hxxp://links[.]notifications[.]fileforms[.]com/ls/click?upn=u001[.]FllkJtf8wKSGa6RAZAEOBFvI5Z6lSQIqSPeNP-2BdyjGbFKicJDlrwNSpFU0shPsOvaW6V_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qAOBGUXLG6HXDXAg2hQI9ItmkEFSkVIyqSUA-2FRTHWStGFwJhfAC1IvKE-2FDlBcFcih8nbiXFSuAHh5pyYxN7RH-2Bwla2MWifitWiknq4IzO3pda7XwDIkNBPKIGDxwb43DrhRhipp4RSu5OPeKjrGN5pfGVWedqMrL6qpOAaAD6Lab6qCp4ERfBYVSr5AG-2BX3M3UYPnP6pLXGjoqoKUrbLkYBsQq5uFj2ar-2Fh2QZ7aRShg-3D

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://links.notifications.fileforms.com/ls/click?upn=u001.FllkJtf8wKSGa6RAZAEOBFvI5Z6lSQIqSPeNP-2BdyjGbFKicJDlrwNSpFU0shPsOvaW6V_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qAOBGUXLG6HXDXAg2hQI9ItmkEFSkVIyqSUA-2FRTHWStGFwJhfAC1IvKE-2FDlBcFcih8nbiXFSuAHh5pyYxN7RH-2Bwla2MWifitWiknq4IzO3pda7XwDIkNBPKIGDxwb43DrhRhipp4RSu5OPeKjrGN5pfGVWedqMrL6qpOAaAD6Lab6qCp4ERfBYVSr5AG-2BX3M3UYPnP6pLXGjoqoKUrbLkYBsQq5uFj2ar-2Fh2QZ7aRShg-3D
Sample260622-psdsract31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266053372714951"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
1532	chrome.exe
1532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1792	4088	chrome.exe	86
PID 4088 wrote to memory of 1568	4088	chrome.exe	87
PID 4088 wrote to memory of 1568	4088	chrome.exe	87
PID 4088 wrote to memory of 4972	4088	chrome.exe	88
PID 4088 wrote to memory of 2660	4088	chrome.exe	89
PID 4088 wrote to memory of 2660	4088	chrome.exe	89
PID 4088 wrote to memory of 3868	4088	chrome.exe	90
PID 4088 wrote to memory of 3648	4088	chrome.exe	92
PID 4088 wrote to memory of 3868	4088	chrome.exe	90
PID 4088 wrote to memory of 3648	4088	chrome.exe	92
PID 4088 wrote to memory of 3828	4088	chrome.exe	93
PID 4088 wrote to memory of 3828	4088	chrome.exe	93
PID 4088 wrote to memory of 228	4088	chrome.exe	97
PID 4088 wrote to memory of 228	4088	chrome.exe	97
PID 4088 wrote to memory of 2376	4088	chrome.exe	99
PID 4088 wrote to memory of 2376	4088	chrome.exe	99
PID 4088 wrote to memory of 4352	4088	chrome.exe	100
PID 4088 wrote to memory of 4352	4088	chrome.exe	100
PID 4088 wrote to memory of 4116	4088	chrome.exe	101
PID 4088 wrote to memory of 4116	4088	chrome.exe	101
PID 4088 wrote to memory of 2568	4088	chrome.exe	102
PID 4088 wrote to memory of 2568	4088	chrome.exe	102
PID 4088 wrote to memory of 2128	4088	chrome.exe	111
PID 4088 wrote to memory of 2128	4088	chrome.exe	111
PID 4088 wrote to memory of 4700	4088	chrome.exe	112
PID 4088 wrote to memory of 3716	4088	chrome.exe	115
PID 4088 wrote to memory of 4004	4088	chrome.exe	116
PID 4088 wrote to memory of 1320	4088	chrome.exe	117
PID 4088 wrote to memory of 1532	4088	chrome.exe	119
PID 4088 wrote to memory of 2604	4088	chrome.exe	120
PID 4088 wrote to memory of 2604	4088	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.notifications.fileforms.com/ls/click?upn=u001.FllkJtf8wKSGa6RAZAEOBFvI5Z6lSQIqSPeNP-2BdyjGbFKicJDlrwNSpFU0shPsOvaW6V_NSg3tvTOBDqXx-2BFoA4j4y-2BxyzryeGuxZ7halBpRHsjP-2FLyfKPX5qmSTznFSPXc2qAOBGUXLG6HXDXAg2hQI9ItmkEFSkVIyqSUA-2FRTHWStGFwJhfAC1IvKE-2FDlBcFcih8nbiXFSuAHh5pyYxN7RH-2Bwla2MWifitWiknq4IzO3pda7XwDIkNBPKIGDxwb43DrhRhipp4RSu5OPeKjrGN5pfGVWedqMrL6qpOAaAD6Lab6qCp4ERfBYVSr5AG-2BX3M3UYPnP6pLXGjoqoKUrbLkYBsQq5uFj2ar-2Fh2QZ7aRShg-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8dc97c728,0x7ff8dc97c734,0x7ff8dc97c740
