1e4659b9ffff4ace079c3a008c107a94b1c02f7f9ddf595e231a20541e5e4367

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gemini_Generated_Image_czcsegczcsegczcs-removebg-preview.png
Size 45KB
Sample260712-sjc2mses21
SHA256 1e4659b9ffff4ace079c3a008c107a94b1c02f7f9ddf595e231a20541e5e4367
MD5 901577b8f1085597c62dfd8f415bfa5c
SHA1 1a51b841d662d8457a75a82026173da62af8060d
SHA512 58e4a4414de17d6ef45372eb63da0cb1103a81cacb594fe8f18d589096591f70593cd90a4fc4d8d1edd7f679dae34c3b59ad6a3e7f7a654bb81f60ebf1d2e9cb
SSDEEP 768:6ZMKbliIPqXHkMt2FXt0zE7GfAth/BDxD8s4agcyLt7TALcNzdGYohCy9SPJ7DS1:6Z3li2qXHknFXt0Zfs/Z18hBcyRTBGYy
TLSH
T12323017B89295DFF232391278CEF6357B5A0762A8CA76FA5434CE4B516073C9810DD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283426434555219"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{30FACF5E-EFC4-4235-ABE4-D61B90813D92}	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
860	mspaint.exe
860	mspaint.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
1536	chrome.exe
1536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
860	mspaint.exe
860	mspaint.exe
860	mspaint.exe
860	mspaint.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3680	3412	chrome.exe	91
PID 3412 wrote to memory of 5044	3412	chrome.exe	92
PID 3412 wrote to memory of 5044	3412	chrome.exe	92
PID 3412 wrote to memory of 4708	3412	chrome.exe	93
PID 3412 wrote to memory of 5108	3412	chrome.exe	94
PID 3412 wrote to memory of 5108	3412	chrome.exe	94
PID 3412 wrote to memory of 4288	3412	chrome.exe	96
PID 3412 wrote to memory of 4288	3412	chrome.exe	96
PID 3412 wrote to memory of 1136	3412	chrome.exe	97
PID 3412 wrote to memory of 1136	3412	chrome.exe	97
PID 3412 wrote to memory of 4684	3412	chrome.exe	98
PID 3412 wrote to memory of 4684	3412	chrome.exe	98
PID 3412 wrote to memory of 4508	3412	chrome.exe	99
PID 3412 wrote to memory of 4508	3412	chrome.exe	99
PID 3412 wrote to memory of 2848	3412	chrome.exe	100
PID 3412 wrote to memory of 4912	3412	chrome.exe	105
PID 3412 wrote to memory of 4912	3412	chrome.exe	105
PID 3412 wrote to memory of 2348	3412	chrome.exe	107
PID 3412 wrote to memory of 2348	3412	chrome.exe	107
PID 3412 wrote to memory of 3236	3412	chrome.exe	110
PID 3412 wrote to memory of 3188	3412	chrome.exe	109
PID 3412 wrote to memory of 3188	3412	chrome.exe	109
PID 3412 wrote to memory of 568	3412	chrome.exe	114
PID 3412 wrote to memory of 3008	3412	chrome.exe	115
PID 3412 wrote to memory of 3000	3412	chrome.exe	116
PID 3412 wrote to memory of 5016	3412	chrome.exe	118
PID 3412 wrote to memory of 5016	3412	chrome.exe	118
PID 3412 wrote to memory of 1796	3412	chrome.exe	119
PID 3412 wrote to memory of 1796	3412	chrome.exe	119
PID 3412 wrote to memory of 1536	3412	chrome.exe	120

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Gemini_Generated_Image_czcsegczcsegczcs-removebg-preview.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa849fc728,0x7ffa849fc734,0x7ffa849fc740
