5d586f8e90eb256f3a3c23a270b786329d6b9bb727ced4fabfaecf3f676bf2df

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 50KB
Sample260711-rs66eaet2z
SHA256 5d586f8e90eb256f3a3c23a270b786329d6b9bb727ced4fabfaecf3f676bf2df
MD5 621e583bd060fa6b0783d03ee9758541
SHA1 7418fc44794c426749d6ec41c52f7c93bfeb3166
SHA512 d23a5170294c1cdbfbcc283e4a46b40b5d0b89563c165ef0757fa1233363f5afe1c5d142af77a8a2135973691701a0f09c931c4d6c262ac128c8cac5f674dadc
SSDEEP 768:shz0fGHBiAio/tDJVHn8ZGSvIWzHGtL6+:s2+HB4yDHn8ZdIj96+
TLSH
T16A33A51A56B210366437A1D13BA6775F7795E043E40AEA6836FC418CEFCA9ECC923748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3216	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282537258841329"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
2320	chrome.exe
2320	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 5440	4744	chrome.exe	85
PID 4744 wrote to memory of 868	4744	chrome.exe	86
PID 4744 wrote to memory of 868	4744	chrome.exe	86
PID 4744 wrote to memory of 3216	4744	chrome.exe	87
PID 4744 wrote to memory of 2664	4744	chrome.exe	88
PID 4744 wrote to memory of 2664	4744	chrome.exe	88
PID 4744 wrote to memory of 1296	4744	chrome.exe	89
PID 4744 wrote to memory of 4904	4744	chrome.exe	90
PID 4744 wrote to memory of 1296	4744	chrome.exe	89
PID 4744 wrote to memory of 4904	4744	chrome.exe	90
PID 4744 wrote to memory of 3908	4744	chrome.exe	92
PID 4744 wrote to memory of 3908	4744	chrome.exe	92
PID 4744 wrote to memory of 5976	4744	chrome.exe	94
PID 4744 wrote to memory of 5976	4744	chrome.exe	94
PID 4744 wrote to memory of 4492	4744	chrome.exe	95
PID 4744 wrote to memory of 5468	4744	chrome.exe	101
PID 4744 wrote to memory of 5468	4744	chrome.exe	101
PID 4744 wrote to memory of 5156	4744	chrome.exe	102
PID 4744 wrote to memory of 5156	4744	chrome.exe	102
PID 4744 wrote to memory of 400	4744	chrome.exe	103
PID 4744 wrote to memory of 400	4744	chrome.exe	103
PID 4744 wrote to memory of 5408	4744	chrome.exe	104
PID 4744 wrote to memory of 5408	4744	chrome.exe	104
PID 4744 wrote to memory of 5716	4744	chrome.exe	107
PID 4744 wrote to memory of 5500	4744	chrome.exe	108
PID 4744 wrote to memory of 5588	4744	chrome.exe	109
PID 4744 wrote to memory of 4928	4744	chrome.exe	114
PID 4744 wrote to memory of 4928	4744	chrome.exe	114
PID 4744 wrote to memory of 2212	4744	chrome.exe	115
PID 4744 wrote to memory of 2212	4744	chrome.exe	115
PID 4744 wrote to memory of 5988	4744	chrome.exe	117
PID 4744 wrote to memory of 5988	4744	chrome.exe	117
PID 4744 wrote to memory of 2320	4744	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd78cc728,0x7ffdd78cc734,0x7ffdd78cc740
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,13365384023466743667,17697036706741002826,262144 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12305986110708355201,9546330722702756209,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1675521276664780730,678632192747145012,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,4721434086537896866,5272879662994615336,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,545834396429120433,3481126498912470601,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,14099411349493844246,11110728450472688816,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5152,i,16377828002486463740,10661763271849375067,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,3031923640616447532,1232862761866867604,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3236,i,11574023051169854805,15373200360897118923,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5828,i,11396552097116328092,11372818223727910932,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,10816896135965695076,14677505464768136609,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,14972711628739866206,10166006729846144490,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,6370003677986441407,5558386506344432084,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,3115781863124912293,2593935904345056478,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,4407489188058793301,16553294535370278890,524288 