hxxps://gcaptain[.]us11[.]list-manage[.]com/track/click?u=9d589e63fba611f84640a8337&id=abc1b0fc5d&e=69533ff9bb

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gcaptain.us11.list-manage.com/track/click?u=9d589e63fba611f84640a8337&id=abc1b0fc5d&e=69533ff9bb
Sample260702-3mysmac18j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275091184065861"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
3140	chrome.exe
3140	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe
Token: SeShutdownPrivilege	64	chrome.exe
Token: SeCreatePagefilePrivilege	64	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe
64	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 540	64	chrome.exe	85
PID 64 wrote to memory of 3452	64	chrome.exe	86
PID 64 wrote to memory of 3452	64	chrome.exe	86
PID 64 wrote to memory of 1228	64	chrome.exe	87
PID 64 wrote to memory of 3144	64	chrome.exe	88
PID 64 wrote to memory of 3144	64	chrome.exe	88
PID 64 wrote to memory of 3840	64	chrome.exe	89
PID 64 wrote to memory of 3836	64	chrome.exe	90
PID 64 wrote to memory of 3840	64	chrome.exe	89
PID 64 wrote to memory of 3836	64	chrome.exe	90
PID 64 wrote to memory of 1100	64	chrome.exe	92
PID 64 wrote to memory of 1100	64	chrome.exe	92
PID 64 wrote to memory of 1652	64	chrome.exe	97
PID 64 wrote to memory of 3348	64	chrome.exe	100
PID 64 wrote to memory of 3348	64	chrome.exe	100
PID 64 wrote to memory of 3476	64	chrome.exe	101
PID 64 wrote to memory of 3476	64	chrome.exe	101
PID 64 wrote to memory of 5036	64	chrome.exe	105
PID 64 wrote to memory of 3932	64	chrome.exe	106
PID 64 wrote to memory of 2496	64	chrome.exe	107
PID 64 wrote to memory of 3048	64	chrome.exe	108
PID 64 wrote to memory of 3048	64	chrome.exe	108
PID 64 wrote to memory of 556	64	chrome.exe	119
PID 64 wrote to memory of 556	64	chrome.exe	119
PID 64 wrote to memory of 3140	64	chrome.exe	120
PID 64 wrote to memory of 4752	64	chrome.exe	127
PID 64 wrote to memory of 4752	64	chrome.exe	127
PID 64 wrote to memory of 1380	64	chrome.exe	129
PID 64 wrote to memory of 1380	64	chrome.exe	129
PID 64 wrote to memory of 1240	64	chrome.exe	130
PID 64 wrote to memory of 1240	64	chrome.exe	130
PID 64 wrote to memory of 4880	64	chrome.exe	131
PID 64 wrote to memory of 4880	64	chrome.exe	131
PID 64 wrote to memory of 3968	64	chrome.exe	134
PID 64 wrote to memory of 3968	64	chrome.exe	134

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gcaptain.us11.list-manage.com/track/click?u=9d589e63fba611f84640a8337&id=abc1b0fc5d&e=69533ff9bb
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffed69dc728,0x7ffed69dc734,0x7ffed69dc740
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,3073251199987340717,943987722146770683,262144 