hxxp://Google[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample260511-a5f2bab17r

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
158	5628	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229340704105456"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
3200	chrome.exe
3200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2916	2396	chrome.exe	84
PID 2396 wrote to memory of 5808	2396	chrome.exe	85
PID 2396 wrote to memory of 5628	2396	chrome.exe	86
PID 2396 wrote to memory of 5808	2396	chrome.exe	85
PID 2396 wrote to memory of 4584	2396	chrome.exe	87
PID 2396 wrote to memory of 4584	2396	chrome.exe	87
PID 2396 wrote to memory of 3220	2396	chrome.exe	88
PID 2396 wrote to memory of 3220	2396	chrome.exe	88
PID 2396 wrote to memory of 3488	2396	chrome.exe	89
PID 2396 wrote to memory of 3488	2396	chrome.exe	89
PID 2396 wrote to memory of 3060	2396	chrome.exe	90
PID 2396 wrote to memory of 3060	2396	chrome.exe	90
PID 2396 wrote to memory of 4604	2396	chrome.exe	92
PID 2396 wrote to memory of 4604	2396	chrome.exe	92
PID 2396 wrote to memory of 2180	2396	chrome.exe	93
PID 2396 wrote to memory of 2608	2396	chrome.exe	97
PID 2396 wrote to memory of 2608	2396	chrome.exe	97
PID 2396 wrote to memory of 2532	2396	chrome.exe	98
PID 2396 wrote to memory of 2532	2396	chrome.exe	98
PID 2396 wrote to memory of 5872	2396	chrome.exe	102
PID 2396 wrote to memory of 1780	2396	chrome.exe	103
PID 2396 wrote to memory of 1328	2396	chrome.exe	104
PID 2396 wrote to memory of 5624	2396	chrome.exe	111
PID 2396 wrote to memory of 5624	2396	chrome.exe	111
PID 2396 wrote to memory of 5412	2396	chrome.exe	112
PID 2396 wrote to memory of 5412	2396	chrome.exe	112
PID 2396 wrote to memory of 6056	2396	chrome.exe	113
PID 2396 wrote to memory of 6056	2396	chrome.exe	113
PID 2396 wrote to memory of 4636	2396	chrome.exe	114
PID 2396 wrote to memory of 4636	2396	chrome.exe	114
PID 2396 wrote to memory of 4580	2396	chrome.exe	115
PID 2396 wrote to memory of 4580	2396	chrome.exe	115
PID 2396 wrote to memory of 3332	2396	chrome.exe	116
PID 2396 wrote to memory of 3332	2396	chrome.exe	116
PID 2396 wrote to memory of 4492	2396	chrome.exe	117
PID 2396 wrote to memory of 4492	2396	chrome.exe	117
PID 2396 wrote to memory of 3476	2396	chrome.exe	118
PID 2396 wrote to memory of 3476	2396	chrome.exe	118
PID 2396 wrote to memory of 5472	2396	chrome.exe	119
PID 2396 wrote to memory of 5472	2396	chrome.exe	119
PID 2396 wrote to memory of 3200	2396	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdb11ddcf8,0x7ffdb11ddd04,0x7ffdb11ddd10
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1548,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2860,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2868,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2896 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4188,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4168,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5140,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5400,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5540,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5404,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3808,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=2888,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=2872,