hxxps://drive[.]google[.]com/file/d/18Ga4l0hsPPPo_WpkWNzy0f_1iNBPgVlL/view?usp=drivesdk

Analysis

user interaction
yes
max time kernel
68s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/18Ga4l0hsPPPo_WpkWNzy0f_1iNBPgVlL/view?usp=drivesdk
Sample260625-fdp3sshv5p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
7	drive.google.com
8	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3824	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268363551606749"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe
2660	OpenWith.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 5092	2120	chrome.exe	86
PID 2120 wrote to memory of 3824	2120	chrome.exe	87
PID 2120 wrote to memory of 3552	2120	chrome.exe	88
PID 2120 wrote to memory of 3552	2120	chrome.exe	88
PID 2120 wrote to memory of 4980	2120	chrome.exe	89
PID 2120 wrote to memory of 4980	2120	chrome.exe	89
PID 2120 wrote to memory of 2388	2120	chrome.exe	90
PID 2120 wrote to memory of 2388	2120	chrome.exe	90
PID 2120 wrote to memory of 3200	2120	chrome.exe	91
PID 2120 wrote to memory of 3200	2120	chrome.exe	91
PID 2120 wrote to memory of 3688	2120	chrome.exe	92
PID 2120 wrote to memory of 3688	2120	chrome.exe	92
PID 2120 wrote to memory of 1452	2120	chrome.exe	101
PID 2120 wrote to memory of 516	2120	chrome.exe	107
PID 2120 wrote to memory of 516	2120	chrome.exe	107
PID 2120 wrote to memory of 1704	2120	chrome.exe	108
PID 2120 wrote to memory of 1704	2120	chrome.exe	108
PID 2660 wrote to memory of 2052	2660	OpenWith.exe	112
PID 2052 wrote to memory of 2884	2052	chrome.exe	114
PID 2120 wrote to memory of 1080	2120	chrome.exe	115
PID 2120 wrote to memory of 4256	2120	chrome.exe	116
PID 2120 wrote to memory of 4620	2120	chrome.exe	117
PID 2120 wrote to memory of 408	2120	chrome.exe	118
PID 2120 wrote to memory of 408	2120	chrome.exe	118
PID 2120 wrote to memory of 1932	2120	chrome.exe	119
PID 2120 wrote to memory of 1932	2120	chrome.exe	119
PID 2120 wrote to memory of 3472	2120	chrome.exe	120
PID 2120 wrote to memory of 3472	2120	chrome.exe	120
PID 2120 wrote to memory of 3516	2120	chrome.exe	121
PID 2120 wrote to memory of 3516	2120	chrome.exe	121
PID 2120 wrote to memory of 1564	2120	chrome.exe	123
PID 2120 wrote to memory of 1564	2120	chrome.exe	123
PID 2120 wrote to memory of 2492	2120	chrome.exe	124
PID 2120 wrote to memory of 2492	2120	chrome.exe	124
PID 2120 wrote to memory of 4120	2120	chrome.exe	125
PID 2120 wrote to memory of 4120	2120	chrome.exe	125
PID 2120 wrote to memory of 1792	2120	chrome.exe	126
PID 2120 wrote to memory of 1792	2120	chrome.exe	126
PID 2120 wrote to memory of 4416	2120	chrome.exe	127
PID 2120 wrote to memory of 4416	2120	chrome.exe	127
PID 2120 wrote to memory of 4252	2120	chrome.exe	128
PID 2120 wrote to memory of 4252	2120	chrome.exe	128
PID 2120 wrote to memory of 1008	2120	chrome.exe	129
PID 2120 wrote to memory of 1008	2120	chrome.exe	129

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/18Ga4l0hsPPPo_WpkWNzy0f_1iNBPgVlL/view?usp=drivesdk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa60e4c728,0x7ffa60e4c734,0x7ffa60e4c740
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6208404656723313367,15686233963163566999,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,7702067788038337480,14279949341276569559,262144 