hxxps://meet[.]google[.]com/linkredirect?dest=hxxp://www[.]google[.]as/url?q%3Dhttp%253A%252F%252Fportici[.]pw%252Fdxter%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw0SGjeL9PFKDorZVFlAK9jD&source=gmail&ust=1782918321746000&usg=AOvVaw1Xm-KRbi9zgklmWqFI_poF#?dfhjfhddjdur=amJhYmJpbkB3aWdnaW4uY29t

Analysis

max time kernel
299s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://meet.google.com/linkredirect?dest=http://www.google.as/url?q%3Dhttp%253A%252F%252Fportici.pw%252Fdxter%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw0SGjeL9PFKDorZVFlAK9jD&source=gmail&ust=1782918321746000&usg=AOvVaw1Xm-KRbi9zgklmWqFI_poF#?dfhjfhddjdur=amJhYmJpbkB3aWdnaW4uY29t
Sample260709-aejphsaw8r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1744	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280292784251556"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2064	chrome.exe
2064	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2516	2852	chrome.exe	85
PID 2852 wrote to memory of 4504	2852	chrome.exe	86
PID 2852 wrote to memory of 4504	2852	chrome.exe	86
PID 2852 wrote to memory of 1744	2852	chrome.exe	87
PID 2852 wrote to memory of 892	2852	chrome.exe	88
PID 2852 wrote to memory of 892	2852	chrome.exe	88
PID 2852 wrote to memory of 3752	2852	chrome.exe	89
PID 2852 wrote to memory of 3752	2852	chrome.exe	89
PID 2852 wrote to memory of 448	2852	chrome.exe	90
PID 2852 wrote to memory of 448	2852	chrome.exe	90
PID 2852 wrote to memory of 3024	2852	chrome.exe	92
PID 2852 wrote to memory of 3024	2852	chrome.exe	92
PID 2852 wrote to memory of 4472	2852	chrome.exe	93
PID 2852 wrote to memory of 4472	2852	chrome.exe	93
PID 2852 wrote to memory of 4912	2852	chrome.exe	94
PID 2852 wrote to memory of 4912	2852	chrome.exe	94
PID 2852 wrote to memory of 3688	2852	chrome.exe	95
PID 2852 wrote to memory of 3688	2852	chrome.exe	95
PID 2852 wrote to memory of 1988	2852	chrome.exe	97
PID 2852 wrote to memory of 1988	2852	chrome.exe	97
PID 2852 wrote to memory of 2868	2852	chrome.exe	98
PID 2852 wrote to memory of 2868	2852	chrome.exe	98
PID 2852 wrote to memory of 1212	2852	chrome.exe	103
PID 2852 wrote to memory of 432	2852	chrome.exe	106
PID 2852 wrote to memory of 432	2852	chrome.exe	106
PID 2852 wrote to memory of 4312	2852	chrome.exe	107
PID 2852 wrote to memory of 4128	2852	chrome.exe	108
PID 2852 wrote to memory of 1756	2852	chrome.exe	109
PID 2852 wrote to memory of 3988	2852	chrome.exe	114
PID 2852 wrote to memory of 3988	2852	chrome.exe	114
PID 2852 wrote to memory of 2416	2852	chrome.exe	115
PID 2852 wrote to memory of 2416	2852	chrome.exe	115
PID 2852 wrote to memory of 2064	2852	chrome.exe	116
PID 2852 wrote to memory of 3384	2852	chrome.exe	117
PID 2852 wrote to memory of 3384	2852	chrome.exe	117
PID 2852 wrote to memory of 2164	2852	chrome.exe	118
PID 2852 wrote to memory of 2164	2852	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://meet.google.com/linkredirect?dest=http://www.google.as/url?q%3Dhttp%253A%252F%252Fportici.pw%252Fdxter%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw0SGjeL9PFKDorZVFlAK9jD&source=gmail&ust=1782918321746000&usg=AOvVaw1Xm-KRbi9zgklmWqFI_poF#?dfhjfhddjdur=amJhYmJpbkB3aWdnaW4uY29t
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7ff89f5fc728,0x7ff89f5fc734,0x7ff89f5fc740
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,17761680355706106332,1492872990758781572,262144 