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3308,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4604,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5568,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4692,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3284,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5920,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5756,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5464,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5752,i,11146361636815020070,10481239928894024766,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cbf90e38f6b3ddf782370372005f3104fd8c2400c0c7f6a4b9154afbd02b9efb
MD5 018511508e750669f157d8d428790b8b
SHA1 0b68cf96cd9c28b143248a17e0997fcedd28e494
SHA512 878cb27493ce1c3e29a834919d970c38c292b7b38eb6f314706725fa3c001ac5b931f93a5b2cc413d5ebf3f77ac4aa50b3f6cc92ec4f214c0bb54fa09c1518b8
TLSH
T17FE0EDAAC861982B1AFD076964540A89EB80035A2B80895E363C92088FF4A3B9686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 865781e61c509d10265c068557635c14484660c340898cc6faebdeabdb2ff265
MD5 0f71f9812605ee0c18f258c6073898be
SHA1 e06d2ebde4667e4f20bb618a1a6861c479a46491
SHA512 e9649a86561af68c750d445ca7b555238bfafada113e0dfd9402b2d9928c1f57ad4574ed7a5a5fbff5edad449a5e17c160389569cda87a07209e37843bfdc44c
TLSH
T192E0A70028511512CB515F39037C8CA33F311E6D9142E3E316F056BC64E36783D1A5E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d1ad6d3add6019b8578bbd65926f4648eec71e901bba17abf1a6907656450b6e
MD5 8af50fa8553515d1d2e400e5044b96be
SHA1 544e55b4a90fd7c7d58bcf53afa6781b8e57eb47
SHA512 ef6955907c26f3d36a5226abbd2bc2b4e9fccf079827fd48eb3f9f859c700890e013b97521f64e8c23012b53e6b3e456cf5194223794d98df67ab11e8912521c
TLSH
T1E831668605D31526CF61793903CCBC53EB28456B61C15F4B50B0B82E49B3FEA2B856A7
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7563746098cca6862b00f3808bc6b0503288a37609be8e5fe5da42c1fdff20b1
MD5 0004e0c55ff887a6c3b418dd6d4161ce
SHA1 da063d3116ef5ed8b2694eb3bdd1296e195910d6
SHA512 78cc49b4713bd0573f4586ff6130613e93cbc6834f3478012dec19cf1f28729ee4de07214f78933f7ea9a2dcafee6575fbb2c1427dda695cb14332cfd76346f2
SSDEEP 48:YALl9s9J95I9I2u2HuzYfc7vszHs9gCzsqhsJrIszuzsE1Vs95sg7sW8skusNxYW:DuP/ICZOuc2eYxirDw2XnIveW
TLSH
T1FD919BF7C3D8866D894156F86B25AE1FCE2D0A14431C3D66C8C8AF4B93E5872D22179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 12a4c139d1a105dc6e227fdb61f6bd947a80416589865dc0ba54c84fb0a8b47a
MD5 57fb54b56bd5c18193559f6a750ba683
SHA1 4f093f0fc40335c7c95ed47f83c39d3aa298caf2
SHA512 f6e8fe2058981e429c5d47af94cf03a9ad50ea3b7245c5e0e8f43e4326b4279d00801b53def3b093cf5f7b321d493e8f49026ec65765d9eebf70df9c8a953d25
SSDEEP 192:DuPgCZGXuc2wIyTMi/bIGXo+EOoKJxHMmLMZECQ:DuPgCZGXuc2wIyTMi/bIGXo+EOoKJxHB
TLSH
T198E1A9F7C3E4856D894156F86B25AE1FCE2D4A24432C3D66C8C8AF4B93E5872D31178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 795241d6743d8199829996845363c9a82e79c6ee9b3a63ddad12b561533f8462
MD5 1c25029a36fcc4bc72917357d398fead
SHA1 ed46abde253330d4bb44405181fff40c66e01f7f
SHA512 8fcf764f5996143952bc7c52e45ffb62b9ef8f78e5a6a5d0ddd3d2289a841e813a42e73a74a431cc73d99d8069860cd89e6199b8a4297f45afa1d2d2e9123bba
SSDEEP 192:GYccBhc22Jx3nZ8PRp7OieaNHIE+WNAOUKBVTeiDUNkwLzpQyIsnA/g2:GYcmhclxMXp9VVneHRZ2
TLSH
