Analysis
- user interaction
yes - max time kernel
525s - max time network
526s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/05/2026, 12:21
General
- Target file.html
- Size 326KB
- Sample260527-pjdrdsdv2n
- SHA256 183de0bac100be3e3600b5e22563228fb680784ed2f77f1901430fe7f343d5e4
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 59 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ba2c728,0x7ffa7ba2c734,0x7ffa7ba2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,3943307843999092874,15578399648449298016,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,11866679299864851292,270084263563006160,262144 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,16550609585054612292,13306525420638869208,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13468909543811998019,15855995425924860566,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,1384448240627703877,6715537446780941617,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,6771104228819816619,17465710951145851183,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,2645061065082097774,1225496598518184112,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,13564405523858758717,237476963428612400,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,4125844157697933160,450732801511768677,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5888,i,778630121395932143,11562505664996007677,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,7335422360489311627,9218057492403837463,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5828,i,15125707353922097900,15318821142943928429,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5904,i,8164017624404378215,9389204152554634144,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5884,i,17906606862816012292,3824991158239157705,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3400,i,2518911874224072667,4205567741730490147,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,8812598275501094535,8672412107624735813,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,10245837781992914427,10743028825824907413,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,5601208649236362868,14937352978273075950,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6668 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6768,i,2337783723065079452,8142128206949815424,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6788,i,11882473433184408365,2898746143292402853,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5976,i,18333919435912533987,13023884161711260225,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6944,i,11510813550680596962,5512230495507730685,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7020,i,16629465829851739597,11637975904031194974,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6628,i,12957899986331247475,3066866481399675876,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6908,i,2868629533061761822,5735995464049209638,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6780 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,13493327142694288811,4323971993110232164,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6880 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5896,i,7231359926872899136,6993892346215874993,262144 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,15737156778562592798,273082946921292221,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6768 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,1526760149364502831,10879354054391303671,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:142⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,1277088300887563395,12049727342602367821,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6448 /prefetch:142⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4944,i,13352597517558183861,11417153004626399090,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5560,i,14707586202894306544,12754949685477125182,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6728,i,15525396455322721621,2290693331990040993,2097152 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3060,i,7553124602812875836,4497268127128416030,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:142⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3336,i,7092561649522506700,14453262319918284117,524288 --field-trial-handle=2008,i,1250205325750192465,8086126440861954992,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RoLarpV4 Tool\RoLarpV4\content.txt1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000022
f_000023
f_000024
f_000036
f_000064
temp-index
the-real-index
the-real-index
the-real-index
000004.log
000005.ldb
CURRENT
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe588c7c.TMP
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
default.dic
key-screen.css
key-screen.js
RoLarpV4 Larp Tool.zip:Zone.Identifier