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,10373729495607965727,2174475049745510326,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,6483455770487604459,1611165577296134798,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,9851020597226984205,2527245125368352238,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3448148147372458438,4347961220703902385,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,9149624187084653271,6574068017178568389,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,11958029148236124426,10288726610992523787,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5660,i,15707137527722785934,3013128454682103585,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5816,i,13289084651195493704,2157469469042801013,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,9381784184227773225,3996488802513222884,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,11869102558234951904,12360382784092943908,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,6592108299251881541,12515570188959396462,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5744,i,5290627211706842070,5221721276610411564,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3476,i,11830349982755265503,1029158120838391548,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4604,i,6963468208144821308,5622712506305461894,262144 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3028,i,101319586648474523,5893144924178705403,524288 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=976,i,12664782115433517290,3131707784797882906,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5660,i,14311078743511427425,13836385589624093513,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3376,i,350303397984615922,8302804464451027709,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5904,i,7511103713494717771,1739720089784743185,2097152 --field-trial-handle=1960,i,14847518666264893848,1236686334610898870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e8166f36a0d6a5fe72e6180821f6e8c97b9fad633ac83641b6551b16fb9da02a
MD5 0bed5d61fbecdda54d0ee27541271b06
SHA1 171f748dcdecc7f41958df0a1ff376c0e19f952a
SHA512 605ee71bc74ef6659f0b0e728eaac881377fb14cb2a0b26fe7cfeaa62ea1d2add236aa601aba81089dc12027de935039d03c4fec945d7c53176bad7a6c23a535
TLSH
T121E02BA6C862DC3B28F90B18A0101785D79413DB2A40C94F7B3C910C8FB26764586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4df14b23f961757f1fb40c5d75a73e9a85ce13c8cde31013c541f3d1076819de
MD5 acdbec28fe48a121ee1f081c05f63b63
SHA1 7ea28efac2345c0c9247add27e3ef837de8f0d1f
SHA512 26426696713e59d814b445323ca34d8be07117a18edec2a2f185292c486ffac38a86599b9665e2d609db7a6e4c5947b227a9a2125a804c5e960dd266f2a62ce3
TLSH
T11131C72007DC6EC1FF3507FC428A3EC43271276824961FCB0042196FEC437E694A20E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 39b6a6cac50f13950fd319a23d7d1962bf95c11c18f8e8076514a986c77511d0
MD5 e349268e4c7f8efc6bf1d58a3ed9063c
SHA1 931db88beee119b26d4c2c064416b9ba1195fd60
SHA512 8c9f343f1efdf084bf4759ec092823bfbc78e65447656818c5a27d502b04ae1061bf894aa8fb7ab1c02f50ca82ce9204737fde6890c197499ff7e96976c46c8e
TLSH
T1D4B01220B1C019E1C710433D4A410DC271222CBC009E0B23D1CB1780C6156F4B401480
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b8132cbe0c86d6a9edfca76bff11da5c4006eed449806ab5d9a63953d376b809
MD5 c6ec166cdccca6c400fc5a0d233dfd0a
SHA1 7e0d20ac548584be4cc9848e3199c3dc3bbb5c41
SHA512 3207a26c8c3a7709a5b17da02c05a0c9c8c967f19eef404a1a223ee810f0ccdfb1d8a9371d1d077aebc7ba0e34054c9986c40f57f22e455389cf142396c5682b
TLSH