T1D742E65AB9142A7B4CC7C22AFA11BB56D7F5202161942EC4FEFC8B1C24DBADC2127947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cfa8952517067a5a5248e42454ec767a0bc7ee216587ba1297ecedec6807a70c
MD5 e7b6e58e762a8fb640b5d86d117f2175
SHA1 9c74dbc49c2150808af4b8b48d21604af69ee3fb
SHA512 8e42cf75514dadb2d26f211d47fd63ba03987c54c2e4b49aedb15d4c5d8f049e9a4754925ad9b8d4d7803c7586b74e5013529e1507d00f0af52970e7bdca679a
SSDEEP 192:GYccBhW22Jx3oZ8PRp7Oie3gNHIE+WNxgUK/EVLQRnYizUNkwLzpQyIsnA/g2:GYcmhWlxZXD9V8/2SYXRZ2
TLSH
T11742F75ABD141A7B4CC7C22AF911BB5AD7F5202161942EC4FEFC8B1C24D7ADD2223947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f549821412eb027ea8f5d45db321b30cbe7080e56b47c0e1df05243f7867e007
MD5 0d8315d58844c8550f4d3ea37c9ae9c1
SHA1 298b84ed3d08c230367f5591eb66061086141858
SHA512 88e639b9c80911e3ab1ad34d42e23aad191f842130211a744f6ccebe07671e00f73dc498fd3b693f32302dfb30c07ee97239ac30beea08a53158da8920c66a8e
SSDEEP 192:tYTc22Jx3IZ8PRp76sNHS+WNAOnk4Er+ixUNkwxzpQyIsnA/g2:tYTclxZXB9ccj+ZzZ2
TLSH
T11532F75ABD14697B4CC7D72AFA11BB56D7F5202121942E88EEFCCA1C24DB6DC122780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7b585488e58701a05be707cfbd258169d69fc744dfd8c8ff18a8aa6903b96439
MD5 4deea49edbe2aae06f17abee837876e6
SHA1 d6bf044280b0e4c6b8cd719a021aeaddfe6aaad6
SHA512 68c7b8d98faa173d2a28f525548a77696da7976f30aa4c57a65ed673faf24b26a773742b3ce65c33c9a625208897eafcc6d52674a20d82fdc49f370a77bb19ae
SSDEEP 192:tY8c22Jx3IZ8PRp76sNHS+WN4nk4Er+i6UNkwvzpQyIsnA/g4:tY8clxZXB9cLj+IdZ4
TLSH
T15A32F65EBD14697B4CC7D72AFE21BB56D7F5102121942E88EEFC8A1C24DB6DC122780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a2770944329c5498a5e04cdb260360735f5e546a2d74af6f746f203d16764be1
MD5 e0288b6d098069240009f11cafa23ad4
SHA1 d77ed21eb38e8fabdc877b8cf01b1311daad8484
SHA512 b2d7c524729d77689f86253c1cf7543196730b17aefee8b57ad8eb93f0de0be192c07bac3b30b042cc487e1e7de8b6dd4930e1e30c31666ea5ecdf9bbb0876ca
SSDEEP 192:GY8c22Jx3iZ8PRp7SiesNHIE+WNAOUKBEr+iSUNkwLzpQyIsnA/g2:GY8clxLXP9VVu+qRZ2
TLSH
T13B42F71ABD241A7B4CC7C32AFA11BB56D7F5202121902EC4FEFC8A1C24DBADC2127907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2c4a07439c3cdbd0d1610339724883cba3e1d9f6f7a2ff784e847f73a32029e9
MD5 24a692ae74a54b32a180a3375100a683
SHA1 6e76e1b5d9e1a607f525b11bf9050c6ac178dfbd
SHA512 470c1f0e1be35bb396ccf5d9494f7312c383179ccd7574b4e68ed582e6cf56a66fd996687c53b9e064c16868a4f5a5beafe786b53b8da914a7b052e8efd286cc
SSDEEP 384:J5zA7pLuLceiBYXWnPkXqKf/pUZNCgVLH2Hf1NwrUo7HGGctDAnqwVHL:JRA7pLuL7siWnPkXqKf/pUZNCgVLH2HK
TLSH
T19472E8677C4C9A770F94D9CCD9267F4FACF6024B65ED886443FA982503D4EDA010A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 56aeedd5cdc315c4e521c48085d5f03910a9136fa6f08dd8a1cc2c9b78a68ad6
MD5 4e023cb4693f93a68ecc2937e752f489
SHA1 233950575cfbbf68240a50928d995473ef2bba53
SHA512 9d7232cb028bcbd390b6c84181954ee2fde73c3150bcbab4ceaa4f16ab828afcaf3c35e1a79e6c6bf83334a1cbdbbfdf6fa0155e733eaabfc1e59fd134c0b89f
TLSH
T113A0021D11991221C8090A71144E554023605E11652147099491D8EACC911F192C3589
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57a7f8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a7f8.TMP
Size 48B
SHA256 5b384a886228429612ed8b8860847fb2eb917f7a7f5171e7080559fe65ce6a6c
MD5 cc83b575202becffef74af8ec4433c14
SHA1 22a631a138cb70c2ef3488bcfb14c892fb2bc86f
SHA512 fbd19e373f7e87755b9247328fd5856688b761258387339b1f4b1e9e2013568a560fa36c62032befd3aa508b905168b064b05bd81a60a707cbc163955f776437
