hxxp://img[.]yec[.]tw

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://img.yec.tw
Sample260522-etpljad19r

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238968644910743"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2064	5048	chrome.exe	85
PID 5048 wrote to memory of 3872	5048	chrome.exe	87
PID 5048 wrote to memory of 3872	5048	chrome.exe	87
PID 5048 wrote to memory of 3712	5048	chrome.exe	88
PID 5048 wrote to memory of 3528	5048	chrome.exe	89
PID 5048 wrote to memory of 3528	5048	chrome.exe	89
PID 5048 wrote to memory of 3244	5048	chrome.exe	91
PID 5048 wrote to memory of 4428	5048	chrome.exe	92
PID 5048 wrote to memory of 3244	5048	chrome.exe	91
PID 5048 wrote to memory of 4428	5048	chrome.exe	92
PID 5048 wrote to memory of 2620	5048	chrome.exe	93
PID 5048 wrote to memory of 2620	5048	chrome.exe	93
PID 5048 wrote to memory of 4100	5048	chrome.exe	94
PID 5048 wrote to memory of 5112	5048	chrome.exe	98
PID 5048 wrote to memory of 4144	5048	chrome.exe	99
PID 5048 wrote to memory of 2148	5048	chrome.exe	100
PID 5048 wrote to memory of 2284	5048	chrome.exe	104
PID 5048 wrote to memory of 2284	5048	chrome.exe	104
PID 5048 wrote to memory of 3768	5048	chrome.exe	105
PID 5048 wrote to memory of 3768	5048	chrome.exe	105
PID 5048 wrote to memory of 880	5048	chrome.exe	106
PID 5048 wrote to memory of 880	5048	chrome.exe	106
PID 5048 wrote to memory of 2460	5048	chrome.exe	108
PID 5048 wrote to memory of 2460	5048	chrome.exe	108
PID 5048 wrote to memory of 784	5048	chrome.exe	110
PID 5048 wrote to memory of 784	5048	chrome.exe	110
PID 5048 wrote to memory of 5020	5048	chrome.exe	111
PID 5048 wrote to memory of 5020	5048	chrome.exe	111
PID 5048 wrote to memory of 3168	5048	chrome.exe	112
PID 5048 wrote to memory of 772	5048	chrome.exe	113
PID 5048 wrote to memory of 772	5048	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://img.yec.tw
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbe761c728,0x7ffbe761c734,0x7ffbe761c740
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,1548555513045446817,17213815886601316958,262144 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1596,i,15493385112769890810,15641598527923521427,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,6448239495823386202,1998938529833836225,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,16383510497298171386,3133808297350851637,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,14460574986021250303,286549294898552895,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,10759457672640420966,15500035470095901664,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,10660208851922389425,2933930839979305280,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,18375167654649247261,8996040155544037706,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,2798259756130642902,9116074420468821265,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,10569110267517091654,1134678633211791236,524288 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4960,i,11809284533977501017,15001221599854191975,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3100,i,10506732083032197797,12331519944518665981,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4776,i,10027334284255331721,2987094243577065526,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3196,i,18353661283144982017,3179266925358393028,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4832,i,4989276714628269405,3653177428894354449,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=840,i,212949918387520360,7854521420914414930,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4960,i,10135799992641854185,4469046420721368881,262144 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4468,i,161112198775327147,12105725405274319795,2097152 --field-trial-handle=2004,i,1462391289482053864,17367059532559745599,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0cbd4b59-f630-47a5-add5-f2bec08a504d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0cbd4b59-f630-47a5-add5-f2bec08a504d.tmp