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,7195353367365678313,929810753420539606,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,11962664365969557790,6901228631304877210,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,829994007530883073,3260118584860798792,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,1962426166497708288,9147173598198111293,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,14621319070041238918,12368145424198377437,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3920,i,9337855814292263277,8664877702332634708,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3896,i,10722295834491581288,5165642733191431177,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3136,i,12674406091172592969,14174568964274373559,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4988,i,12226211438492587666,11633705105408839199,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4884,i,2383278811493481934,5053373329481158944,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,3968372157983629455,5527302231212961459,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6152,i,7252179729857899159,10637330150712570617,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,893861337952795574,5630314280539660044,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,2437114406874489880,7628665460246682357,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,8523594770350004002,7719505889699606941,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5608,i,379109063875508742,6007761774899973498,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=804,i,10008429090606200480,9829941697566155682,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6204,i,1570087507732595843,8170312897469013057,262144 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=808,i,10339451850766635059,17450547620509523652,2097152 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,10747009853519664151,14759983043297555068,524288 --field-trial-handle=1988,i,16127547804727904975,6194784945466806363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:2164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 be833ee301635ae06ce6820b4f0e719075008994cd6882696efe6426b0ac0ed3
MD5 68c68b93ff17cd6de2c0a528da74e575
SHA1 c8647a58d8910125ea899df4361327fb725c80b9
SHA512 2fbca7b682fbcc97f308c9ae622bdfcb8f0d59e1cb0c8e392943a8ffbef2032b093c0d731a07673110df9d97467455c519724e3f220bfe2e8e4652758b13ccbc
TLSH
T16FE02BAAD8619C2718F91B282050474AE74013173F90C80F7B3E820C8FF5A3A41B692C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4c9179266c10039ab6b7bc1a2d2549113bf62a4eb03010606a5f4f233a84c6c4
MD5 c610bf451f5f619593909154e0d2308d
SHA1 0f3afddef1b70e959007f3a8b70bac8ca3ffae6c
SHA512 5e5ebabe71d5be8e5336d2c71d477e2ee3f8faa5fa6f840f094dbd9ef4902464b18f4d288a2fda6297db5a2fa50f0127f8649327f2902e89a966eb5f30a5247b
TLSH
T14B418BF783F4D57D891192F8AB156F1FCE690A24131C3CA689D46E2B97E2872E10078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b416c53fc86eb5f124bcfda8ca26e096822b24b60135cb879070b6070b77c93
MD5 137e31cf7de7e3d340363ab70421163c
SHA1 54f09c55cdaf3130e1b580a4bc1125ae8a51e998
SHA512 4e32955ed926804b10bddd467e0b4b4e96f1fab92afc0f33967c9a2888c7c5a2dde3b1f0e86fcecb624b6e63bf85d1b43971c588b59efb6f472081613ee5787e
TLSH
T12751ADF7C7E4D53D891196F89B156F1FCE690A24531C3C66C8D46E2BA7E2872E10038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 229ba9c842fd495ee62f3973ffd47741cc7d20c24623e3faafe11537d2c08339
MD5 d0f31c898ab8b3e09447e613faeeac58
SHA1 6c626c79bf47283ed9bfd4ca0bfa23d9a0c34709
SHA512 4dbb4fed36f53e2c58ad122802acb79e83578eb93a2ea94437c2bfb33b8b2be792b8f0a37f247f0a0006690651e223f772d57fcad581c8f23717bbc10baffa10
TLSH
T11571AFF7C7E8C57DC91156F8AB156F1FCE690624032C3C6688D4AE2B97E2872E10078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8c621cf366a96cf47365986ff75ca241b1905e85c7520a6659c9e2d788004c85
MD5 4f72e1ba74cfc0bece9c564f1b68f34c
SHA1 996ee4393f23bb411e80619b53abb188ffdd2f2e
SHA512 5237e14d7d5e56138ac192a0bc02508056989bb58ee7fe05f5bd493994ebd483befc8a07310f3149855ce7d73cd252f38e0359919bac82080b427e5e4b96fe95
SSDEEP 192:4R+tCWzy686v7cpAPRp2qRwAE9BHLXb+WNHhEGZi526D2GEraIIVVyIsnAUge:4R+tB2WwUXlmr5pq2M2fahDe
TLSH
T1BC52B81FA92069775DDAC21AF926B757E3F5102226843EC4E7FCCA2C14EB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8d85fef6af74fd9f80ffc00fb15aef1c8ac2ab234c70184d1dc4f7754e36b2dc