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,17145749735985529628,10032447505740856545,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,9829529511420580504,7113220472495058878,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,7179815137866911812,4346017883098902456,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,16694957556084061301,8548177931124548321,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,6996857351138430050,15805569989977404455,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5380,i,17903100080246093379,15888515574155290987,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5732,i,14355228332458776260,4250338464500801192,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,4092192983559596925,8097784700340500277,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,7783229804124580054,17013843338763203750,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,14652520568207348345,1775523005862122069,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5908,i,7290472907620292440,18271048829343860753,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6200,i,10238654072570994407,454101585412187047,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,16033814669197941330,5955439971776908186,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,17355288447560141722,2992163577518370094,524288 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6512,i,11544322858037800508,1801897855180571547,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=2968,i,16442687304449503289,17796788614731617904,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6096,i,4570662745086137652,3830350305917834954,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6184,i,10203717643064053751,10669477963509367125,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5696,i,10286229517364991548,1321651645419662570,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5784,i,16015646286307500553,5174314221313014829,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6256,i,13076602056256135432,10836461547552514504,2097152 --field-trial-handle=2080,i,16984734388002011057,8666975375299088327,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument tel:98246%2076694
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa60e4c728,0x7ffa60e4c734,0x7ffa60e4c740
    3⤵
    PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0f42c5c664014d4dfd1aa7020ddc4833ec1b7a79b20154a8f0c662aae7a8d962
MD5 700325ab4a280f5c0bda6424853a07d2
SHA1 471c0d61ba70722a484493f04690b0da0f6a2f68
SHA512 ff7b31b88ce182786dc39ecd1b3b0bc4bb104e308351504d38dc2378ac5aa5f1bdafd1a374da26778bff926361983c16b3f8ff373f5549ae1e94e32f207b8b80
TLSH
T1D0E02BAAC9209D2B09FD071D28580646E75423573B41456B3F3C9309CFB96370986C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 9fce6bd001636090eab84c383a45255f37a0f44a1311a278cba475415dca3d6f
MD5 4e62344ec6738bf5c433e02ff8d5b4cb
SHA1 10d4173de37b4e26d2f6b8c413ab831195f35522
SHA512 05fc7797d60460ab1d1050e80f82932bb105e46d8e683d0dce14c7ed78231bd7d4e9b42b01b82f1f9bc8993d4ab25b2b5cb1b9d7e4f5b32a03cb0e030204a11f
TLSH
T15AF0D816B5A92105C7775EF8EFF00845275046E841C05331064EA7B97B47687D955582
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 586a909b1904a9fe6378dc186dd13f7dbc9a4e82042ac44db5be5cad176ce569
MD5 3735f7ce5880b4493e923bce54b96a8e
SHA1 f309e3f2af7cc1d2a91d096b3173eb03fc4adc43
SHA512 36c7663de3c7881fe9ebd5d36c96fff53585b93aa0d7ee90961d0c29cc72b9b24d360aae5d8f6fa79a2ec797d694bbda8e8542f11b3f87e97d721b146705bc23
SSDEEP 192:wREUGJeGiYav72ympAPRp2Vr95Hsb+WNnW4sXN2GkufzaLbHUoVyIsnAUge:wREUpm2QUXE7w5G2Pu7akMe
TLSH
T1F442D71FA920697B9DCBC319F9127757D7F5107635902E84E6FC8A2C09E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e5d30a59f6f37f97cf6965e67cd71aee0daa26c828787a1a5dabca27d6fc853c
MD5 239e6812cece5bab9c8f371581969fce
SHA1 39c0be0b2b2a8b96a02cd30b1f1db45d2e3a1fb5
SHA512 81fa7399a44257a2704dee66c8ba7beb0380a0dbf1a24c683366e7060e3b7f84ebf1a3c1de137e60f7bba3ef586721bf2a5363e5db4a748b2069618cf850f6be
SSDEEP 192:5RaUGJeGiYsv72ympAPRp2lbHT95Hsb+WNwewOVnQeMkufzaLbHU+VyIsnAUgE:5RaUpm4QUXW7wNyelu7ak2E
TLSH
T15E52D62BA920297BADDBD21DF9127717E7F5107625902E84E6FC8B1C05E7ACC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ae331a1e11f5be404e0a687906211910c26b76ca9ec5babe88cb03590f2d6bc
MD5 db1063c0757388bdae6c133093fdfed1
SHA1 2c3bb940d6f69e3cf9911f8931843c0dd92c2ca3