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9242445873572402020,14803605960924735634,262144 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13624031593006118150,10900878258357446127,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,11920968209643465634,10616476854218079399,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,9663837174975511612,4722902451127013299,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,8965134938643828337,9647096811975001595,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,10771757579300413177,2655815858369867842,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,13457265969404990288,54947290749367792,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,6818989617522150619,13183712689846636590,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5768,i,6293253288303854358,6104209954808647506,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4756,i,6576615892287940812,2602445436937256092,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,3628968048826825245,16314047480290055799,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,2712307418002236514,12082891396674718904,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,13055554766929353211,14698158454022589137,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,13684843439267862775,11398240905142269668,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,9408932284690417671,9836991050746451145,524288 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4452,i,3739906719868316864,74379957858291421,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4768,i,7801279737036463176,15578609227019664830,2097152 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6284,i,11149866836707612153,9430493149258769865,262144 --field-trial-handle=1984,i,8370339034490876326,4993120419858777737,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48867dcc668afe2508dc63dbe20722926da875807a6212cf5d8a63914117616e
MD5 bc41f18bda2ff4e5b2d8617c512b166d
SHA1 7dcde287d41f3b8f5935a1dfb0da6692e78154cd
SHA512 3d9a29f071ed6bee782f69c0432416da89336ee6e175cfc3f2551b9dc721f7884ea0f45619698205effb0d5aad23a186e25b7a72cca6898486085df001216649
TLSH
T10FE02B97C931AC3728FD075810914B86EB5613572B804A2F3B3CC30C4FB177A4586C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c50c64d36abe2675ed64a9cdb1598fd27402142630fc9d774e6a2b2f42108e2e
MD5 17b5c33076eb53d3b9b17899d39ed083
SHA1 c19242836824e5d65a66004c72fecf301b3ae614
SHA512 baa53f28363fe41837f5215af1265ec10ac7835465d3c275cca9544c0dadfad6429e25420f8165664f21c03ebdbbf24d7f2bab0ac117ee19cd58951e86d9cd48
TLSH
T11031665061D421DFDF5826393DA83D003B7D66790857AE43B418782D69E23D5A07AD35
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.lendingtree.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.lendingtree.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 36d783b39ca560a3d79a7088f1b04b9a4abe1bdbfb35e2fc2cf67dc7243122bf
MD5 fd3135af621d7872797f84e8e2db2dc9
SHA1 ba4edfdf34fa02ecfad75ee39b8f24cbfdccbbe8
SHA512 e4399c2a36a4f2024bc89b980b5d8551a08536d3d43e70b7694682f527a84bedd1c98ba0b115540b0dbe4af2a9a4d82db2f25ee6a927ce886b6899c95c998015
SSDEEP 384:DbcbSV261Bc6yedpFY+GeBXaI+W56R+9bdzgfiDX4coC6iVHrzCNBpn1ZyQIilOg:6DSl013XGsOY5L