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4488,i,3983998800035216699,7988463250010319960,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5164,i,13394303308307104373,17483685599338837182,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6680,i,4149426748871738220,839736309728781526,2097152 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,6194654230338608261,2023829340061668392,262144 --field-trial-handle=1996,i,16370123688780376616,12929679682367596193,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d92cfa0f53942aba23e2f5a2e57c890168dcdbfbeb3696d2eff3bd68f233ac65
MD5 91572daff5306a8077bd74da8242d22a
SHA1 1624a25c053b3f3aef9ff8a1324c778b25a1c68d
SHA512 efc673729f5ca6b0595b97c109ecd407de278c2c70323e238f94f6d0871f9c9ddd39d5cd7d7eaf3a694e16e2c11bf7e76012d21cf1b1cbabe38233ae69086403
TLSH
T183E02BAACD61DC371DFD071CA0550745E65513173B40894B3F3C95094FB923A468785C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 eda79559122a2cd8e668ca1af6c4042e5b88c6b280948b52b3a44b50bff5df10
MD5 a3d2d9d61cb21246cb9603f790d8d56b
SHA1 d2b72ce94dd041917d0c266157ed98cb6064091c
SHA512 7c547693a5a343fe5c65f24ca1d44968e53957a2a37cb31a1ef9d3dbf6a5a5798dea9af33f96911e9c581adc0c3f4ddc0534488a185dcbcd8d85e6a9ba42dfde
TLSH
T19301466DB2622193DB7BC53422FA1920E27C5A543A77173773D00CA02D12B76D1C1415
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 0fb6fccbce5756f09165155eb37e806d18b7d3e65dafb87997783f39f016fc06
MD5 05f3491e6a582de0e9902585e6cab232
SHA1 f433c3d6a51239088060edcc3107cd2dcabe6b9c
SHA512 271357e54b1abae220db527b4e73151a1507c45d96253af76f9ab09f52b32f234c7cfcbf66aaf556e56a042f2827f32dcfd255bf0810ae8c8658a3f7862b1a4b
SSDEEP 192:D14784mhJXJZFTaax+qISzrOjhG476sPaPOvLfP4I03SNPdnsWRGpvg:D14784mhJXJZFTaax+qISzrOo476sPae
TLSH
T15612AFF7C3E8866D891156F4AB256F1ACE2E0928432D3C67C8D8FE5F93E1471E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 baddcbda2c0c09ef4e1b2d1bc3b78b5f9c091cb73ba9883ac79ed83afc0b4a81
MD5 8521a3b30c167bd940bfbbfc5040d065
SHA1 f9164da991872d9718b031d1cf604764fa5beb7d
SHA512 8a294abe934202c71cb0f0719879a4b334e018ae630543df9f5d8f8d9c81333528b5cf38a8b743cb578580418c019e78d82dc0418e1deb0010bedcd251ccfa65
SSDEEP 192:9R8cBzLH15aDp9v71hhBPRpTAFM8eX92Hsb+WNusdzZ3kMV720VpWng46YVyIsnv:9R8mzLXW9BhXXTZQwNO22EpWY8E
TLSH
T1CD52C56BE920597BACDBD226FA157B97D7F1202565E01E84E7FC8A1C04E79CD222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2768fd2e849415ebf88dd21887c92e0bf6c6fd0cdc1de964625c09e81092c22e
MD5 439d73ed603c21d5732756686bed0811
SHA1 8dd1ddeb3af7f2e94ae4f65a57d58a5a46ddf81c
SHA512 ac6e03f03120456f5095a371f2a5a603a51a2353b593ab6b18aa997c4b11d2dc33a48293aaf8a498077f0abd1af5d40a3d07d7622d053025da4509b696c0a988
SSDEEP 192:5RcL+15aDWjv71hpAPRp2Om92Hsb+WNnnTPWVpWng46zVyIsnAUge:5RcLCbbBhUXuQwTPupWYVe
TLSH
T10442D56BAA10697B6CCBD22AFE117793D7F6102525E51E84E7FC8A1C04DB5CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b6dc6afdbc5dcd8bcc73c32594ba2cadfbe4cb320b8fc647ce7793ad8ff809bc
MD5 03cf4d73c8aa87dee81020908a665589
SHA1 5514cb8ce3c5513205b3fe1c8f409b1998e290b8
SHA512 435e17425dbdb3f7bffec683b30db738ddc29ec559c329bd23e5bf45b6b5e295123cdeadfebd0272642a57b38ffb6a11cd3e6273da979fd27d040ebe6e46008c
SSDEEP 192:9RcLH15aDW1v71hhAPRp2Om92Hsb+WNndz0eVpWng46cVyIsnAUgE:9RcLXbFBh8XuQwh0mpWY4E
TLSH
T11542C56BA910697BACCBD22AFE153B43D7F1102565E51E84E7FC8A1C04EB5CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9fc1cb573ca3adce802e41b218c1afda6ac2a8643da70714c18ac4e567278d1a
