hxxp://txtlnk[.]com/a=b53e672

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://txtlnk.com/a=b53e672
Sample260508-tft2esd17j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227296367137308"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4464	4424	chrome.exe	85
PID 4424 wrote to memory of 4684	4424	chrome.exe	86
PID 4424 wrote to memory of 4684	4424	chrome.exe	86
PID 4424 wrote to memory of 4704	4424	chrome.exe	87
PID 4424 wrote to memory of 4552	4424	chrome.exe	88
PID 4424 wrote to memory of 4552	4424	chrome.exe	88
PID 4424 wrote to memory of 5932	4424	chrome.exe	90
PID 4424 wrote to memory of 4736	4424	chrome.exe	91
PID 4424 wrote to memory of 5932	4424	chrome.exe	90
PID 4424 wrote to memory of 4736	4424	chrome.exe	91
PID 4424 wrote to memory of 1344	4424	chrome.exe	92
PID 4424 wrote to memory of 1344	4424	chrome.exe	92
PID 4424 wrote to memory of 3232	4424	chrome.exe	93
PID 4424 wrote to memory of 3232	4424	chrome.exe	93
PID 4424 wrote to memory of 5880	4424	chrome.exe	94
PID 4424 wrote to memory of 5880	4424	chrome.exe	94
PID 4424 wrote to memory of 6024	4424	chrome.exe	95
PID 4424 wrote to memory of 6024	4424	chrome.exe	95
PID 4424 wrote to memory of 5744	4424	chrome.exe	96
PID 4424 wrote to memory of 640	4424	chrome.exe	108
PID 4424 wrote to memory of 656	4424	chrome.exe	109
PID 4424 wrote to memory of 2292	4424	chrome.exe	110
PID 4424 wrote to memory of 3556	4424	chrome.exe	112
PID 4424 wrote to memory of 3556	4424	chrome.exe	112
PID 4424 wrote to memory of 4924	4424	chrome.exe	113
PID 4424 wrote to memory of 4924	4424	chrome.exe	113
PID 4424 wrote to memory of 1244	4424	chrome.exe	114
PID 4424 wrote to memory of 1244	4424	chrome.exe	114
PID 4424 wrote to memory of 5168	4424	chrome.exe	115
PID 4424 wrote to memory of 5168	4424	chrome.exe	115
PID 4424 wrote to memory of 740	4424	chrome.exe	116
PID 4424 wrote to memory of 740	4424	chrome.exe	116
PID 4424 wrote to memory of 4676	4424	chrome.exe	117
PID 4424 wrote to memory of 4676	4424	chrome.exe	117
PID 4424 wrote to memory of 4132	4424	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://txtlnk.com/a=b53e672
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbef0cc728,0x7ffbef0cc734,0x7ffbef0cc740
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,6148176255132340498,13196470412774125034,262144 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,15117739471242893535,17599566224306632476,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1616 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,4271883552328947485,10941129444990539231,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2328 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,10633563173698257335,9775556000996691678,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,18014427396793430701,6282466348347870529,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,7563557141829111962,7868091576215026442,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,15130862180963917731,10240637972570549104,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3536,i,5911476638814018589,6770615863467194218,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5048,i,2513883538204201384,13210464597624299151,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,13076211073612626765,10892203818285074629,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,15559026442565917073,15573945779585244542,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,16351032398127226454,15385702511529315369,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,16107327834489549359,2057248148591691189,524288 