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ee9929f3fed9bec9961c5de158ea8bcd59551df9e2ede7cb80f431532c4b18f4
MD5 9a573e3d09fa66577ede0c99eee2231b
SHA1 aedd13c518cc3d213a463d006f214f5f39e8f848
SHA512 27f8f0e9ffd4e8370134ac8c39ea31e43615df1162f183d77771d7fd61d24fa3737eb47c845222fe2a91393498f4ee4a285796747fa30a5e195e83d323851d0e
TLSH
T121A0021002D30C7AD81017B3509E42407332ED16214A8B1370EF4144CD7329DB25D842
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 e224e51b0bdd4ed4beda9732663ac3472b4b7610acc0ab09b0a5399f5caa56b8
MD5 3d7c895ab376e84e091c92a5ae617148
SHA1 cd8223bf57ba96bd0f89c8468b048cbb4f7cb2ad
SHA512 620eac09c3f7573185e879d6cf04232e4a696514486ca8dadd8758f4dcb00449a5816a11727b6040d421055cfbff1950f3827afd670a7ee5ade2d211d00c7e11
SSDEEP 1536:hSIIwdXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:ywdXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T19B830233A8DE3B9713A56164901B3F930D9401F725C70AE096793EE6279B8EC477262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 1e1a2e876586a00989f03bba6df6e755138446f0356bf2e8e25ec242f6d47d52
MD5 906512324268cc656349bb3c45807129
SHA1 60e4e303b21bc575c94d42067a1f6c357d5b2641
SHA512 ac601fa817079d9837541f2f4864673bc999ac24bc29585aefb20a48e38c8afa49b7a69ec500b35e1a776e7a17baa90e6cb37d5085e0bbfe29e3a5ea2474468a
SSDEEP 1536:6SISeAXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:9eAXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T114830233A8DE2F9353A55164801B3E930DD405F725C70AE09A793EE6369B8EC476262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 57ec1a55cbe4c1d987388da8e87d47a70911b2e746cead5f7c02fd0212071ba1
MD5 aab1a31270ae5cd78f9ce8cca10d8289
SHA1 7c42182e9c86076d99b7de5ed415960e88b49485
SHA512 16554afcbbcf7c044e3955878e1d4dd7d86678a0d53ea5697b0fdbf9b105cd643ce81700e0e8d2f77a585f1c880001aa564d0d2d9732da5882e00887e47fd3dc
SSDEEP 1536:hSIFwdXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:3wdXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T1C6830233A8DE3B9713A56164901B3F930D9401F725C70AE096793EE6279B8EC477262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 e3d944b2890aee3082309bd89fcade48d5df5303bb176f25d4bed1d33b0a70f3
MD5 a98f8d0218087b5cbdbb6f7bc406f821
SHA1 d3f4dbbbe7a9c20ddd9690bd880dbe5a91423df6
SHA512 929111449ce1f39476b29bc4df36a73b70c09a919da576070da3cf9b263a444e65688d87ca023eb7b1ca6d8563839af1ae49fb8cbca05d773e88ff0d0610ba7c
SSDEEP 1536:bSyqXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:VqXjM4rTmN5eWvStRNoV8cWK7XF+TwM1
TLSH
T1E1830233A4DE2BD713645164841B3F934ED505F725C30AE09A793EE6279B8DC0B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 edbe394feed2c92610ca3a7262d7f46b34d19c364ebe6eab034446ee29873b45
MD5 7eba023a3645e0163cc679340b1a8211
SHA1 3ce7b5c271e2424a5891c325aedd60d468fe55bb
SHA512 9a89c9679b348a249026a170e25598087fbeea97a6b7182d9a6895abaa11a483f71a2c197c6e95b8b5f315158ead7b106f26cb4a0c14d8683b4bd2335f63c0d9
SSDEEP 1536:6SIIwdXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:3wdXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T1A0830232A8DE3B9713A56164901B3F930D9401F725C70AE096793FE6279B8EC477262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 40748.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 40748.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download