hxxps://rcm[.]amzdistributors[.]com/checkedreportsafe/dp/B06X6J5266/?_encoding=UTF8&pd_rd_w=sdNvl&content-id=amzn1[.]sym[.]f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_p=f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_r=D9ENZ1QFSXATY6RS0K29&pd_rd_wg=z0rG8&pd_rd_r=8a48b541-6fdc-4d8d-9cf6-a5c9abdb3eab&ref_=pd_hp_d_btf_crs_zg_bs_16310101&th=1

Analysis

user interaction
yes
max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rcm.amzdistributors.com/checkedreportsafe/dp/B06X6J5266/?_encoding=UTF8&pd_rd_w=sdNvl&content-id=amzn1.sym.f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_p=f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_r=D9ENZ1QFSXATY6RS0K29&pd_rd_wg=z0rG8&pd_rd_r=8a48b541-6fdc-4d8d-9cf6-a5c9abdb3eab&ref_=pd_hp_d_btf_crs_zg_bs_16310101&th=1
Sample260629-pse1tadv8x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1624	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272101758275009"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
376	chrome.exe
376	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1644	2364	chrome.exe	84
PID 2364 wrote to memory of 4900	2364	chrome.exe	85
PID 2364 wrote to memory of 4900	2364	chrome.exe	85
PID 2364 wrote to memory of 1624	2364	chrome.exe	86
PID 2364 wrote to memory of 2488	2364	chrome.exe	87
PID 2364 wrote to memory of 2488	2364	chrome.exe	87
PID 2364 wrote to memory of 4068	2364	chrome.exe	88
PID 2364 wrote to memory of 3756	2364	chrome.exe	89
PID 2364 wrote to memory of 4068	2364	chrome.exe	88
PID 2364 wrote to memory of 3756	2364	chrome.exe	89
PID 2364 wrote to memory of 3832	2364	chrome.exe	91
PID 2364 wrote to memory of 3832	2364	chrome.exe	91
PID 2364 wrote to memory of 3292	2364	chrome.exe	92
PID 2364 wrote to memory of 3292	2364	chrome.exe	92
PID 2364 wrote to memory of 4032	2364	chrome.exe	93
PID 2364 wrote to memory of 4032	2364	chrome.exe	93
PID 2364 wrote to memory of 1112	2364	chrome.exe	96
PID 2364 wrote to memory of 3796	2364	chrome.exe	111
PID 2364 wrote to memory of 4104	2364	chrome.exe	112
PID 2364 wrote to memory of 3364	2364	chrome.exe	113
PID 2364 wrote to memory of 2908	2364	chrome.exe	117
PID 2364 wrote to memory of 2908	2364	chrome.exe	117
PID 2364 wrote to memory of 3368	2364	chrome.exe	118
PID 2364 wrote to memory of 3368	2364	chrome.exe	118
PID 2364 wrote to memory of 4560	2364	chrome.exe	119
PID 2364 wrote to memory of 4560	2364	chrome.exe	119
PID 2364 wrote to memory of 376	2364	chrome.exe	125

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rcm.amzdistributors.com/checkedreportsafe/dp/B06X6J5266/?_encoding=UTF8&pd_rd_w=sdNvl&content-id=amzn1.sym.f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_p=f2128ffe-3407-4a64-95b5-696504f68ca1&pf_rd_r=D9ENZ1QFSXATY6RS0K29&pd_rd_wg=z0rG8&pd_rd_r=8a48b541-6fdc-4d8d-9cf6-a5c9abdb3eab&ref_=pd_hp_d_btf_crs_zg_bs_16310101&th=1
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff92154c728,0x7ff92154c734,0x7ff92154c740