Size 649B
SHA256 9c29e7afc2f436485aef86d57621ab7e73252d0571f978cb3aab1c8741f2652a
MD5 94f8eeb01771bee131aa82472aa56917
SHA1 5b44143912b040b2aa6f60ca55f56e5e66352b2b
SHA512 f38d58331eba8c834b67ce2ee7c33180f4193a008557d89dc3fa7d0487b6c1c60829c1d540e8789b7336bb53fec2acc88b2d30c030f1cf764826816b0c4d2fa2
TLSH
T15CF02DB6C9219C3B0CFD0F1860684B8AFB5113572781854F7B3C920D8FB553B455681C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 67e536a15bff696c1ebe1af6a545f2a9bcbc6b039a930cfec5e2b1cc2d783ba4
MD5 f8623c01aa836955fc2e0afa370c7ea1
SHA1 ab9124d2753c2bb1d2f9a786422dd45bc7531a00
SHA512 536e79002c464e7bfc4f1688a14659b09e280d18371b5c275a7bcc31acbb54a5349cd7157206673dd375a719f5ce4905f154fa35f5a53db78b88b05cf31afb98
TLSH
T1D64199B3C3E88A7D8951A2F4A7192F1FCE690E54532D3C66C8D4AF1F57E2871E20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3032291879b9ed13a263426e01d0033afd01277399826a50ca3f1bed08a6a69e
MD5 2febe977401e27831663f6c8ca727c01
SHA1 975304f07e5be51cec949133660783e8279c6291
SHA512 294366e7710e5481eb68984b2fc11eb7a03644b8438c9481fe094c391950ecfbde6a8a34d811495545012d207657e33574c0a1e59b1cc781886c6b6b77970a2f
TLSH
T123419BB3C3E88A7D8951A2F4A7192F1FCE690E54532D3C66C8D4AF1F57E2871E20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9d8be72ae4315585233a812c2149ab05c67a9ab41d14249564a8b708c9d511f2
MD5 08f7fbbd74a03f6f28b12a4d1128479b
SHA1 b588387a760d16feea2b576fd5c566197ed02822
SHA512 758f36776eb72da8bd7411c5fa6199ed2524a769643908e44d2692f8d380638af5fc769d345c7af7b6fe7d84ebbe2d5ac5cd16359d8b7ad745e3db77b069698e
TLSH
T13D516AB3C3E8867D895156F4AB152F1FCE690E24532D3C66C8D8AF1F57E2871E20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 afc70cd0c32ad821fb5d935d0cdda12a4366a53ca9e3a0c19d5c61512e4df810
MD5 e8794d8dec2b18ecb6b49ba37925da0e
SHA1 ad629f525bf46af65f0ff5cc1860510c4fc4ffc9
SHA512 02ccdd5e4e912e488b9d28e5d2c77807f98d365e63692338a679a3d6c153764b6c44014106a4297b062a8eb3d2c2ef953a294129cef0531c4a2751df70598bf4
SSDEEP 192:cRY98Z5BM7b6cZApuAmtaV9brv7SVpAPRp2979fHDhSfb+WNnLBXH72PeO2OskwY:cRY9gM2tMUXKxUNL2PB2b9e
TLSH
T19A42B56EAE10A53B8CCBC62AFA257753D7F9102675942E88EBFCCA1C15D75CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c342a6595f4c61aad4a1033922d32e91e66e0e9d667a35f12ea7113601d4bc70
MD5 78f3122b5d3aa124725f962f862e8943
SHA1 a12d27d54fcadf48d48efcea2f65460aeaa7179a
SHA512 a3c90573f33baefc4af6385b5eefb330ecefe4364a9871a4b125d3a143ee5b316d138267ad81d88c8f870d37eba00f29b97a5b9e5af5f9e4142c9f67ca7ac0c9
SSDEEP 192:cRY98Z5BM7bUcZApuAmtaV9bAv7SVpAPRp29X9fHDhSPwb+WNnLBX/zdcS2JeO2U:cRY9gMcGMUXix1Nrl2JB2b7E
TLSH
T13452A36EAA10A67B8CCBD62AF9217752D7F5102675942E88EAFCCE1C11E75CC321341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 589a7d38619b0a6ccc435bae833140dc108c445c58525859a3699b26e9342a30
MD5 419f758d26292eee2291412dff9d7b9b
SHA1 bb5c13ac34e6a4889a24a38fa5bc97ec0d616e49
SHA512 8fb04622c8c8adfdba9cd01a180625db63d9dae2abc4d411ca2307aa4d9e401c685932efad5cee4e8be0bb46248bd59f78ff209bcbaf7976839eee3eaa6880f7
SSDEEP 192:cRY98Z5BM7bUcZApuAmtaV9bGv7SVptPRpJ9X9fHDhSP4b+WNnLBX/zdcS2VeO2A:cRY9gMcUM3X3xlNrl2VB2bHE
TLSH
T13352A46EA910A67B8CCBC62AF9217756D7F9102675902E88E7FCCE5C14E75CC321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f16230fa941755d199d12ac0d6b62968e9c8c739449d54c20a00e2dde3d136c
MD5 121265c81befcf9cdf7566a756245028
SHA1 cbeec2e4f1c43e2e7cbcbf5f8f9581a3d32d8c5c
SHA512 6b7270c32f6099cb30c813652d69f714878beea706fd049943d769f53bd92463a1c41c9d6eef1a4582f0c528945f5357a72bcc647a6cc9ed923582991d3ed889
SSDEEP 192:cRY98Z5BM7bUcZApuAmtaV9bpv7SVpAPRp29X9fHDhSPAb+WNnLBX/zdcS2JeO2U:cRY9gMcbMUXixdNrl2JB2b7E
TLSH
T18552A36EAA10A67B8CCBC62AF9217752D7F5102675942E88EAFCCE1C11E75CC321341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 48ce6f045f700285c31b05a13f78f92f7bc4c7b9905ff9069361e7adbb76029e
