hxxps://kokiladhirajdhamdawarka[.]com/

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kokiladhirajdhamdawarka.com/
Sample260625-pkgvfaby2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
948	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268638013206205"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
1500	chrome.exe
1500	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 2940	4072	chrome.exe	86
PID 4072 wrote to memory of 948	4072	chrome.exe	87
PID 4072 wrote to memory of 2156	4072	chrome.exe	88
PID 4072 wrote to memory of 2156	4072	chrome.exe	88
PID 4072 wrote to memory of 664	4072	chrome.exe	89
PID 4072 wrote to memory of 664	4072	chrome.exe	89
PID 4072 wrote to memory of 1324	4072	chrome.exe	90
PID 4072 wrote to memory of 2732	4072	chrome.exe	91
PID 4072 wrote to memory of 1324	4072	chrome.exe	90
PID 4072 wrote to memory of 2732	4072	chrome.exe	91
PID 4072 wrote to memory of 3772	4072	chrome.exe	93
PID 4072 wrote to memory of 3772	4072	chrome.exe	93
PID 4072 wrote to memory of 1536	4072	chrome.exe	98
PID 4072 wrote to memory of 2676	4072	chrome.exe	101
PID 4072 wrote to memory of 2676	4072	chrome.exe	101
PID 4072 wrote to memory of 556	4072	chrome.exe	102
PID 4072 wrote to memory of 556	4072	chrome.exe	102
PID 4072 wrote to memory of 3332	4072	chrome.exe	103
PID 4072 wrote to memory of 3332	4072	chrome.exe	103
PID 4072 wrote to memory of 2216	4072	chrome.exe	106
PID 4072 wrote to memory of 3560	4072	chrome.exe	107
PID 4072 wrote to memory of 4256	4072	chrome.exe	108
PID 4072 wrote to memory of 2924	4072	chrome.exe	109
PID 4072 wrote to memory of 2924	4072	chrome.exe	109
PID 4072 wrote to memory of 4436	4072	chrome.exe	110
PID 4072 wrote to memory of 4436	4072	chrome.exe	110
PID 4072 wrote to memory of 1876	4072	chrome.exe	119
PID 4072 wrote to memory of 1876	4072	chrome.exe	119
PID 4072 wrote to memory of 4216	4072	chrome.exe	120
PID 4072 wrote to memory of 4216	4072	chrome.exe	120
PID 4072 wrote to memory of 1500	4072	chrome.exe	122
PID 4072 wrote to memory of 2088	4072	chrome.exe	123
PID 4072 wrote to memory of 2088	4072	chrome.exe	123
PID 4072 wrote to memory of 3308	4072	chrome.exe	124
PID 4072 wrote to memory of 3308	4072	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kokiladhirajdhamdawarka.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff53afc728,0x7fff53afc734,0x7fff53afc740
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,14612523008340200485,10770061742636715848,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,14449466682324756780,5461111608449308432,262144 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,5596370914353152704,1764362626408866318,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,11015395749060125699,10188815427541985545,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,16513354227585539224,14082734176856090715,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,3493751743553711560,934450032786699939,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,10361470905454300722,10657866158513494763,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5596,i,17167284495085471896,7510624198822491329,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4564,i,1324336430572372412,14937785220572922492,