SHA512 e3f6ce40f85a4073c6144edded464431337869480cbc53d0e094b9156209de81495be73667c581fc0d43929bd665d036123a801a180f8b8f8565813eb5cfda55
SSDEEP 192:5RaUGJeGiYiv72ympAPRp2VS95Hsb+WNnwOVnQeMkufzaLbHU+VyIsnAUgE:5RaUpmuQUXB7w5yelu7ak2E
TLSH
T11952D62BA920297BADCBD21DF9127717E7F5107635902E84E6FC8B2C15E79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5cf5b57453c968b68d6068cc19732f237241c1d3743fd672000161a948af7225
MD5 09c9aae944f368f84df2d775110ece6b
SHA1 b8f4f66ae6a0162af6ca0f9759420d31446a6c50
SHA512 45755b10ce660fa59b9b52f464d5d0bf13de75b97caf3a6f5bd53282891b7f3e3b53b7673604d86ebdbfc439831399b786bbb45632f3601d5393f6f7bd2d3e1e
TLSH
T1F4B01240C0025141C05202F411822488711CDF10E60A1F0153E0BB329A392518414051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886fe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5886fe.TMP
Size 96B
SHA256 c80343cd9c2f150b9589fffca5b45b1e550af6d79bf5d0e6b38e3372f608546d
MD5 507ecc2a63e4b7ecef1ec12f83720b6f
SHA1 a724b812d3d8555851356a3b5e7ae67989a8c671
SHA512 3379fbf5ba95264e4cea557aeda8ea44a49a3abd82cbdd4e366ac8d17415fa7a1c4b723e90a0383e7e9fc321292ec69ecb445da297e92afb5914e410bd91ab7e
TLSH
T108B0222AC023E30AC00303B0BC8A88CA3020CF22C203230282E00E32CC322220020820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cd3e57ea9dc99b5bbbd5efe907ea6b2d9c5931abe56288c7b99826641bb63616
MD5 55787e2e272daca9d683581afc95467c
SHA1 7227725789f6cad720f3baaff8e20b04f8d4a414
SHA512 847f5af1ab7a3385cf4b2f462384228dbf1f6dc8ed94b4e0936de3fb8203f204401deeecf4ada45ef5118c194c033aaf559befd6e73773b8d904c6bc8c58f52d
SSDEEP 1536:TWQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:3qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B2C30237DBC21F339E92CB64B9530FD697B644A59034D301AA7D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d129ac29bb24f3e7f6248412f4444360516e0000048fca78180c436ffee7c4dc
MD5 d01e7b139d8ab8d5ee42377d6955c6b8
SHA1 8cdaf9326d7c5f75300a412f292035ac5f27bc19
SHA512 ce9d1728e90e33c32534e02fdfb9940f7a41e5f5dcebd36bfdacbeaa1e66c08b08b2f6e8098966365ddf79022b670bb054316ad67bf16a8771f1f63098634589
SSDEEP 1536:C/xLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:M1qfd7NtZL8cHQRZEQ6Spsk
TLSH
T112C30237ABC61E335EC2CB74B9130EDB97B544A59034D301AA7D37FB6883895654249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 65c25e565a41038fcfe5e3509a5976dbd1a080aa7a6bbc5198f8ea48a7bff912
MD5 6f6d4073941b7b39993c2050e2dd04d9
SHA1 51fae7837c443a79b0380a4cd1444a153c5c5094
SHA512 766e27756294561e07983a4a536a1b7a68b3dc1779a46d9650593b0ba50f59818189891d7488fff1b81d1d48e00f1405a4002dac17352611d924efc689cfbf25
SSDEEP 1536:f0xLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:e1qfd7NtZL8cHQRZEQ6Spsk
TLSH
T105C30237ABC61E335EC2CB74B9130EDB97F544A99034D301AA7D37FB6883895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e05a5d4a97e63162728cc637f793253b7675f3d8f74e7536239e18f1a0c8b0d5
MD5 6889ad809baa5d90cde5ad3eef62ee62
SHA1 9547335004278c55d5e160ee87642b7e76bf83cf
SHA512 51843e74754a5bcc5650b588f0bb6f2037559e304e90807ea698d9f82de2ca2b32a2f45df5ecc551f4088dc7e7aa8a8caa31faf98b5cd277ff227682268473c3
SSDEEP 1536:fdxzyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:/9qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1F4C302379FD61E335EC2DB64B9130EDA53F544A9D0349305EA7D3BAB6883491A84249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cdcad60184818aed46ed7ce9090b19fa6dfb4644559a838391d5de7619fd760c
MD5 581c1dc6dbcd6b1567df794ea12f65e5
SHA1 939ab0ccda23192e9d220e1e305ead1c9c559a55
SHA512 329348b03dd14acd993a9e245863ebab6126d5c353ad5499b2996e7c8754306486feec5327539c19c26bb94d45efabafa31ae87e0816d8dea67465124dd3803f
SSDEEP 1536:fYxLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:i1qfd7NtZL8cHQRZEQ6Spsk
TLSH
T10CC30237ABC61E335EC2CB74B9130EDB97F544A99034D301AA7D37FB6883895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download