MD5 a25afb57851238f3cd0113fb3cd0f5ee
SHA1 e56877344319904709f0d37a0815670e1e95a9ab
SHA512 0a72bd1f89ae53ee23a8f065b9c78ed1ac9a3fcf5b19efae3c87c62f6d5189f6ffec92277455c0946d875ab6f14670994c5311a5ae3634fa3f9c8009bfd44040
SSDEEP 192:cRY9gZ5BM7bUcZApuAmtaV9b9v7SVptPRpJ9X9fHDhSP4b+WNnLBX/zdcS2VeO2A:cRY9EMcvM3X3xlNrl2VB2bHE
TLSH
T1EF52A46EA910A67B8CCBC62AF9217756D7F9102675902E88E7FCCB5C14D75CC321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 12c953d824d37f2911dece87103645968222d9440f29f0d4f503a292fc62cc14
MD5 8d40a55c044a409a3488213d4c91c2a9
SHA1 cf6f49fbb3de63cba584e9bd584a420697544d48
SHA512 0f7d83d8ad6d49266f4904431223e6c856416b39fdc32115a3205c68931e62ac858d782bb72c771b682f49270200b3d3a976793f052b5bc6798b7c7c5568d410
SSDEEP 384:Zfjd07KxkXqKf/pUZNCgVLH2Hfgsl/X7pLuLcSjrGXODd8+ErU3HYHGt64PH:Zrd07KxkXqKf/pUZNCgVLH2HfgspX7ps
TLSH
T1D372F8676C4C9E3B4FD4C98CD8267B4FADB5014B25D9C86883FA982503D5BDF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ec5c7634f39e5053c19f3af8ed9173cf9910d66eec42f9ef5e283c9ddf127332
MD5 34e2becf6ffca01936e9e57d6ecd0be4
SHA1 50ddf6f061c7bef33d57f7af1993851475e9e970
SHA512 eb244eee6f17c0257c84139fce11572c03890ffc28701841902a4c7722cc1ba1ce9499679afee9ebccde0524610456c84314bb3dd7e838f6b3261a1792554def
TLSH
T1BCB0120080016201C08302B055539488B2145F20961B170143E46936C825AA1C11D251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588652.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588652.TMP
Size 96B
SHA256 05dd6bc0e5e35cd3b4be590eb2292c728a49f8275ff5184594d22e33693a802e
MD5 1398f41a884d46faf510388945e1820c
SHA1 de2180b37961a46d606cb9eb46e81957570f403b
SHA512 8778393971c4bc34bd5cd7756d9f2e4ab60541a6643cd5b13eed51ef5ce76b0b6422aebd3fee0da413405989e339b69ba36e0b5b9d84e56f65be91ee3dce9ca9
TLSH
T179B00256C1027252D04687B025A6A5FCF561EF35C603121292E12A6ADC296718965172
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1ff77ef2b4da47e47be15f8cd1f0568e1fb2229714944958ed56ccdf062341cc
MD5 9b1fcb084353137630c91324e3ca34fa
SHA1 86b57f11257425ce2bf7acc6c940f56e69879db4
SHA512 dc6110eae1ae301d2f3fea381d91b785c5de0d597e7f8d3a0552fd0c53518897050566c35e53d027b7c3112886a2034053246b1b6d62af1d6f0bbcbd31710561
SSDEEP 3072:RRw3LffUnBKU/F8enCW3iyVEXGey0cB1W:RO3LfqBZqenbyyVEd1cB1W
TLSH
T1A0C31231E4AAFF2B53A5562A750B97191CE148BF48E1B788443C2F18D0C63CCEFA9D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e85fbd6c78eaad610ac48047779b0190fed209ac2d912a7627b639301ac05376
MD5 ddb8de97b32445db47d5a860d6e30a97
SHA1 1d2b8fbb9d6bb1571c4931b32e6022c570575e61
SHA512 5f9f98af6429c922111bd301bdfc4ccced82caa4199a9b6c53c9187f402ae6b574ea41890d49357002297476290640740618dbe920aaeb37e844cb91abff91bb
SSDEEP 1536:Mk8SwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/QW:3w3LffUnBKU/F8enCW3iyVEXGey0cB1W
TLSH
T18CB31231E5A6FF7B6369562A750F93191CE149FB44E1B788443C2F19E0CA388EFA8C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 451a454fb66bc8252d5bc292a7675b5db9ea9877428de5c05491da836cffdb0e
MD5 3dd09a547f6213c0d4122450617d9fa7
SHA1 dae33c8c9e608fe9c555b364a9b81ed0efd1b960
SHA512 3e11ad47942156323b9ec40398d6f2a2d068671890a53cdbdd712637ae0df39545180fa7319e0a3aa0c3f54d09c770930539f8e34310c49aeeccbd6798d733b7
SSDEEP 3072:HRw3LffUnBKU/F8enCW3iyVEXGey0cB1W:HO3LfqBZqenbyyVEd1cB1W
TLSH
T1D2C31231E4A6FF6B53A5573BB50B931A1CE149FB84E1A788443C2F19D0CA388EF99D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ebaae00feab2ab40a57488744fbac10300373385e18a0ff06d34dc2e9e6e1dc6
MD5 abed2101de936df1314f022a6d8abab3
SHA1 55f6c69db3ec3bec63ab5e605064a8e40cb72b73
SHA512 78080f80f708185623f209d7f88482f50d0e21f81d6056d4349f7b2f1b4176587c78b367413706a18c4cca947dd45d42d1b85cd429a1f1da4f58940270b2da2d
SSDEEP 3072:CRw3LffUnBKU/F8enCW3iyVEXGey0cB1W:CO3LfqBZqenbyyVEd1cB1W
TLSH
T1F4C31231E4A6FF6B53A5573BB50B931A1CE149FB84E1A788443C2F19D0CA288EF99D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download