hxxps://vmi3259786[.]contaboserver[.]net/?_task=mail&_action=get&_mbox=INBOX&_uid=57681&_token=e250b6cbfe8dc8cd0b8b6d865d0df9da0e1abeda99cbc61e0152704f75507392&_part=1[.]8[.]8&_embed=1&_mimeclass=image

Analysis

user interaction
yes
max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vmi3259786.contaboserver.net/?_task=mail&_action=get&_mbox=INBOX&_uid=57681&_token=e250b6cbfe8dc8cd0b8b6d865d0df9da0e1abeda99cbc61e0152704f75507392&_part=1.8.8&_embed=1&_mimeclass=image
Sample260504-semqaaat4k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2620	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223806250420984"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3888	1144	chrome.exe	83
PID 1144 wrote to memory of 2620	1144	chrome.exe	84
PID 1144 wrote to memory of 1096	1144	chrome.exe	85
PID 1144 wrote to memory of 1096	1144	chrome.exe	85
PID 1144 wrote to memory of 1916	1144	chrome.exe	87
PID 1144 wrote to memory of 1916	1144	chrome.exe	87
PID 1144 wrote to memory of 3312	1144	chrome.exe	88
PID 1144 wrote to memory of 2896	1144	chrome.exe	89
PID 1144 wrote to memory of 3312	1144	chrome.exe	88
PID 1144 wrote to memory of 2896	1144	chrome.exe	89
PID 1144 wrote to memory of 3472	1144	chrome.exe	90
PID 1144 wrote to memory of 3472	1144	chrome.exe	90
PID 1144 wrote to memory of 944	1144	chrome.exe	91
PID 1144 wrote to memory of 2576	1144	chrome.exe	99
PID 1144 wrote to memory of 4524	1144	chrome.exe	100
PID 1144 wrote to memory of 1852	1144	chrome.exe	101
PID 1144 wrote to memory of 2024	1144	chrome.exe	102
PID 1144 wrote to memory of 2024	1144	chrome.exe	102
PID 1144 wrote to memory of 452	1144	chrome.exe	103
PID 1144 wrote to memory of 452	1144	chrome.exe	103
PID 1144 wrote to memory of 3200	1144	chrome.exe	106
PID 1144 wrote to memory of 3200	1144	chrome.exe	106
PID 1144 wrote to memory of 1108	1144	chrome.exe	107
PID 1144 wrote to memory of 1108	1144	chrome.exe	107
PID 1144 wrote to memory of 5112	1144	chrome.exe	109
PID 1144 wrote to memory of 5112	1144	chrome.exe	109
PID 1144 wrote to memory of 552	1144	chrome.exe	110
PID 1144 wrote to memory of 1608	1144	chrome.exe	111
PID 1144 wrote to memory of 1608	1144	chrome.exe	111
PID 1144 wrote to memory of 464	1144	chrome.exe	112
PID 1144 wrote to memory of 464	1144	chrome.exe	112
PID 1144 wrote to memory of 2448	1144	chrome.exe	113
PID 1144 wrote to memory of 2448	1144	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vmi3259786.contaboserver.net/?_task=mail&_action=get&_mbox=INBOX&_uid=57681&_token=e250b6cbfe8dc8cd0b8b6d865d0df9da0e1abeda99cbc61e0152704f75507392&_part=1.8.8&_embed=1&_mimeclass=image
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeec14c728,0x7ffeec14c734,0x7ffeec14c740
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,1071026307861211562,6004565448252082885,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,3478426842927786750,13866029901699811665,262144 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,15092989279096760585,2329247329443822914,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,1173156377772057938,16727359761629941951,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,5564753077045781324,2869991790627616155,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,11846705559074001155,1871036973476644597,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3920 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,14066899774495306820,15694130278366121837,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,9580953821354517840,14294519224556544663,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,8615499344862871632,14057274013902867846,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,3627480070218258804,16502243940518724878,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5488,i,3360024502162724911,7845801081092771110,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3924,i,14731689480673962826,10647880161441937104,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5484,i,8319635871556270033,3796016113275765895,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4412,i,16487354967973865417,16831805686232901290,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5468,i,7201454097668965993,5648390514269846489,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5432,i,3998037078776192813,11936512431832787551,262144 