hxxps://lmu[.]riayati[.]ae

Analysis

user interaction
yes
max time kernel
299s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lmu.riayati.ae
Sample260707-vcsvmaay7r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3996	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279166762705683"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3736	1764	chrome.exe	86
PID 1764 wrote to memory of 3996	1764	chrome.exe	87
PID 1764 wrote to memory of 2624	1764	chrome.exe	88
PID 1764 wrote to memory of 2624	1764	chrome.exe	88
PID 1764 wrote to memory of 4148	1764	chrome.exe	90
PID 1764 wrote to memory of 4148	1764	chrome.exe	90
PID 1764 wrote to memory of 3564	1764	chrome.exe	91
PID 1764 wrote to memory of 3732	1764	chrome.exe	92
PID 1764 wrote to memory of 3564	1764	chrome.exe	91
PID 1764 wrote to memory of 3732	1764	chrome.exe	92
PID 1764 wrote to memory of 1804	1764	chrome.exe	93
PID 1764 wrote to memory of 1804	1764	chrome.exe	93
PID 1764 wrote to memory of 316	1764	chrome.exe	94
PID 1764 wrote to memory of 5116	1764	chrome.exe	97
PID 1764 wrote to memory of 5116	1764	chrome.exe	97
PID 1764 wrote to memory of 5052	1764	chrome.exe	98
PID 1764 wrote to memory of 5052	1764	chrome.exe	98
PID 1764 wrote to memory of 2112	1764	chrome.exe	99
PID 1764 wrote to memory of 2112	1764	chrome.exe	99
PID 1764 wrote to memory of 2988	1764	chrome.exe	101
PID 1764 wrote to memory of 5088	1764	chrome.exe	102
PID 1764 wrote to memory of 448	1764	chrome.exe	103
PID 1764 wrote to memory of 4136	1764	chrome.exe	104
PID 1764 wrote to memory of 4136	1764	chrome.exe	104
PID 1764 wrote to memory of 4628	1764	chrome.exe	105
PID 1764 wrote to memory of 4628	1764	chrome.exe	105
PID 1764 wrote to memory of 800	1764	chrome.exe	112
PID 1764 wrote to memory of 800	1764	chrome.exe	112
PID 1764 wrote to memory of 4676	1764	chrome.exe	114
PID 1764 wrote to memory of 4676	1764	chrome.exe	114
PID 1764 wrote to memory of 2864	1764	chrome.exe	115
PID 1764 wrote to memory of 4896	1764	chrome.exe	116
PID 1764 wrote to memory of 4896	1764	chrome.exe	116
PID 1764 wrote to memory of 412	1764	chrome.exe	117
PID 1764 wrote to memory of 412	1764	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lmu.riayati.ae
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa415dc728,0x7ffa415dc734,0x7ffa415dc740
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1576,i,8735373155568108597,18314050303753579635,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,3970127034779399386,7426731108212754063,262144 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2356,i,16062430995845233895,14208411710765512508,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11893179631024590191,9549629770981093317,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,17442391257214245244,6342573617797290848,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,6151570844075198088,3555812693484058066,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5348,i,461043176038414434,2684242020872338698,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5368,i,16891700593054347972,17119517149614717965,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4636,i,5314817412509480466,2013815588203793664,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5580,i,16870681113166221341,365647814388465863,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5380,i,2050908796471601454,11285720415854933250,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