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16324569306925661255,11206012901986894254,262144 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,15079057933557639258,8135088935147068534,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1330783445959377488,16651318452967883602,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,12522425630807697181,9680646294948110154,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,409977242751609115,3747612548578642179,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,15022312727706337868,2111066026775008250,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4428,i,5808499585907960096,8287054667473702229,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,18140189549428074261,14790913166629228002,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,3317096046394154226,3830172413018041136,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,316161667106333240,5865148680508628628,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,5910669358828412699,6200592409767909334,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,3437384567995677667,183326617014020817,524288 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4712,i,12023935109808362555,7406003130879340129,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4780,i,11447513123261485667,3939995173054264814,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6164,i,7874815324149642756,16307227506591758758,2097152 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4756,i,5186150870831756366,17964861098969426890,262144 --field-trial-handle=2000,i,16551176005146187231,3951351832204052555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

111056b4-64aa-4a91-82ef-ee1de8a8f51b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\111056b4-64aa-4a91-82ef-ee1de8a8f51b.tmp
Size 12KB
SHA256 388130375f5749bd47e6042b08ead2ceb0d1a0ac875bf9a803efc31d9bf76b36
MD5 fe88e07ca6cbbaf0988712e54c2a40ba
SHA1 4eb4648cdf6eecd36e03cdb333c7c627a51d92f9
SHA512 e15ccdbadd3a65af1ac1fbd89614086d9b87edb318a31785248625efe67d7a80766d6362605fd99d444f95b36e72266be1fdeabd62a1f71d2a1eb9ebf23dcefb
SSDEEP 192:KRR/kqZeJCPULsv7spAPRp22uZ9wHsb+WNnzLrtj2ZpeusX2rMLVyIsnAUge:KRR/VVrYUX/WKw392bsX2rMNe
TLSH
T1F742DA2FF914697B6CDBD219F9227B57D7F5002161D02E50EAFC8A2C16EB9CD222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7d52bf7cb274f53f992a4ba405de59423d81183531e7625bf618348358414525
MD5 c719744e629fee01055d1da5be20c8db
SHA1 3086b70abe1ceee8e1cb6fba78b6f7430836136c
SHA512 e960b9b69b2e11d93e23c55a7519caca30f89fd10d481473e4fbe2d592653c4c59e437c94eb544257311173f8b6e7f932133a9876791b9e5d94c940c870e70b4
TLSH
T144E022AACC21FC6708FE47196414578AE755135B2B815A0F7B3D921CCFB1A2B41C6CBC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 25117c9859616974c906529972f9914a0749a978f3a3d6b46f52ffdab7e60f03
MD5 cb2221c575291146dbd032db4987272a
SHA1 3dce57bdeaf630ef2779a9365016d3041809e1ec
SHA512 d6e99670ae9cf0bc3fbaea525466e8f39703ad5a7420101f96eee604da70f0bc301c81f97b98ea89bfdab2a714e3152d9b4d75eaecccc9a0e8cdcf8efe41a1ac
TLSH
T16CB01207A2DCA8C2C79889BB04F1214063208E280310431387C078CCFE2B7B3049A180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c749ed031b342ad43246047211d42a1e8024c38a706ad821f52eba8502194c0f
MD5 6eca316b8fad8e5c5e71f3c61cd076df
SHA1 ecdc32200496afcb6ea81b044f49ca939ec914d1
SHA512 f9ff278f918f7a43e34e630c463caed594654948207ddca4136c43d02123f03a12a64605868490a952dc5cbe5a5fe60f7b4446df031d69d329dde562e93942cd
TLSH
T13EB01200AB7401D2D390423A00D1114022300E191311021145D03484C9223730407041
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d61e7f9ff76dd42d866785d0e2c1d59d00b87f21a7e41643ef1b80d263ad9ff
MD5 973be84cb21b635b840af30608570990
SHA1 d3dee75e5965da7b0952817f016518e0692515b0
SHA512 ba971dd44552e7c5ad4bf0d564b25616a79f626164a82272607a5b82b227b0954bb56ccde8554b3d71524256f2f3130c432bec251c32582576f46741c3d9d501
TLSH