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5004,i,7629489071513621192,1145819260592677948,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4008 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5160,i,8169129341853384230,1777503790724045774,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5132,i,16051545027780923062,8530537580644194177,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6100,i,9710321813269694654,4952097795673007435,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5964,i,10767999382860115139,5346412193845879268,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6140,i,5567922408001143354,2752886679173678673,2097152 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4876,i,10613791584973049398,2813639068355321491,262144 --field-trial-handle=2020,i,2955828054280699337,6126837624574854503,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8eee536e6ba36a49697cab9be0d7ebe3ef84d0e16ed5fafff3758630ec9afcd7
MD5 a3314c5cd4f2032f9339803e98c1fc8b
SHA1 c73f1e8792a59d01da0330c27659c0631f033890
SHA512 7bd8726f02a77574594deac5db5df9701c74b759393f36e3f4fcdbd8dbbac0690782a26f782e892f52136d8018d231f7197e287467522823ae496bd3cd7f95e9
TLSH
T1E5E022A6D860EC3708F90728605D874AEB55131B3B90998B3A3D810C8FB1636969ADBC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 f6d1a228efb9b4ba23c7f7e255f5dd1349e8092399cd32aa895c9ac0c5fea9d1
MD5 ade978ca08e22d553aa495de78fcb8d1
SHA1 95810edd2447d232af23c01ae11e7f22514c77a8
SHA512 28a655ff81e1f0acf4d3124e27f65acf0e9522ef64bd47fd922411a2244b47828f6e822a2aa0fe614943328d283bc1a6481771e133ac4ea3928ec1b703df5b58
TLSH
T1CEC04C027DE43052CF973D7924453D56555635AC4276439799C813554C5FEF590CC252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 b1c87f6036cafd6e857ea6e7ca2e354e6ce79a89a3937372ce4beeef22c46e2c
MD5 eb1e6403bc9efdc897fd134acc32c611
SHA1 584e17ba86bea9a76951b71503885741b27231e5
SHA512 35b9bb0bd7653fac37ef804dbb8a7ed9f397f7f1ccd3dbf998a16c75e7ccafb8ad3eed00500acd2a8a95f37a46dc57e4747f9a56daeae79928a2d6582ed5b9bf
TLSH
T11B0159AB6AC83591CFD35D3D04447D73E0111E78823B139793C44659288BEE0507D382
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 a03a5dcd3e223ad46217c7080d1492d36cd7e36fea2069d239e733ff8a70bb83
MD5 d7c050e74f4a157f984485482f561c7e
SHA1 c310258bd1dc682c5f6a2289f02c1ad31d65e476
SHA512 d3d43c186fae71795578aa8741577eafb1f674c3db4e56836c9a4bd3f729e8ad95ff0ce3e07d748bb8ee8d2c135f211d1204b53a16955f7dee9f4971d901e318
TLSH
T166D01296A9A870F2CBB7293A14843C03751526DC027A12DAD1881ABD3C4EEF444852E6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ec36a282214d7d4dea874314ee9019ba500e494598933cf38115403402fb9640
MD5 cb2c1962b5c36ac366511affb0243e00
SHA1 df90c164a262d7106ee42267bcecbee75bdb3480
SHA512 1f2bce247eaf302e810e89a9686821816236b98a64c76e74c2b0f12897499970c97dd27ea974549da2d8a606b49e932abc02e331463c5091951cd11b66462352
SSDEEP 96:DhUGPYqWaIaJkjhdTHSdNkYSY7YNYZGYpY2YWLYZMkT:DOGPgaIaJkjhdTydNk/609y9xL/6