3340,i,9551046005104721966,17412485639033500499,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5368,i,7352194335565540264,8777738954802387388,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3328,i,9598621449413302167,5119303402449528276,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5384,i,4925650858604727240,12763898184392075546,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3508,i,2141332907281046466,14451199370051469864,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4904,i,10096839092158595412,1476937680552240434,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4404,i,8635450291628655876,13481651054979157009,262144 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5560,i,12521257286041877218,10199674881641266573,2097152 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1504 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4900,i,9669933442227875373,9791641469887257859,524288 --field-trial-handle=2032,i,17936954144197963889,9746081811259407956,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 513fd1122423abe96978b9248aac2eb3b7d7916c0cd5494e0a11a35c346984f3
MD5 9411a4f62189afd83a3359cec51ff4b2
SHA1 190e1ee9031141b2e4b43206a7cd1169eb7ad5aa
SHA512 a1c5b6c808b0fb22b84a8b102b4c8063afd849a80247eb297ccda078d8d6f0f95956766abbd30dbbec23f57d6874c530aa96a6a27557ba8fb5c47e9bb9653a8c
TLSH
T10DE02B6DC963EC6B24FD0B19B0141782D754135B2A40894B7B3CC20C8FB96374585CBC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 94d6d502492cfa369bf1bb426e8dd6ec7aaf42787a48db8784c742ef8ab7b74b
MD5 b891df62691029830460dd983f65bf4f
SHA1 31786dc4a9ce4ff559b39e8d7c1f8cb4ac7bd399
SHA512 e15a7322bfaba32202898a3183aea1b638f618cc2d65fcf820837da7062fe28c9e982d6275dab5b2034c706ad96c840b0685e76f6d2b3ff09960f9158a2f77cd
TLSH
T12F416CF793B4997E8A1196E4EB15AF1FCE690624031C3CA6C9D4AE1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 149383bd2137abb4017317e74e8735607f95ec72b1ed648cb0b6d4dc9f43ac7e
MD5 9137f7ef010cb2df1b85db89892a9629
SHA1 a5b9cb258bcf72116cdab2fc2acd5f5840f75618
SHA512 fc3f21eacf8617482527971616645f0a9472c712bf6943f131bd96155735a981c82c333097be5165191937bfab265c2693af847006001883d0d8a7636fafff4a
SSDEEP 192:IRPSds0qkk8Avv70pAPRp2dGd9+Hsb+WNn5gtxO20gVMxkwnXVyIsnAUgE:IRPSdLqtngUXt8wi62NVMxRE
TLSH
T15C42D82EBA10697BACDED21AFD227B12D7F6102265D11E40E6FCCA2C15DB5CC2327417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 658bc27ef37053040d787fd4dfa5d0e5fdd55f532b2603b892b74ba1b7ab2790
MD5 b7037316b52a024f2682429515994a2d
SHA1 b0e79dcd326bd8e5dc57b0bc5baaa9592ab3ac30
SHA512 6cf5f6194c003ec60c34baed7e7d7822ff282583374f0c1536bc9ce36eb593bb0b3719ee787fe27090b4bfe0843958368ef291089cd89b87a0734471481e2a18
SSDEEP 192:IRPSds0qkk8A5v70pAPRp2dj9+Hsb+WNn5gPGgVMxkwnKVyIsnAUge:IRPSdLqtZgUX68wiPrVMxqe
TLSH
T16D42C52EBA10697BACDED22AFD227B12D7F6102265D51E44E6FC8A2C15D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0a5cfdaaae8fd9312be5229a37d56496d8280a9813974622e9905a0b5f3cd56b
MD5 dcdcc458fcc563d0b71b100cf9825ffa
SHA1 d7f2e61cc6fdbf13b3521c5ea6a4d4c6759cf99d
SHA512 e74d50c6d6b283c7c320b1223dc7567bfb3f182a4610aa3ccf2f1af9a600d4dcc0191737393e74b51563b5267fe6e675ba6bd43da99ba6e84d49f771f4afc61d
SSDEEP 192:IRPSds0qkk8Anv70pDUPRpwvdGd9+Hsb+WNn5gtxO2xgVMxkwnjVyIsnAUgE:IRPSdLqtvgUXJ8wi62+VMxlE
TLSH
T1BB52E82EBA11597BACDED21AFD227B12D7F2102265D01E44E6FCCA2C15EB6CC2327417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8382ee091596d16c2a0ba8dac2d9320c9e73eb51b7d9dca20e7f18b8a386793c