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,9742018902181336456,2433376239815005526,262144 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,2120876704449513084,12135099548874607120,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,4926689129695128936,1276608162463983743,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,7851462071477063000,6597821070691246562,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,16900236748673285608,10646718514662317448,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,16315083901514597346,7662337426306693557,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,4006981748865729097,6889211638566970661,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3180,i,9719194104411838197,5865341369321190342,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4984,i,18339456764228457317,3409081286399857205,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,2688037112797562660,10700775573026834627,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,13603688460962368236,2234280628256252719,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4724,i,14865090451374197911,16760876709858377891,2097152 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,6796178760155067615,7360246361524155032,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,1008732321063937920,18043719331604945850,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6888,i,10324426640915959708,10233926500174788490,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2772,i,18211702132308249963,4069563702320375174,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=208,i,7335228331482108347,1633116086171472191,262144 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3152,i,4892162512220794408,1427347504240493194,524288 --field-trial-handle=1792,i,12752075524473213849,14699075244687291646,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 15f9a28ba55de4e0ecb288fd21c15438a7a13fea660f81649152653617cde318
MD5 d7c722d495f68c92e0d1189f593c1388
SHA1 bd07cb4abca942034e2d2d2dc9f65f0137a42432
SHA512 3fd64e20cd9d227e6a52396f8c3271a82b80dd3a2eaa9658000e950b2d5b8702090ea99a2fa1e3282e17bce942822bc90a0bd6be25dd905122a20bd771a3c1de
TLSH
T1F6E02BAAC821AC2708FD871961140646E751135B2F90660F3A3D9208CFB0A2A55C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 95facf63923302fed6c5b4c64ffb0708e61b6c64637f07ef642fae5f536f559f
MD5 3f35f03f12568667f5e7f636a54945b2
SHA1 b57c665713773316fdf4382b115fce9dfbdfb379
SHA512 d71994d382be5cdbe6904bd4451347494876eef09759690d95b43502ec6723b96c8027d0352b010938a8f7c28c55098ce7dc88df841f2fbaaf987382c1af0c1f
TLSH
T18301D1A344CC0A58DBC21D3D5AF7A9C0337277C45443BF5B81C68478E542BDA76CC614
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 62a1759307973029a4c14a4a178129d42bb51d107c26e2b4db92370134d5b251
MD5 b9a6fb55c27b1e181a1c63189e21dc6b
SHA1 84284cbc7a0833b33bd4fbb7b60895487d0c521a
SHA512 d84aefbbcf361d781e51c520a17eee6370c15b3aff3a968a55b39e48c4029c504d9869fae3a2aba95e34930ce1a19195eed8763527bf81f65e4721a99babd63b
SSDEEP 384:D4e0Ss0eftO/B8aaIEdMonp22uyb6OV+ORG1rhV8yVqS37F+txcY9/G/dxBZqaDT:PiwKO
TLSH
T135429CBBDBE48A2D9C1165F4AB146E1BCE2D0626471C3C26C8D4AF4793E34B3F20564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 362786b4cb413919234eea294e63c3b5aac55db8caa14c8084cfcfd9bf460b99
MD5 fe28d1b5885dfad478a51182fa15e86f
SHA1 307b70424376e45ad93fadaba363ca73a76cb28b
SHA512 225af746c2a7e686d9a575d05478255c4d60b4f550d2d3afd93a89f9ebb638c95965c3dde5470986857ed3c190f5fd41f5ec297fa4bbb9fb4499250c60884124
SSDEEP 192:D4e0Ss0eftO/ZaaIEdMonp22uyb6OV+ORGD6rhV8yVqS37F+txcY9/G/dxBSeqaz:D4e0Ss0eftO/ZaaIEdMonp22uyb6OV+8
TLSH
T1ED329BBBDBE48A6D9C1165F4AB146E1BCE2D0626471C3C2688D4AF0793E34B3F24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6938a0e3b4f74c71fe31cff6b20fb8611a512da8af56c01133d6cdd953ab7f68
MD5 270ee6d105bf52af240dcc0c379c6c32
SHA1 129aa41fff67731a4ac937786004afccfc589141