T1C851CEF7C7F4866D8A1152F0AB14AE2FCE6D0A14031C3DAA89E4AF0B53F2871D25475E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3e00a74f7d09abed18c45bf58bf977c447307f4de298aa6a90041772c36c046a
MD5 d904c128f2f0e0cec4b7230f47b76515
SHA1 7381d74fb5b1afce27f45ebcd904ab4c591fb01f
SHA512 e2c757fccb1b3112733abc3f8e29a82bca26ba8db0fa275a2cd0d1467bf9261510f7e965d65add95508570cc877671091ef20d8e77ebbfdaa573e7ddcbd3b38a
SSDEEP 192:KRR/kqZeJCPUsv7spPPRpL2upk9wHsb+WNgmLzLrVFeIpeusX2rMvVyIsnAUgE:KRR/VVjYlXCDKwF7ne0sX2rMJE
TLSH
T1A552D82BF95028776CDBD219F9227B57D7F6102121D02E54EAFC8E2C16EB9CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ae739b2a79aaea8f349896e32972effdfef98a86922d9498961d7484b9088973
MD5 043faca7f74c085389d1f2d434807642
SHA1 977ca8aa59cb8cce8c01894fa299b35adb770a67
SHA512 1f3b68db7ee51531fe7cf415f66aa5b1db3cb88650b673fd4250c8fff2529742a11829428be4601ad285193d803762bcdf7b9f3fca5afaf9dcb5bca83836b03d
TLSH
T16FB0120180467101C48682B052421C88B2945F10960B1F0143E0BD22C8261A28415051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582a57.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582a57.TMP
Size 96B
SHA256 9632ec447706ffe9ef648b781004ba95fd19fe3e6861bc6bb0c9d3fa5bd428db
MD5 d7f3becf9a5e4d396d3c1ad45b310296
SHA1 5b811a86121650f89beb9174e922aecb915ce5dd
SHA512 e75c1c3d94dd4c85cb0bb816438b44a7e34bb57ad14be6ee6c91558b2f01d877760ee14965e4ea18616a1c858565df69db43580ff8cec4ed9c545a2d2dd81e01
TLSH
T155B00255C712A312C45207B025A9F5DD71A0DF35C653122393E52F76DC2B772552B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 14c247b94ecec1c1ee86df6ff3ca889cc0a0128095fa92e40396769f23e5074c
MD5 2c005cc57ac383ca1ba3d6acc76367e1
SHA1 5f797c11e7939a1b88105f93de63ea8f17b0bf06
SHA512 1e6fe3bb9ef3a5b4e580d9e75c55c50ee225c03c8fab9bfebdf8ef671e2ea2e7f66380c88601fd9b51da5e7ded272bd24a7f38567ee8f70d0486242aa22edabc
SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:+m7Rkm1tYpBeh2BAoK
TLSH
T1EAC3123B5D75E83759B5BB5EB08E0A1F1EF249A6C920DE52C8D85B0433EA7CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 392ec2acbeb2a9fdc5fa0ae717fa18f139ca55e4f299b71e70f1f212e8966129
MD5 6316d2ab0c596b61117e5c9196388cbc
SHA1 8abab29c50bd92fc0f8adb81bafa95da124b7574
SHA512 7f69a0b37af93121f8405375caea4451c5d54718aa24742b4ae9cc779abffeae369677daa57b7f67825dbc042ca0a8a3639625e5cce14db64ebe2ca543c36219
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:gm7Rkm1tYpBeh2BAoK
TLSH
T1F2C3123B5D75A83759B9BB4EB08E1A1F1EF249A6C920DE42C8D85B0433F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d8e179052e9d25cb399a2686ffa9172fa965c2d72330c3cc6491f1f28030ee73
MD5 0f5cc351b886de5937dedb4324d1ce17
SHA1 83d42e8ba1e0f8a80806b079e5fe9679aa5c0f78
SHA512 cb575ecfef95b7986ef26d5fd213ca2f63cb9e3411d541df38851dda475662dfffaae83c82c70fe551951f89a03b13dc3da9856f028c7d8bb06a4578dda26321
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:/m7Rkm1tYpBeh2BAoK
TLSH
T101C3123B5D75E9779979A70EB08E0B1F1EF149A2D920DE92C8D85B0437FA7C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 44159e5f41d2ef16702b1b008bdfb19a7f785fa051197962de1efa7edc10e227
MD5 8f93412bc3ca1707f7a487e8ffb15466
SHA1 4d4f247bbbf01d091efb628b6eaa252fa1389a1d
SHA512 84ad173bd0b0d0f5adb63326f28924784a7346589191edc14d6db5c63bcae232690fcfb9cff86153dea54f603b8610b6cb8a6faf8a72869551d55fc6506a50c9
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:dm7Rkm1tYpBeh2BAoK
TLSH
T17BC312375D75E83759B5BB5EB08E0A1F1EF249A6C920DE52C8D85B0833EA7CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download