T1E031E86007CCAEC2FF3543FC468A3DC431712B6824960FC70042296FEC477E694924E9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0096abd72a6a3a4fbd7f0d9557b2ec0a81412d56afbbd7cf0b126d3230d46ae6
MD5 ed3af14f6881317d8d3147cfd6a7ba03
SHA1 b71c14332517895a378f97cebab7b232bff7d047
SHA512 533f98ee4df26cfce3166c5a59b52fe42212f2238b9f3c67dc68d322b3d5f344baf612c2a8506ca2c73085b2562ec8c2f4838b16e077c76c1bc0d5b6e6feb8e3
TLSH
T145418DF793B4997E8A1192F4EB156E1FCE7A0524131C3CA689E46E1B47F29B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e3e27459b9b9e11acc6822fa2d1eab1c1dc4d7e28c1770f168a190bda28a190a
MD5 6df5cf68606ee81aa6b0956afc452266
SHA1 39653edfa571c708de805e8ecb74e32ddac3a721
SHA512 159351e92f349d796f4ce08fbf73f1f84566a8687f84ca57cc5f61d230cbbb7bd91cab889e3f9e1ec6a96ea3732aff66d4384804770849732e8cd3e7f5990836
SSDEEP 192:D63nseYe42JiaIaEdRJAi0usJrHUkPoPdvGisP81EfU:D63nseYe4+iaIaEdRJAi0usJrHUkPoF5
TLSH
T1F2E1AEF7C3E4992DCC6652F4AB252E1FCE2A491893193C3AC9D47F1A93E14B1E10074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3dc13e1e9235e2c133da5032aad51905870c3f837a5c134a5e8c7bf3a77f6438
MD5 0e8dc80199410b0c633d5ca6fe2ffa26
SHA1 48a42f724476377e9336475de52c0cc298c95a23
SHA512 f85b5082da0fdd6692ec34649e5dc5a10690e92798cf51fd6623328a5c818e479231eae7b8a58384261ee9e132bd6ac94967421b963085c4b698fb8b3e4da29d
SSDEEP 192:IRZLMpHuWYNbv70pGPRpIdpD9+Hsb+WNnIQPckQCeMTj34kVyIsnAUgE:IRZLaHQjgSXo8wXP1Q4HE
TLSH
T1AE52D72AAA505D7B6CDFD229FD617B57D7F2102225901E80E7FC8A1C1AD7ACC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 37da60fed427ef72dea8ea2b048704356fd82d743056222f3ec626df26330d59
MD5 893ed81bf7a8ada59572896cb6718459
SHA1 de159e9481d9a4bc7d394412736b92b93a763aea
SHA512 9ac6f58453879e32cb9463cf6d949926e157fc2c5d82a5c8943d3f7129787c0a084088dfaf974dc1c83fd822496e7082830f52286ddcab37e50672901b7619bc
SSDEEP 192:IRZLDpHuWYNbv70pAPRp2dj9+Hsb+WNnIQPtkQCeMTj3pVyIsnAUge:IRZLFHQjgUX68wXPSQ4De
TLSH
T12F42C82AAB50697B6CDFD229FD617B53D7F6102225911E80E7FC8A2C1AD75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d40734e5b590ca81ce9212f530e6f899781ad67b5b7525a14df435a5d73d7b00
MD5 f03322668d854adcda468ddb6beb1bdd
SHA1 3723a0aedb81af175803a2207c72de2dbf095da2
SHA512 4ffefea1b0e21ed1f0ee85fb9a49a4449c74a2a063b0d66b624e7e0e9bc0fe6ac6c09cc3ef7db2b2e2fceaf17b27852873fc23e360a3df88147ed75156e59780
TLSH
T1C7B01200C00191C1C05206B0114314C87118DF149A0B178243E06923C83B2618015091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 49248d0d936ffd853af5206ed74c4b409ecd34ce7f02cbf865f071d44656ce2e
MD5 3c764cb12f26bc2a314b72bb8d92f4a4
SHA1 75e5cedae8f2ac0d5bf932b3632f3df0a8631b43
SHA512 08b502c7cc3a1c00139d53477be6157d435233da0e6692671846f81e147b11740eb40b9d2b2496a1bba2afa000db7064b167ba3913808cbf3b59206545bbe6bf
TLSH
T1B6C01202C8056282C08B03F91656D4D87598DF34DA1A174C53F41D27EC35231D03E155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f4f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586f4f.TMP
Size 96B
SHA256 71cb666b9e9ab3687eb4fd879952bb3b40af34351bf707d77868e28f88ec5553
MD5 5b4d7fb14207430225c7a31bbaaf575c
SHA1 f29c5dd3f4da777fe49966f45db7f9a0124b5775
SHA512 ada9c816331951694c9ca71e37d329d5c92f5e998dc0206ac9ebca2c06d4ed432916959beb7666d8a87a2488d3f7eeb1e491e6d2105cfd14d6df331c56982f7c