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5672,i,5267632301838860945,3207323973548426976,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,4326593076654261201,3800959784673142826,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,13143168896411906248,921854673882791214,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,7856254602903467707,2672498357352472579,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3316,i,17350844430029217405,14424344602175937162,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5800,i,9700894777403077342,635087454222733737,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3440,i,1889331502819877877,9686278081082165753,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5624,i,15229888494403681419,16093302357998974660,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3912,i,15862579931086955504,10936635983116418765,262144 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=1220,i,12120945665939115046,1673041497237430811,2097152 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,7366303474301773754,1890490770362308911,524288 --field-trial-handle=2172,i,2789405184162765491,10919383718264146683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 490eb730bc0e06676d1ba9e2a6e6f03dc3d058d24464f45a0c2a32772db21424
MD5 df2eada4f27b0f1abe07cf0b3562cff9
SHA1 eacb9e5daf1761451c94a53acd8cdeba0a7422da
SHA512 764e6e5f51aa9e13caf55a2265e78d5773ce04a1a5f2c9d7533159c5a70cade519e27995fd8fb8ff4cdffeb2cdb00ca5af967815431ca5716140aeb4097e24c9
TLSH
T117E02B9ACD31EC270CFD471D50A00F46EA5113672BA0855B363C824C8FB16A701C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 70dc2d73e91eaab0eb2acff9cc0fff0e8340138a3914721f1360070ca23b386b
MD5 29692dbcb155b2e569aad45daae882de
SHA1 87a91e80956ee93eb518620ad19d13c6e9b74afb
SHA512 4281067f452bef1268c2cc94c099de4e4850deed5f67ddffaccb0d4d05ca718dcd2e436a6c813c617f193da29c9be38c9489278bb92da4ecc94a89c03ac443fe
TLSH
T103418CF793F4857E861192E4EA156F1FCE6A0624431C3CA688D46E2B53E2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

eea101c1-80f8-4f9e-a79f-7df818654b31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\eea101c1-80f8-4f9e-a79f-7df818654b31.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2920cdad0858d40f15da641110b602f0f1f5a018019d9a021ea4211c73aa8876
MD5 141fec074e6787ac67eeeaafd4120973
SHA1 3b8ebd76070ef3519cfd8dfe601536be7a83562b
SHA512 b5557d7919a785ad07a6f5ce7bd430f5b22011e2c908dc55718c1aeced4281b25394d3086358d284bed7cf97283b89de4f81fb87abf03715a96a91f367d38119
SSDEEP 192:IRS1Sx8r98hSBnjv7ApAPRp2l9qHsb+WNn91PSGeH7VXaOUjQVyIsnAUge:IRS1SqQenbkUXmkwvP87pafUe
TLSH
T11142B62AEE20693B6CDBC219FA657763D7F5202531D02ED4EAFC8A2C15D79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6da70f7526355a418fe48e267d2579795ff6b11fde5449c591be85981697c397
MD5 8a0a472def671cf775f441129f8582a5
SHA1 cc33609383c013fd6494eec1e8c09a089bd04734
SHA512 67d9b8fa4baa2d159a0c80899deacdd3c02449018fe7830d3a0c61c7187cdb39eaa02118aa1aab0c2e8f3b1920bfb25802efe8b4ebdae6c3c6f5fe96c8816697
SSDEEP 192:IRS1SC8r98hSBnjv7ApHPRpfe/9qHsb+WNn91PYGeH7VXaOUXQVyIsnAUgE:IRS1SvQenbkFXYkwvPm7pa7UE
TLSH
T19F52B72AED20697B6CDAD219FA557B63E7F5203531D02EC4EAFC8A2C15D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ef01404e31543ce15e1a4a9205de36c9f6aa53a960bf2f2c88ef95de36ef49d7