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3924,i,17126068037450107223,15312495155500113482,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,1317817649778814096,11116441515988613520,524288 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4608,i,5856668255673941906,16454766762877880544,2097152 --field-trial-handle=2028,i,4304095818455066793,1646325058974332966,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a4c2d71-c1ba-4945-a36e-a7448d69ab04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a4c2d71-c1ba-4945-a36e-a7448d69ab04.tmp
Size 12KB
SHA256 2d3ca0bca824f6c54e0d0062f8e26219757bb92a85426aae11de67df1686c504
MD5 b68f1bac025e6899ddb76ea0722c3d97
SHA1 e846acdb1a1498d147d19da7cb5a57105544ccaa
SHA512 f6c2b0e1df645cf0a6d2b15e2e614f63f2a97ad8925fecf3bac62d177cd1c757f75a54c1ccd9e36d42f4663fffdd536476d4f239612395422cf97e36970e7574
SSDEEP 192:cRF18B5CyUv7rpAPRp2m98Hsb+WNnBPPBN2fqe4ZYap1VyIsnAUge:cRF1enQHUXF6wVPn2/a9e
TLSH
T14A42D62EAA20797B5CDBC229FA257757DBF6102120D42E84EBFC8A3C15D7ACD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5c0bdb763a78b00642ae5fda821d94ab9d843064e9ba14ba419ca490dfbef6f9
MD5 f96f75e6deeb69966102d7a85f3d968d
SHA1 2d1bedccf0184c115892dfab7a0eed40ba242f0b
SHA512 81dc2443e6882c3785c43532ad06d79ce79aea020c6fecbc4b00cf4382458b6d9653b068259fb697098e216d0d85549d8415c8cff1fbd16c9c6dd9abd2447b70
TLSH
T122E02BAEC925DC370CFD0B2C61044A41E754231B2791595F363CD20D8FB077A4586C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fbdea27f58752093d14bcd6aba316b3353e094ff7f61fa1e688945e45fa1751
MD5 173aa42901bc788b366c1a72a836797e
SHA1 21a814dc1ec37ec9fae7e3c5c9052890c474a67d
SHA512 c63f12670ee0e3a4117501c5b178e75653dfa2b0aa30ca9f5979a24a13a6dc53cd7f9bb136b0da3ce32d3c13fb1462994e52e78de18326f7527e0cdd44f0ebbe
TLSH
T1DA419CF793F4997E861196F4AB156E2FCE6D0524036C7CA688D4AE1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f436bb471c070069ea04beea98d779dbec3e2a33ed4bee91842057850c08937
MD5 c4f62d7c8dc3ad9b33ef34ff4403ec51
SHA1 a304deb910f14e67dd8b740c32ec06ef920436a2
SHA512 08af874f101f5e8a18b0f8d049c5c468491f8847ddc90ef927bacb0d46b6c1e9df78ce7fa82bee5a6f0e42485c43d006fdc1610cc482afafc82696ebaf8559b6
TLSH
T1B6418BF793B4997E861192E4EA156F2FCE6D0624031C7CA689D4AE1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7c0d8a53bf809c3a498a4f8c58f0d6bb35f41ceaf20dbca27b66b4e52974bdaf
MD5 b8864f68ed96db9023a604835602590b
SHA1 954bbd792171ccbe355c743ef4e7bf07b9a33229
SHA512 eab33e671ee094cbf52a08cdf723c2ddc87653a0df24d2ee7a8e1b30b41d10554ebfbd0778ba25072904bf174aa22b89bfaafd3c7c82089694f76f8f73d1699b
SSDEEP 192:cRF18B5Cytv7rpjPRpH8n98Hsb+WNnBPPPN2fqe4ZYapTVyIsnAUgE:cRF1enNH9XC6wVPF2/anE
TLSH
T14552E72EA920797B5CDBC229F9257B57E7F6102121942E84E7FC8A3C11D7ACD2217067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3e1990e92ae0ba22ccc20a00025c08fe897ca2aa883af51cbc9f796049f8e8f9
MD5 aa0218144180ad6b5ca86500d3ec9f0b
SHA1 381fd16bb5b11ca5757a30a15fbc9b0d0be7887a
SHA512 5dc39adc49e645350ea33c19ce9b66f8837cda74c11f227f8bd86b37d9bcec018f7eb6c4684e3afa58a85e99d81e03aa8b87365c9da20832adbf4fb5275ec42a
SSDEEP 192:cRF1YB5Cytv7rpjPRpH8n98Hsb+WNnBPPPN2fqe4ZYapTVyIsnAUgE:cRF1CnNH9XC6wVPF2/anE
TLSH
T13B52E72EA920797B5CDBC229F9257B57E7F6102121942E84E7FC8A3C05D7ACD2217067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4893022fda4fbeccbbbcd3c8ae0f5b8671da97e1132034c05c64e454a5c8dc6d
MD5 6c702558b502014bf1ce30effb28af8c
SHA1 c62a9780ddea24444f761350fe8ce079f468efb8