MD5 2d7f6da7ecf29024eedcfadf5dce49e0
SHA1 cc56cb850d4f44782727ef292ba3b23c2aed242b
SHA512 0fa049bccde34521492b2f8728dfea47d1f7f1a2f328e6425cad71a571ff12e51e3adb0d9f7b59ce9043e8a9e8759897b8f9c5a5d97f6db65c4cb15e8b7042cf
TLSH
T1A2B01281C4515601C02202F4115318887154EF11960B2F0643E0F93ACC295508418050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584f15.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584f15.TMP
Size 96B
SHA256 ccc78995fe337ea53efebcc86236dd23222b14b33bfec22def91094107c6df56
MD5 852d80ab9ae6cfadbfb0d3aa67e00e57
SHA1 6ccf18480cf822e221e99f8fcabb6b2fc5786147
SHA512 edf89fa37563eafb102ba46afafaec2ec49cce6c3ff9c0d297a8cafa0680f61d00c163e3376a37ee1d283fe85496f5d9d1398694e961f969a0a666f5505da19b
TLSH
T128B02280C0022222C00203B028C08ACC3020EF28C203832AC2E02AE3CC2022000338A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1caadb6430cba03bee56cdf862b74846d9c3937b374a3fd3c34058e7e0946f04
MD5 7c6e4f238640f4414037c27cbf8fc482
SHA1 599d8b821454d6f67a75550e2ca5eeebffd2a5da
SHA512 ab3dc8eae71e48e99ac59a54aa52cb6d95c673476ee8f20a09791afdbcf6ac6e300e92f4b3ed328f3f5827cfdfd50b3d341bae80ffe5ce09536dd098165e799a
SSDEEP 1536:01XyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:w5qfd7NtZL8cHQRZEQ6Sps3
TLSH
T190C30237EBC21E339DD2DB64B5130F9793F604A9D034D305EE6D37AB6883555644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb886a292669b3aa9712ba80e57d00fb4f27ad6b3c1a63b026fc6f860cad1435
MD5 46babc3db3cc03b69f479faf9879da26
SHA1 c8867d1382c280fa0fc8fd3413b94f504834e0bb
SHA512 5154e142a9a9cda0d9f8b05ec1aec95b5fc7737e011c46e3950fc680b64d107476fedc2e006c1038a43a7680036c1c40edb10b7b7248ba1d36710f6897ce78f3
SSDEEP 1536:c1XyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:45qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BBC30237EBC21E335DD2DB60B5130F9793F644A9D034D301EEAD3BAB6883551A4428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 991a2a3b4c6f5f6b25c2ab00f2addf8a768c1173255db05eece6d3707bfffa03
MD5 7bcdd7f5053dea5f67835ebb7b671a8b
SHA1 bd0b83b694963c8941f3b3e203045a3f9c9bd907
SHA512 11a6613b357368c42860813dfd249ad483897718f1ec38f0134132ef807785c4985944f5a88b66527849fba5e486c9003746032c21fb268a29e17376e520258c
SSDEEP 1536:bkLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Yqfd7NtZL8cHQRZEQ6Sps3
TLSH
T105C30237EBC21F379D92CB64B9130FD6A7B644A9D030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a0c17920dc563de93b6c862350bfbc64f574191f68197255dd2e476a9e141cb7
MD5 654378e3ee0da5b3de761871aca31b40
SHA1 2966f8a84d97fa05d6c837df41966aa2897157b5
SHA512 c1fe42d390283d262e7e966b701d409f0af7747666d7898441a98bf5f431f7418f9bde85b6afe871d01ba6f723fc459f0582dcf6ea3faf9ae387e17247239dbf
SSDEEP 1536:cZdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:QDqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1FCC30237EBC61E335E83CB74B5130FD7A7B644A99034D301ABAD37AB6C8359165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9c8e1388e06219a6d60b2cae542b437ffeac3b4250471be79e3724ff6f3c9892
MD5 08525475e1025aa11e6397fd9dfba4dc
SHA1 a0a8fe3a54014c69e9c34f7b6868c9b5c8d5e042
SHA512 fee14cb5486517ae8a3da7468129e43a9c18acc7522471420a1806f0cb5780b70d4cb9df788a907af31fb7da982084ce2a0cfbfcc84b3fe9cc2969118300d165
SSDEEP 1536:hZdyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:rDqfd7NtZL8cHQRZEQ6Sps3
TLSH
T191C30237EBC21E335E83CB74B5130FD7A7B644A99034D301AAAD37EB6C8359165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download