MD5 8b3b5e59ae67b595832ac8e04c103fbb
SHA1 e9ffdb3e5c5c4336dfb90daa3e0dbd8759ad3cd5
SHA512 371899830093d2fe297b738a3a02297d3a1cc9d796e1379f3b8610c169dae60db270feecadd051b18aae178fca7b7d86170115152d76634e15352dbadb22f389
TLSH
T183B0124080426101C40B06F4214214CCB158BF50D60A270243F07937AC2526081180A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b3ab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b3ab.TMP
Size 96B
SHA256 87bfceeb412f23e2fa27165e18802ce7e3d85f7447299cfe8e5fb753ef3ff543
MD5 db134aa1d034bcd0f2caca0c19bee1c5
SHA1 be7d70227565c2bf0ef2cc72d6199b52801d475d
SHA512 28e8f15c3e166e3904afa9c81e8b85f22b6ef9b440aaf8d0ebe1ad155a1a4f3aafa97fcdb11e1be7c80527d409a9a8c65331dbf919b220f983c81845fd1ca246
TLSH
T1FFB02228C0032202C08283B028AACEE8B820EF22EA230302C2E02F3EEC2222000200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fbe9fcb77b60a607ad1ba7f7594d4cd5b837375f44152fd58985af58c13c1e46
MD5 cfda9b3ecc8bd26082d5c780bcca3cf6
SHA1 f4afa4a42cc08b8e6898c00fad85cfa9aecf9c26
SHA512 640d6d4a4e756d85241de0566eb3b203c1497f57520e30493749feb3800beae0a6de203d7fef75290ddc483177cd5b7e93bf6c703b8fcd3071fb4fe83becb202
SSDEEP 3072:xcGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Zm7Rkm1tYpBeh2BAog
TLSH
T155C3023B9D75A83758B5BB1FB04E0A1F1EF249A7D920DE92C8D85B0423F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4ffc9d43593d70203e14a1b9e01407687f57761f54930e2bcab6edd3fce59c6d
MD5 07672833a085a6423fb6d1004ca69ecb
SHA1 44978d0a865a06f65d20d5d678a3a0fa1a6b990a
SHA512 f1fada8bb84eca1787ff40e826f7c2fd91ce06bcf95561004ce5155820a6de4aa6b7906dd29e66d1b344161d27b0d14f0ebd2138ced4796a99ff4bd23608e7d5
SSDEEP 3072:NcGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:1m7Rkm1tYpBeh2BAog
TLSH
T10DC3023B9D75A83758B5B71FB08E0A1F1EF249A7D920DE52C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e798bb19aa7ffb20b486df9f7d0b492f106c30401f40cde3fc14bf57b1799490
MD5 5d770f8754d2f84b0fbd5cda3a3f835f
SHA1 465252d96a92f6f07223613e0fa7c6facd40ca7c
SHA512 ea7cce14404986cd5e4e102846f9c2ce6ab3cc0fcb3e27cbb9ab4d5511ba167709fd7ffd355b7a2b61f4e871ea8fc26b26640af52eb127c888d50e7caa62d2ab
SSDEEP 3072:yjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Nm7Rkm1tYpBeh2BAog
TLSH
T19DC3123B5D74E8375DB5B71EB08E0A1F1EF249A7C920DE92C8C85B0423E9BCD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d352975ac09eb346f774d75fe55dd719abca81bdca4da44d29e5d6b828f205c8
MD5 8d80e3be0cb7699e043d5230dc474d51
SHA1 b1fe88c5897759051e28389de4f8615cae1f39e4
SHA512 035b438ed2c82fcaf842d535ad1e7a110360410fca2372a4f9dcbeb72edb3aaf4509803ffab2c5a22a1223dace5807c834bc72842015ff4dd5ca1933bddf390f
SSDEEP 3072:AzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Rm7Rkm1tYpBeh2BAog
TLSH
T16FC3123B5D75EC3B5CB5A74EB48E0B1E2EF249A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 354fa37fd56a3cc8c94d9abbef43d3489f3818f963c8911ed5c017f4484026ad
MD5 aa1aa280ab42966669a66f245c791e9d
SHA1 5b2e96865516665ef10304e140525dc0aedb3170
SHA512 e9e12c51a398ad61ae5feba23ac5d94b759326db924ac7081da6a6aec895554b951e4d0443d682cf5ed57f85ce67f06a92db3050d03f3405cb21c7ac87acfb07
SSDEEP 3072:xjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
TLSH
T1CDC3123B5D74E8375DB5B71EB08E0A1F1EF249A7C920DE92C8C85B0423E9BCD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download