SHA512 69ca051a33cf0dcdf5a56d353392a039daa3cbccd5a6ff2f644405689eb04b64ec9eaf328741f45d8e9c53c0c963483a0441dbf7948a1a5b72c6895626d4f7d1
SSDEEP 192:KRw3/Yq+SMDZZv7spAPRp22BS9wHVbb+WNnib+uk2SjGkwhfVyIsnAUge:KRw3/CDZ5YUX/wK7OQ2cGve
TLSH
T12942E82EF915293B5CCBC229FA227B57D7F6106172D41E84E6FC8A1C14EB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1f0a140c5f6abd1bca4e6ffb5d1282cd0b143b7c40cb6a32a20615dcbce2e557
MD5 d3bda460599db6a52d6375da4ac999ef
SHA1 f4208e2254075d5715f38dc1310415eb9007eb62
SHA512 e77965f0414642439e0fcd779318afc44dab2b44a9374c553203da14b7114da99596f64fb1ce8bbab88cfe608cb4c5ce99d3c6ac2cf76a4857cdda02c68ab560
TLSH
T19BB0128094059105C04206F8175258C87114AF20D70A174153E4696688355908114050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586d2c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586d2c.TMP
Size 96B
SHA256 614c1349986184b883c0e03b73b676a791b1ca4182d8c6ac153f10bf7f9b5d50
MD5 f619ddcf02663346d95a54c45f042c28
SHA1 609af83cbb4636830061892b07907294d2713652
SHA512 678486c19523d5abc7659986a6c83836a0eaf8a89c86948a1322534f5a22073d5faf5b25e8a729c349e7354ab7dc2bc345d3a961d2a3942ab9df04081f540ee6
TLSH
T137B02200E2222A02C00303B038A080C8B0A0CF32C20302038AE00A33CC202200C28A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c4e06fd885aa275985a04bf01cc8a6df2bbef590ae84fa3fd780f56ee7570680
MD5 893d1b7ae3913cfa6c6c002ac8ac61f6
SHA1 12ad29084b8a97f8024b00ebe5727db8fb769c11
SHA512 cccb23a5b15fd1d95793e7e8fe5353d54b259585a328363c7e28043409bc3792f7c146d39c8c335b925f9c932c93313767612227c7f17061c50ba146dc1c9603
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:km7Rkm1tYpBeh2BAoK
TLSH
T185C3123B5D75A83759B9BB1EB08E0A1F1EF249A6D920DE82C8D85E0433F97CD0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 044d7f3fce325fc88bc71239b823dc8d7afa8ab0e525aa3aa6c2ab226486cb7c
MD5 2ff0dfd464c73d1cc3adc08a04ebc84e
SHA1 4dcab03150ef893c4260d8d06dd146fe9034fe83
SHA512 38d10e1128f228d90c964363d2dd6c5c676fb277674df513c9782abc650e070a0e17de46ad9e78796dd5af8dc5ca770799f9d747c7d9803d76c66860f4983c24
SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:lm7Rkm1tYpBeh2BAoK
TLSH
T1EEC3123B5D65E83759B9BB1EB08E0A1F1EF249A6C920DD92C8D85F0433E97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 cdc434edbd16ff55510b3174106db92cd9992c0a617785e2ade2862ef7fbdc3d
MD5 769248ded33e7e386cf0769b841ef818
SHA1 33b26d80715e5394f99d781deb7b41400c6f5aaa
SHA512 c193588253c217fea0b60b257cdbceee4e16eb41d968cc3c4f1046201488878ce5ffac89c3333c26e756ee1cb17a7119c2013c463699c25b81a436a8307168fa
SSDEEP 3072:pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Im7Rkm1tYpBeh2BAoK
TLSH
T1A4C3123B9D75A83799B9BB1EB08E0A1F1EF249A6C920DD42C8D85E0433F96CD0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 08608e35c0ef64cac8544f4134a716d8279a40947480eee667f6a735cd99c915
MD5 3299c1e928b100dbf172cb3be42ff4b4
SHA1 f108e8b9ad63db96d9d2554607033abd320ff9e2
SHA512 302020a9ba76680256623e8bf0079c0930f5cbfc093d2c3d669ee37e9cc05130e84428891f79019ef8ceaa89c9643ff7c30a092d5ea4148b2d8e2f696e2534b3
SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Dm7Rkm1tYpBeh2BAoK
TLSH
T14FC3123B5D65E9779979A70EB08E0B1F1EF149A2D920DE92C8D86B0437F97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 aac565ded63e56cfcba68e49b96e7e3139704f46798b706be44bbf389829887a
MD5 68d267c7b5f79d58a1b1213eb016f740
SHA1 b4276a9f0b5575c01eb7b3007d450d75efe98189
SHA512 2d9a7dee0454e086d6b5eec86b451bd76dc67cb8ebebcb91356568fbf66a04176de2894a08a647400255665ff689063b23b1e5858833c8c4e8dcea53efb2b7a0
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Em7Rkm1tYpBeh2BAoK
TLSH
T1CEC3123B5D65E83759B5BB1EB08E0A1F1EF249A6D920DE92C8D85F0433E97CD0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download