TLSH
T19CB00256C1126292C48203B176A595DC75A0DF29C603221392E05A76DC257B1A6256B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9630e819cb334e8075605c85f8333a6cbd9b92ddecc0a2e7d23179abab89da47
MD5 7c2f5496e0940b124665c23331be42ad
SHA1 7a9f7b12a2e5a7c7b557ac35f2c84944c9412646
SHA512 4f302d1bfa62578ff57cb7a3dccfe524b9b2b5352a04cf10644df761eb90fabbc3c772a5459a019cfed098d208ab7bad09f88e1b3555c2135a10d2d69deea4cc
TLSH
T198A0021036580082C15032F471C2C2843225EDB51305876165D049978CA02444115022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1d450be9037dc49c3c15cf81bf3be0922e4a9af9c0642e26569d2a53e6a959a5
MD5 d31c4c3c2f5f7cfdb9015489af032ecf
SHA1 0b43b19295099511be09d79fc71a5b8cd33a50f6
SHA512 71ddac066a43b660b17dc919b9515882bab540c4aa4b6107b393246a44370556f3668b5e2f593e82a67175defecfaf8ec3cecaa3eb0116d6b2d05a4b3c02be1e
SSDEEP 1536:xRmyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:nsqfd7NtZL8cHQRZEQ6Sps3
TLSH
T15DC30237ABC61F379DC3CB64B5130FD797B644A99034D301ABAD3BAB6C83591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 aecc1d8aef1ca635f4ae0405a71f00bd08af872e633cdac4dcc2db3364badb1d
MD5 7877351c05f6cf85088edb7d08287daa
SHA1 369ffbd4180adba8e48ffbd7c80f06a472054a53
SHA512 0e3da8f92f3b02cd7f5f0e637c526d2ac755e95ddcdea4cfd035bc3eb113242f72307accf809ae4c3d56060aefaec90255947a48a58bdbb268b96df7b589d1e7
SSDEEP 1536:F5uyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:LUqfd7NtZL8cHQRZEQ6Sps3
TLSH
T146C30237EBC21E379DD2DF64B5130E9A93F604A9D034D301EEAD3BAB6C83551A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 04eea751d7159933ccb5a3c8b96c718dcab05ee63dd9eca661009dccc6946432
MD5 6ad632c1fba56e0668bd4ff76f18ec67
SHA1 12bf4bf3ddfb84a48d13e696f4fb566fc77c4413
SHA512 8d8b1ab7b7a4c5216640cf49d3599b44292ea04fca2af29fec1e69eadc9f55e764f99ecdf8f146dd71ea1791fcc2821b22f52bff158dc277b63c9763d76e73da
SSDEEP 1536:x5uyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:PUqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1D6C30237ABC21E379DD2DF60B5130E9A97F64499D034D301EE6D3BAB6C83551A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 72458fc190629b15e429228ce041ef2aaa13cee3e07200840c28d47d6c46a9aa
MD5 cec6d272f50d60870a603b9624cf3ad2
SHA1 1fa1dd98a9a2a1104d961a17f98171a0bf53383b
SHA512 30063bd743fcc878eee380e215583c961c146072a7476b7acb67cb57661bc39fa9efe16e0766e4f945e727825f498a5ba225fbfe9fc2d0da80f935a94f87f4af
SSDEEP 1536:bGLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Kqfd7NtZL8cHQRZEQ6Sps3
TLSH
T134C30237ABC21F379D92CF64B9130FDA57B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1aa1b24b949ca57a364e3e32d49f5389e4802dff35986bf0579354d74cc0be2f
MD5 a0cc74db2e40a2934526b6214b96840b
SHA1 cdc2e012f0e7895bb916179a6b717bc3cfac4b3d
SHA512 ba48c3c3e41be39239ffaf7cb12734f69aff97163a76b02113b9dff3cc5cb134266126727654cd129aa9becb83f30c2fc3428eadb9ec0a0c7712febb40f17eb4
SSDEEP 1536:KRmyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:usqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1CDC30237ABC61F379EC3CB64B5130FD797B644A99034D301ABAD3BAB6C83591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download