MD5 7e8797c26ed98dec56f80680ddde4eeb
SHA1 f2e92b7080eb99d4109e6c3450c77963808b415b
SHA512 b1eb5f3e3d681c9b888b75d70fc399ec71639f310a11f77922712fb1c27820018b9b9d19aeca4e553f7d38bb6d53893fa23475b57b670b85e226f6a7370e793d
SSDEEP 192:4R+tjWzy686v7cpFPRpBqRLRAE9BHLDb+WNHhEGZi529D2GEraIOVVyIsnAUgE:4R+tK2WwbX0Nrdpq2J2fa1DE
TLSH
T13C52C91BA91069776CDAC219F926B757E3F5102226943EC4E7FCCA2C18EB9CD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b3e9df45816e8efd915054f4f6e2be528e9a5900416c251bd038d028855c931a
MD5 982e4b849a21b98c50c95e689e8d4a88
SHA1 5e0fcde9dd35f9bdbca87d6976232f1bccfbce40
SHA512 90fb2179b226a5376968353243b738fca8e5ef53c70c2277e895bbf40978859164d7f420048fea3672b2f0e6a814026ce58c7e16f74d5768b51b9b56042135fd
TLSH
T1E7B012608041A111C48202F4114214887514BF10D60F170583E06D22CC2A1D0801C061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5904a9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5904a9.TMP
Size 96B
SHA256 ef5eac83309eb288ec64d52f848688694646837404c67f7453e5cb8531ce04b2
MD5 328a20c0e0dcf665abd30f99a3c9d687
SHA1 50747a011a32ed1e0203df66c0004284c88bb484
SHA512 9b5b3d8e169df889f1f3e4dbd3c3e1712a8bd057ef3d3b9310dae2c3002aff3e0d72927fe301797c3315a4d8f60ee303ea46667ed3d2f7264e0f9ec33994c623
TLSH
T167B02202C203BA02C08303B02888ECC83020CF20CA03A282C3E00AA3CC202A00220020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1386212b57be34e0e401581ff18f0e72e7823e54e115c16716a3c056c561be36
MD5 04cd65d0f4d522f4d47e0e165edc7537
SHA1 b3defd6a046be6c23f4bab7eb55446e10573142d
SHA512 cc67ee73e1feb6a8ae677046dddeaa125907aa23c04d593736d18e8d8d482238c267171965d1a872a67b9e04b6703fccc0060aa76f633dcee31840c68219a94c
SSDEEP 3072:SSwIdFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:LwIdFmUi21rSm8uUVNSlzY/
TLSH
T11DC31210B9A3B8B3FE9930447BDF2A158D680E418290C60156739E415DEF3C66FEBB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7613d5e75fb7f21226d6cc57061098bf048678b44b6cb29bfe4ce9ee825922a7
MD5 65e6ad970c612646116cb3b803679c33
SHA1 7f05e0e2c09ea9e2c7000b55fd6667963544d443
SHA512 5c0af63297af30e188838defc3f4500695dd5ace64c33bdd891a422b4d66ce71ac648299b6b2aa61542332c4fe00d438b3ae445c0f6cf623b3fd83a18227d0f3
SSDEEP 3072:SS4IdFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:L4IdFmUi21rSm8uUVNSlzY/
TLSH
T163C31214B9A3B8B3EE9930447BDF2A158D680E418291C60156739E415DEF3C66FABB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 02f9db1ed97dafa5e7504fbaeefae123b66969e62f65a706dfd0a2af8973e1d0
MD5 627e48b68afbb7241f618dbe44a31ca2
SHA1 07d00e53b1fc4a80833e70d3b1a0e0dbe19fa68f
SHA512 712eaa03faabff4c02d0c4637c53db114cdc6d187f9f7b860a5f653ebf59f312a29f8edc74d837611ec805b4ec0aa85e657e0510285e9638a8df550741b20832
SSDEEP 3072:SIFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:JFmUi21rSm8uUVNSlzY/
TLSH
T16CC31304B6E3E8F2EE5930447BEE2A145D6C0D818291C6415373AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8c430864881439ca12932fa053c6f2ab7d7ad456ab62c8f3c89dc60d92eb9ea7
MD5 81d320dd5e6e90ea370f477aa49faa2f
SHA1 b54dcd1f2e9e022aab280457cdac9b88d3ea117e
SHA512 9aae5d5de5180e783c6aece351a7069dc28cc9f62ce48c232afff0f13486b9fdfaf79454387a714308b0dc99a3e79750ad1bf4ea8e301a0569f77b6242c71c8e
SSDEEP 3072:SSvAFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:LvAFmUi21rSm8uUVNSlzY/
TLSH
T177C31314B9A3F8B3FF5930447AEE2A158D680D818291C64157739E419DDF3C61FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 df07107dd87ebd4c15e415a539b418830b6e4b24d1ae98dafa6675d16c7ac4fb
MD5 9ff5e97f31b17decb36cd5eaaf43c6ec
SHA1 2d6e149c00492c490ba4b798ada55d0ca0bcf11a
SHA512 a2d2c7953cc6e7c13cce94fb82939f5a95097ce72372517ced00d6ad65ec67e0dc4a6d31e15d26dbad22d277bbcdf974c77e1df029e6c2977d11f58141c92bd7
SSDEEP 3072:SS4AFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:L4AFmUi21rSm8uUVNSlzY/
TLSH
T179C31310B9A3F8B3FF5930447ADE2A159D680D818291C64157739E419DDF3C61FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download