TLSH
T18382B9F783F48A7DC95152F4EB192E1FCE690924436C7C2AC9E56E4FA3E2471D140A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 7e76c4ffc3c17b74b37d100fba9ec91356db437af9da53695726339d4f6e905e
MD5 cd836ff16f95acad74f49d44773d5e4b
SHA1 ba8089269b82c82a19994e46e0121f03d859eddf
SHA512 0e189a506a292f4dac1f991f050530172393e442dcc72f345716cbaf694f80646cae03d97f626d8e32686635620f7dcb28ca53888b676c9123ea36f1c06dc62f
SSDEEP 384:DbcbSV261Bc6yedpFY+G2aI+W56R+9bdzgfiDX4coC6iVHrzCNBpn1Za1HQIilOe:6DWl013aGGsOY5I+
TLSH
T19672CAF783F48A7DC95152F4EB092E1FCE690924476C7C2AC9E56E4FA3E2471D140A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f980e1802dbe4c7fd03e2c3068ef6779f5bda7394dc75e9eeefd29ef5d3f5652
MD5 15c1134fd96a726b10fb86aabea4ac70
SHA1 73d300b988f229ad7190143f699105337f19dd14
SHA512 a99234280c218f4eefea207a9f3be117813f90e126723e0b0caae074514ffbed4aec938116070aaf82b359028e7d401c37f678981d205576b35e194e11efd1ab
SSDEEP 192:lR2WBLnXUq+v7hpAPRp25E95Hsb+WNnChWiII25cngkwMfVyIsnAUgtaJ:lR2Wd69UXlrwUYI2Sgs58
TLSH
T18242B62EAA20653B5CDAD629F9227B47D7F7143126E01E44EBFC8A5C15EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d4dfeaf9b7a10ded939858aa2eb1cd2934dcf257a177cd0694a7566f5f1bd47d
MD5 487fdb6d7ddc51c56824ec7cca7032b1
SHA1 da1725fc92bc32655097a5607fd26e99905b95e5
SHA512 5f5313cec2f7f6bcaa2238fdf7adac3c4c804187b8db05cb3ddfeda27e8e5a5c93b546c45e180aec4ff6aac6e8eb837bc0e9f702fee2253eb0f9fe8d41f6b98c
SSDEEP 192:lR2WBLAXUq+v7vpWPRpg6WE95Hsb+WNbpChWk7mrooZcngkwrfVyIsnAUgraJ:lR2Wi6zqXNrwCZZoygL5e
TLSH
T1D052D82EA920553B9CDAD669F911BB4BD7F6243126E01E44EBFCCA1C15EB9CC321341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9242208d7f0a3244bdfbefc9aecd284f572d8ca57bfc5e2fdfa9831fb377d3d9
MD5 98e0122258775c80c9c70f77854636f6
SHA1 ce12b935891a8dedfaaec46f14edff412d026449
SHA512 6b620363666dea79d967b6910a6908f4d9d84be7f59eb8e02c30b8cb886a33ad749b1c24a61721d5ca70f4b15414bd60ed0a19a4cf922a14dc68efc8e2db9096
SSDEEP 192:lR2WBLAXUqJv7vpWPRpg6WE95Hsb+WNbpChWk7mrooZcngkwrfVyIsnAUgraJ:lR2WiJzqXNrwCZZoygL5e
TLSH
T14052D82EA920553B9CDAD669F911BB4BD7F6243126E01E44EBFCCA1C15EB9CC321341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c5db81d35216cd20efdde21e59e26a3ae4ec6a5831423ba7161149dab8cac114
MD5 cee22afde63ff7b243016cb61c3a5968
SHA1 014e93edf12624e675926ebe4907f15121360e2b
SHA512 d6adaf67689d4db44c9b3c881089c51ebc2c86a6f744a1a97a61ee7c1c7b1b3d7adcb8bb886cdf2b59df6b708153ee6d375eb50b38552df6e5fe562c45a31ba2
SSDEEP 192:lR2WBLnXUq+v7vpAPRp25E95Hsb+WNnChWiII25cngkwMfVyIsnAUgtaJ:lR2Wd6zUXlrwUYI2Sgs58
TLSH
T18442C72EAA20653B5CDAC229F9227B47D7F7143126E01E44EBFC8A5C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 c8ffb14690a23689d8d9c30efcfbf53c39fc493495f51448e5af2ed42103cd2b
MD5 07d841310d80c023a69b7fc08b000c6e
SHA1 2e276808ce1b1a32f4f57bb77ce9324a0714d39f
SHA512 b3af546111c38a1becaaf7b9ac86597966be6460f348c31af7580ee0d625319189136e974d6318cbe541324e89a9ec68c9bb48b916f7f9b92c611eae7f7ef2bb
TLSH
T1FEC01205C505B152C48A03F97B82E4DC722CEF20D61B276893F019569D36662801D151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 384c11f178b1991f93ebdc7d0ac53e3ce9d09bf07b72ddc8c3f6c8d59eb420ec