TLSH
T10AB19FF7C3E4866DCA1195F4AB157E1FCE69092443687C6688D4AF0B93F6872E24078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad2da7cee372e039bcf56edbd80b23fae1b5b89df5b23452e77b8e1632f2356f
MD5 e0168f907f7d50c77dc6f74228d5364e
SHA1 a606223bb9c036ad3b9e8beabdec0695d7b16066
SHA512 e1c9faab524ea444ae8ed1cdbae1f7d812647c797ea09c746378b71e6021109e4d0d76d2cb8d492a59c0416e53419c3ff654ecfa8c60ba71945e6355ab88a73f
TLSH
T11C519DF783E4857DC60196E4EB156E2FDE690924031C7C66C8D4AF1B53F2972E24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0273f54d5d4cc64906ad239391d7ecb79e360d7bebe38b67c9395982c770c703
MD5 3be38bd27bec6f535905c13b631d6634
SHA1 9e854739fa2bd862217ee3153756c0bc1b2102bf
SHA512 1861fcd938a9859865ef3cb10f798c57501f8085f29398e0a12eb789a6cd8c86d233a24ac46f076681e643a49fbf8bfdf4f173d8fb4e8743455b42aa3c8ff65e
TLSH
T165519BF783E8857EC60196E4EB156E2FDE690924031C7C66C8D4AF1B53F2972E24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f716eca448b5b25c7d5c8300605b6e6f6da382a915ee5b5e2baf99401591972a
MD5 0c108be6fee8d0550d1fafd318e1b4ac
SHA1 a82fd63854c0cb9aefc09e7388a47c62a8e10164
SHA512 7b1c9fc96d773587b4c72242ca4d86195f5c1553e657897967e3a6c4a9a0c470dd501370bd678807571f746f710aa21ca83859f8c9522aba74edcb3846c35950
SSDEEP 192:sRBenHg3DHv73pAPRp2JF9YHsb+WNnOWoJd2OFikwaAkVyIsnAUge:sRBekPTUXyCwHY2Gike
TLSH
T1F742F82EAD68687B4CCBD229FD61770BEBF5142274956E84EAFC8A3C14D76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3a684569a8345554c2175aec754f0b6ad125e1ecfb57c561b857112010ce5216
MD5 61e030885021d69b18bbbe866728c57a
SHA1 1ca78e95c98e3c00d817a3645526ef2f7a8eae69
SHA512 3ba9716d1b5f7270544763ad682773313a5900a4873b568a2bea29d01b7e0ca52ab2cb8ed1580431dc1afc501528816b346d765b092d48308b87b03754aecf3a
SSDEEP 192:sRBenHg3Dfv73pAPRp2JF9YHsb+WNnOWoJd2FFikwaAgVyIsnAUgE:sRBek3TUXyCwHY27iwE
TLSH
T12A42092EED68687B4CCBD219F9617B0BEBF5142264952E84EBFC8A3C14D76CD6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7ab171bdb8baa900e1f00db2fa4a0425db9b18b050a23b533b85f60a562bc376
MD5 2ff21c783161ceec9ed08258b2141f08
SHA1 5aeaa4754bb8e412f225c95ba11b96c0081beedd
SHA512 f096898ee1fd9232be57b7be0eb758600225d9ac554d4ddc6f2accd95fa9d338f2c74cea272c08470a08b6451acac540a1bd2d9f0318c05ffbdd490efe07a86b
SSDEEP 192:sRBeqHg3D+v73pAPRp2JX9YHsb+WNnOWoJd2FFikwaAgVyIsnAUgE:sRBe36TUXcCwHY27iwE
TLSH
T11F52092EAD68687B4CCBD219F9617B0BEBF5142264D16E84EAFC8A3C14D76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 609d6cff481d4bd2ac005e38b14769298f01d304f12376ce4b52a655fe6c2a35
MD5 b254867e163b5c40b1b973c1e5d69184
SHA1 0f5d72d604efef810e98c41ec88310b321c7868d
SHA512 a23c49315f2207fbfdaf6f1062b9ae728269a71bcc93a434b904b1b22d1f4e8ab1900e5f70e005111d7aa874824b084bb6008420b5d619065879a49572da0dd0
SSDEEP 192:/RBeqHg3x+v73hUPRpcJX9YHsb+WNn22FJd2MFikwaAkVyIsnAUgE:/RBel6TIXOCwf528iME
TLSH
T143521B2EED58687B5CCBD219F9617B0BDBF5143265D06E84EAFC8A2C14D76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 347954727610c6e294a708a0f5fa2bd0780b79ea12f4aeb8a1b508879a94dc66
MD5 a1a59b86801455a5163c9d4b63e2bbac
SHA1 1a35f4503a3f9d48aab591528da9c713bc207529
SHA512 74fe9f11964f7caebd346be69e75d1f16344e79254269d8600f3ef6606c5dbbf9a241c3fe9d7052afc144c1de48a6cc5ac8ae4754495dfe713a91bff7291d985
TLSH
