccb2ab6dbe90e86205837a3ade3df00535489e05d026
SSDEEP 1536:0klCxfnQRmMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPt:0m3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T13B9312FA9E2A49F799BE5691729E7809CE13130E709FA8CC715C538C21D41C86B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 13cb22f2ef0a5f54cc501aacb586cce196076a9005d25a49d9835e2272acb9d4
MD5 e36329b827b02b496cc0be7c178b5f0d
SHA1 b152ad72c303141bf077a19a9e379e8047ba3e3d
SHA512 45a1b9cd20cb6533e738292fa6eb76082675734cce7276dc1ede77d24911e0a22a1993aa67aa85e20447bfee76f99913b1ae40978b9bd1c869ae80dac9a0e73f
SSDEEP 1536:0kYCxfnGR/PucYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLl:0O3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1B99312BA9E1A46F799BE069176AEB809CE13130D705FA8CC725C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 571103391d7b58903ab7ed1bba9a7e108a0d0dc59a731bfb5c8846fe5fe2da2e
MD5 8f07d326599a4f0512d208ba4ba35a28
SHA1 ce83f73e95e57429e6968d94ac2c0e564181d0eb
SHA512 dd48e0b2b1cd3ac85b179714d6a5c72983c132e270d13c95f258fc9d9241c117389419c2df225cad1c62ef69780d382c242bfbb9a191311fb65d3193996b1d23
SSDEEP 1536:0klCxfnQR5PucYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLl:0r3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T15C9312BA9E1A46F799BE4691769E7809CE13130D705FA8CC725C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 113KB
SHA256 5b5e32a0fa0bd9298cc2ee303aba5040d8757f43e2f13e431738ef86e3b39e81
MD5 48479735e8798c39688adc0f72f93d38
SHA1 d9cb4aecf4db95c0dbb62517f27495ae52a400e5
SHA512 f219ca44d01f813a076cee12776da0d86c727d2e1cd62e6a00cd92d2a72f5d15a011c1da90d6fdaa81acf1d88a419ba0c0b40e58f9e654be1b06beb65a46f20a
SSDEEP 3072:0NkJ6ij3Qw/xLANk0mUW5GmRntSFCjEENW:0Ns6urOk0HOGm/SFyEE4
TLSH
T1A9B312F59A235DE749BA1BA5F05A7D09CE17430EB06FA88C7168A38D25C51CD2B13F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 db49450b91ef7458c482ba85e3ca0177498691c6d679efca28e4bb6351795289
MD5 a9f73e9c25e6bcc0f6f12656492118ea
SHA1 c4ead507be41fc26a824d5fa46402431b2fc7ff9
SHA512 8f561dd325d6da4fb083a3f6a2175db564819464bc7ed723def90dc6959755ba95fe513b5e9dadad3e92c113862428c8a4202019054ef71c99fd732c4915abe5
SSDEEP 1536:0cCq4OgcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jC:0d3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1449302BA9E264AEB957E468176AE780CCE13130D709FA9CC315C639C21D41C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download