MD5 5969e4765eef5239963132a40f0aade3
SHA1 0bc954146a9f21c4dc8b0df92188d87cb4cd5a68
SHA512 af15b30f6bb8a1b055371f7e7573566197d5c698cf2e2a8efcb716ce9ecf494b2e3591dbe67cdd81cb554fc5b3d19f3eb12a52c142624d99f092812057be0372
TLSH
T1E5C09201C90AB0A5C81A03B46E61A4AC711CFBBAC62E335452F82A9BEA7953182651A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bed6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bed6.TMP
Size 96B
SHA256 47a11fdf8389cb33acf51c9450bd4b1e19498dc918b4852d1b505fd977e9bb8a
MD5 c1c7b8ca0f57fd0139af3708734fd2b7
SHA1 bca0cf9ea847e60faec5794b6176e4f5b3b2dd29
SHA512 8920f3df30a433a85d7554e03eaabcfa3595970f1ec1448e138154e4292f906168990a6c5399ed81ea5206aee88f9fd979d5fb33261549b83212b59c362091d9
TLSH
T1C8B02202C08E2232C00303B02888C0CC3030CF2ACE03220282E00B33CC302300E20020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 4d7087c8000daa16d23f0df5926da120d5409cf938bee44b110cb01f37f0d2de
MD5 6e69644820429af735f82c292122aafd
SHA1 4d9a4d61bbabf5206b77f4def963ff1d3879c261
SHA512 176167d20d498be650e3afcf24aa5720215f0f1bde88bbdc4fefdf59c760636d01e521e9d875193b9a3301fe770e5601febb65ff5f427e0fce566a5955dc4b2d
SSDEEP 3072:/4cCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARIIsqfd7NtZL8cHQRZEQ6Spz:/FCe0T4THtKE+1HXlKM0sqZ/ZLW3Exo
TLSH
T1EC341232AF239F36DD66DF20F92B1F4F9AB256898530D2459A397F9B5C83441909388C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3628741c1956a5e868d86fce35f7ed288ce831f13e9bbc70480f208a2d584c38
MD5 107c343993943e2c0bbac8d3a5da5f08
SHA1 f29b4574aeb485652cc47aa5d2ac890d2ca246e9
SHA512 056a524fc41b70e01e6e78e5352786ed7ba26925508425a963572336041c60c0c590e7036f93f0972bc5aff1a675b8acd5c2e02527f8dec3545a4a50211cf6b8
SSDEEP 1536:6yyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Bqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1A2C30237EBC25E335D82CB647A534FD697B644A99030D301AABD3BEB6C9349164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 dbe4429b80dfc6f185e636de38cfe88d59a11a1bba217790aff72f83950361fa
MD5 0e268433e7a020f8035c812e73bc066d
SHA1 f233bbec26bcc70bc7751e536846e99de75682c5
SHA512 fb33d640b2bb715f091086cf828218a3be369ab36adb1dbae8eb45ef7d75887dddce134619acecda04a357d42cd6a0377452607c2508658c501faf4dfef2af73
SSDEEP 3072:dKcCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARIIsqfd7NtZL8cHQRZEQ6Spz:lCe0T4THtKE+1HXlKM0sqZ/ZLW3Exo
TLSH
T1A5341232AF23DF36E966DB30F56B1F4FA7B256988030D2419A7A7F9B4D83841509358C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a3bfd62c93d1fca136a1fddfe8570eea64fe79eabe9827bbb962e46a51b42295
MD5 eaa974968095ba61d3ac1cfbb41033e2
SHA1 d6af6f3065a8a93cd6df259a59f9ae17b99daa36
SHA512 d9f7e77b4f7ead20ac69c621901a3b45791cec83fc2d898abb4701388b025a6bb94411c3ec31460b8cda27f32a02e068f427232100cf390d53fabd8ea13f9c83
SSDEEP 3072:mKcCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARIIsqfd7NtZL8cHQRZEQ6Spz:WCe0T4THtKE+1HXlKM0sqZ/ZLW3Exo
TLSH
T1AB341232AF23DF36D966DB30F56B1F4FA7B25698803092419A7A7F9B4D83841509358C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download