SHA512 45c7cadb0f5d23d0fd6c0b7f95a894ed5b8dad01b57f60715914bebcd8e24676a3eb2f047477255b426529b946107e6bdaaddf716d54ca58e9cd4561529b27d0
SSDEEP 192:cRF18B5Cyrv7rpAPRp28I98Hsb+WNnBPPBN2fqe4ZYap/VyIsnAUgE:cRF1enTHUXe6wVPn2/aLE
TLSH
T13142D62EA920797B5CDAC229FA257B57EBF6102161C42E84E7FCCA3C11D7ACD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5ce4dd310b47e7d1942c1ce46c023ccc62e2fc73b4f3a6fa71e2a61253b4a458
MD5 cff69f84b11b153416a5b6e9d0bd3984
SHA1 95ed9dba3e8c2bc0dd440e032f82f4f990e64382
SHA512 1243f39d4b4b97467ad7848fbf0dd5eb8163b60ba51e9c175295b8daa5f5baa6dbec522b96bc81fff28d926f0c671e735bb04a097eb331a13b035d127df2e186
TLSH
T1EDB012D0C0425542C07303F916E714DC32149F11D705330253E069B6982A29041152D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587e82.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587e82.TMP
Size 96B
SHA256 63b30984b1a96da97cb50c6d0eaf36e195bf04682aa1e4d8687f40bd5486f0d2
MD5 f8503a6992ffd60e4cd1c3b8e929f03b
SHA1 49d7960468174430d57a356f741f95b0b61335b9
SHA512 581454671354d559f9ed0eb4df6c3f51e222fb224ae46a8cd5a028855aad49d749ea16c54850cd282ed0b1770ab10a742b53e456fe752f7acaca8f3dbbcd2c15
TLSH
T1DAB02230C202A202C00303B028A8CCC83020CF20C2032323C2E00E32CC203200C3A020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 32e3f40f49097589ea417532a032e6e37a3d3c6a234c1ea3bb5e7597072dad2d
MD5 864f1dd631aa12266350e8175a770274
SHA1 72c07e71180c2a07454a8532eaca8cef36a3f0cc
SHA512 7a25ca3f85e682724e3095f6267d90d979eb0ca6e4a5cf73bbcd8112a4779b632f3f6e30ea8ddc48f18b12f69a1929d0f9be8aceafc3d2a782c3fd8017aabfbd
SSDEEP 1536:W+TYcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:9c3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1989302BA5E2A59F395BE5691729E7809CE12130E716FA8CC716C538C31D41C82B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 802f156e06e10393af4539fe010e38aa9db0b780870ee5e283ef2cf862591b90
MD5 c9b31e206b7b66d9042ae85b84a867ce
SHA1 9118105cec1660431054966949cccd23cc390de3
SHA512 a21678ca429893fe8b1dc75c2ab00bb0356cb714430252acedb525b413a835041c4866e887d190b3b82e85c47e276d874e7e4c1df6819f2dfbf4bacc96d8a749
SSDEEP 1536:W+TYcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:9c3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1ED9302BA5E2A59E395BE5691729E7809CE13130E716FA8CC716C538C31D41C82B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 4ebe8646790f8fe93c3fd2e021d24a13a051a97732f61dc9fa75626b80a59abc
MD5 3d1276a4456c0d7534f29d5a3db89f12
SHA1 b03d2c6e93298771a980a0983b930691cf5906fa
SHA512 e22e4c387a50465865435343946d22ced8a4586966acb94b057c5e238a58e9b205d40ef8c8a8791c55c1226aec1b702cbe1a0b08916ee5f2df9af1315526c1ea
SSDEEP 1536:gCcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:/3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1D49302BA5E2A46E7957E469176AE7809CE13134D70AFA8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 79bdc3c4484ef6291ba74d66f53dfef77854e647739ec10dd9763fcc4d62cc95
MD5 78cd30d53178aa6cfc59a1e1234d3d99
SHA1 aaba0e97c3b99b71285e8c145c18c4dc78c8a8bf
SHA512 ccd1e73e18ec1eccc9f24f8f6593a356c746d1de19d2532b3dace19b4bfa1e0e57a0d60fbdb07967437c0e53e9c8f45442611106400f9c3c492732fe04dd31e2
SSDEEP 1536:WHTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:O3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T14A9312BA5E2A59E355BE4691765E740ACE22130D719FA8CC726C539C21D02CD2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 fdf6ce8306ac3c1fbabbf0f8809b7bf37ae820f09b6300e1f2e18b65677467f1
MD5 4f0b48637601750d44906df1863598a5
SHA1 4aed2df3ec53f478a2b432332416fb5ec4874499
SHA512 66280b05d84e2b7480aff5c4d1ecdc841b50f39184f8494d8f26fef9f49a8a318ef850c61df8251c520f4603b80ef7835e034a9617124b01daf7a66258c9273f
SSDEEP 1536:ZHTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:J3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T14A9312BA5E2A59E755BE4691765E780ACE22130D719FA8CC726C139C21D02CD2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download