MD5 348d6f0bc8eb69c42942bb2b788422d0
SHA1 b4cab116871dc37984e0851dbad855318f9d6e1f
SHA512 aa91ecb9abf9a69ee50afb3eab8289a483bea94dbd5b3b018f98ec6942f9161105060988534ab1a6fa8b43aed5c3de203af266595ce6e907beab3e86bd13d4ee
SSDEEP 192:9R8cBzLH15aDprv71hhAPRp2FM8y92Hsb+WNndz4V726VpWng46cVyIsnAUgE:9R8mzLXWTBh8XrQwhK2apWY4E
TLSH
T16952F66BE910697B6CCBD22AFE263B47D7F1102565E51E84E7FC8A1C04E79CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7071a5a72f11d49ee0a126b8e6e5268d8f8cccf0704637c4c68a8c9d2b5772be
MD5 bcacf2ae971dba9b34bba462a7cc6901
SHA1 eaf4920d7c0d226a50dc7f7a794d3c65943fb2da
SHA512 00c64d19d52c0b292bf1fe6f2ec53910f6c00f5f37ed7a235d0b828c9d835591103d55093eaf9c62970af77c221e1501b1d491a2d0c04ebebefb28cb53562227
TLSH
T1FCB01280C401D201C00642F45143249CB1149F11971A1F0243E06922C8351B081151D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583c68.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583c68.TMP
Size 96B
SHA256 9c867d1c434f88e096c995a2809822244ee14a728960abb8cb315d436f8da464
MD5 b4477e942c038f3339e3fb97523f2b7f
SHA1 6fb63013a83b4c7298e5d0bdc0d5c470048b7236
SHA512 6c6cb61c75fefd41ad916b2d42244ec6191847b6afc351efaa2810c758e523902749ecb254a0961676d184298b1d756dcf8737a361ca1b055153f52d84742449
TLSH
T110B022E8C0022202C00223B028E08CC83C30EF22C2032302C3E00E22CC3823020BA320
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 d524771c0f82fc4c360ff247bd2d42f10e4f97caff4e6ba066aabb972724688a
MD5 e1e4106eda330de9b6c4f3d9a0db1764
SHA1 617192ecbda5400fcf48042313d40ff7214625af
SHA512 ae5a5e84e1126cc454d282182e73d4566b443f946ddb959198e6934ea99efc9612f565795c8edc75a20d3ca5f7070ceba2a36bd01b14d73ee5e06f19c1663c34
TLSH
T15CB0026D33953F4BEA198B7013EA25923B3C5D14176B810E74E98065C9373A2B512745
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 894321b267e7498a5ec70de3771d7f28bb8781ee714fb69c551fb240012f9934
MD5 4a6d37df2514fc48c80cf1aac0dcb656
SHA1 9d0c980922ed4e6f88386c47a81b14883d24b44b
SHA512 9759bca0434c031f57a04764ab3f2d0860a9e4a98556be96d0761defa302f27fc39c8ebabc80e8b9fc7f39cfd69b9f60bd996fab35da5ac8721cc097d4d7a5f9
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Em7Rkm1tYpBeh2BAo3
TLSH
T19EC3123B5D75A8375DB9BB1EB04E0B1F1DF24AA6C930DE52C8D85B0423EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0bd24a76de803f6b51295f096ba3c684fef742a5989d73fc750644ca7aedf7aa
MD5 4a0ac586947f0a2daa88423fa77e77ed
SHA1 04b8e9e23d178d22f0bf583403e2922528addb75
SHA512 7c29cc2c829c03b160d739ae92487f1e2e6604a22082c223ad5230346485f6798ad523719bab6c1e0ec5ea43c9fbb9ec5951b16d11f8a072499355b31bbe7465
SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:7m7Rkm1tYpBeh2BAo3
TLSH
T124C312275E75E9375D79A74EB08E0B1F1EF24AA6C930DE92C8D85B0437EA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6ee55bddc8d99ba9aa3cfe5dd7c50b5d073a297efd9c235c94dbfea2b1ec1cf1
MD5 21eb6053bdc069c2a2c7ce1817c02483
SHA1 e671a5527f0f2b4979bc1dfdd88bc1b4545797be
SHA512 7e29b1ce1e9660c1b0cb50f9e0ca5ea579b271db774f16ddd6d3809ebcbea9b06b0b634b7b3343e4d15207b25bfd36fdff4032cf04d6157fd961132d8716d683
SSDEEP 3072:zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Km7Rkm1tYpBeh2BAo3
TLSH
T159C3122B5D75E8375DB9BB1EB08E0B1F1DF249A6C920DE52C8D45B0423EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 00759fa550bbdc539dac6d2d1670e6116cd54d829d65d240da3b7b30fc561df5
MD5 db038bd43dad8347b82715c0d173bb50
SHA1 b7c4b560d7c783927a0cd5998dbed27fd2061b66
SHA512 21ed7567aabef5192df1a96db0bffa5f7061b7401115b3d9577973091b5b63cabf4391214065af2f53b52a8588673306e7b45168076cbbc7cba1c1e132dda79c
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:km7Rkm1tYpBeh2BAo3
TLSH
T155C3122B5D75E9375DB9B71EB08E0B1F1DF249B6C920DE52C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download