T126B0121080417501C08312B01192148839547F18870E130563E06971DC275A140282B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5858f8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5858f8.TMP
Size 96B
SHA256 63ed5183a34d517c21ccb58d4b55698c971423756e9fd23823a375807555b625
MD5 f49a12027ae69015d4e8c5a6dca6b608
SHA1 11787c754a22184fef6ec02710c430a504b6a4a2
SHA512 408d77fb14bcf4fb947baa6723722676fad64010ce8755a23c29eab436b0f87df8748bb18166a970612816d2906e19d24bd3f9a624895e17ac58a3b8077ea8f3
TLSH
T139B02280C0033B02C20333B02082A0C83220FF28C303230282E82A22EC22E300020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 ce1965a0234e5d2b0e5460d332c978174651a6ad6826f5cb24be44b2c1b86f19
MD5 88ec38e72eaa669c59be44aecb2c6892
SHA1 10377c4f1e58a3ad92ba9e77795c3eb18fa5d049
SHA512 9d5699509ca8a1f377ba1fbe142452b21ac02e362a64dda1edbfe215da4ece21f69104a46c4e7b9c4f6436d353d2416b87e73f90870a170b8654a2642dd9ac50
SSDEEP 1536:3cxcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:sx3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T13B9312B99E2A4AF795BD5682729E7809CE12130E715FA88C716C934C31D81CC2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 0889d1b3384e306fd66e2e72f3f592da1a3bf429c1600ffe9f5cf318f0f76522
MD5 4a1554c65df8ce7ce9e88184200f2d15
SHA1 591fbfca132d01f909d796ed789e3136eebb4fbe
SHA512 76953e5a22947ed6639dbccf1d091d2e8fe16d2b796bfee70b9a8f8cb5dbdb4cda78d55ba1fdda4b4f3b0b56f8de95307ea94d3273ab476fd2c202281cd3e112
SSDEEP 1536:5s6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:13Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1ED9312B94F2A46F7957D468276AE7809CE12230D709FA9CC316CA39C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 aadfb8963d26b9aa7042f993b53c1011b68b122df86c3ab5cb0b8067534ef7f2
MD5 4db4d60db2df598955d42616e898a8ca
SHA1 a262d0b70f6e5f3f2806e43189199e35a4a176b0
SHA512 019358c6fdb637646dad01b400dbd0fb4d6a7cd1478cc0af123781a3d60c3a9429fee355680afa4cc08d0a0aaddfcb24c5eab153d88ee13e9429bfb6adda7686
SSDEEP 1536:3GKxRwcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRL:WcRw3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1C29312B99E1A4AF785BD5791729E780ACE12130E715FA98C716C934D20D81CC2B73E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 3560efcacb66f5bb0fb701da898820e9e39c915ac4e9afd71bb10b312d96ef23
MD5 864684d58aae7dab2132a99aa57ca8e9
SHA1 1d96ab84ecc2019d0775bfe62d1fdbea0accc2bf
SHA512 3793e8c5d60cc2f0ef2e98aed1f203e9a3eb5d873a57c35245116eb5745f29d61355527e42bb4a67d06968a24349ad4db4b85ab180f907054d923108f01bd65a
SSDEEP 1536:3kKxTrcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRL:0cTr3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1519312BA5E1B46F795BD4691729E780ACE12130E715FA9CC3268A39C21C41C92B73E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1a22b510acfcd7b43edc3ade8d2045f0dcb9c54bb85afac987d3580113dde5d1
MD5 7dc6afa47299aba3faba94df72e48ac2
SHA1 9e2edda71bfd036c15272d182cd22b67ae49c219
SHA512 df6200aad85cc36b6fa28bbbf558b7c1fa9c6e72ccc271a22811d8d4bf6421445174086f3d40dc790ed298f5a608717a7183b5257d9f4f8e1ac5451b768cc21e
SSDEEP 1536:4kKxTrcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRL:1cTr3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1139312BA5E1B46F755BD4691729E7C0ACE12130E715FE9CC3268A39C21C41C92B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download