hxxp://granitehearth[.]top

Analysis

user interaction
yes
max time kernel
600s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://granitehearth.top
Sample260718-l46fcsa14x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288427852631959"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
4980	chrome.exe
4980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3172	2768	chrome.exe	85
PID 2768 wrote to memory of 5036	2768	chrome.exe	86
PID 2768 wrote to memory of 2132	2768	chrome.exe	87
PID 2768 wrote to memory of 5036	2768	chrome.exe	86
PID 2768 wrote to memory of 2548	2768	chrome.exe	88
PID 2768 wrote to memory of 2548	2768	chrome.exe	88
PID 2768 wrote to memory of 1784	2768	chrome.exe	90
PID 2768 wrote to memory of 456	2768	chrome.exe	91
PID 2768 wrote to memory of 1784	2768	chrome.exe	90
PID 2768 wrote to memory of 456	2768	chrome.exe	91
PID 2768 wrote to memory of 2492	2768	chrome.exe	92
PID 2768 wrote to memory of 2492	2768	chrome.exe	92
PID 2768 wrote to memory of 840	2768	chrome.exe	93
PID 2768 wrote to memory of 840	2768	chrome.exe	93
PID 2768 wrote to memory of 1232	2768	chrome.exe	94
PID 2768 wrote to memory of 1232	2768	chrome.exe	94
PID 2768 wrote to memory of 4936	2768	chrome.exe	95
PID 2768 wrote to memory of 4052	2768	chrome.exe	102
PID 2768 wrote to memory of 4052	2768	chrome.exe	102
PID 2768 wrote to memory of 2948	2768	chrome.exe	110
PID 2768 wrote to memory of 4720	2768	chrome.exe	111
PID 2768 wrote to memory of 4584	2768	chrome.exe	112
PID 2768 wrote to memory of 4980	2768	chrome.exe	118
PID 2768 wrote to memory of 4036	2768	chrome.exe	120
PID 2768 wrote to memory of 4036	2768	chrome.exe	120
PID 2768 wrote to memory of 2420	2768	chrome.exe	121
PID 2768 wrote to memory of 2420	2768	chrome.exe	121
PID 2768 wrote to memory of 4240	2768	chrome.exe	122
PID 2768 wrote to memory of 4240	2768	chrome.exe	122
PID 2768 wrote to memory of 4348	2768	chrome.exe	123
PID 2768 wrote to memory of 4348	2768	chrome.exe	123
PID 2768 wrote to memory of 3348	2768	chrome.exe	126
PID 2768 wrote to memory of 3348	2768	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://granitehearth.top
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed6a1c728,0x7ffed6a1c734,0x7ffed6a1c740
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,16160030454524146516,8865306283824055732,262144 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12077970779630453674,17674196600291147911,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5256745004075591247,2188040114283312421,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,6357229959030395380,10988967829526252137,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,3422252351920955607,15764940081098842822,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=1656,i,3186489856417374018,18134531386377303629,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,6665208901517119178,13697203211547736030,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3304,i,15276271692152442131,7254037779795589229,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,13205030766718677694,429082052351149225,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5832,i,4138654963786212537,11665451184156480467,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,2126384787783751316,7847922552953385374,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,3562091233005147656,17805554735043623480,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,11684724530094330990,9248612106337221440,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5372,i,15636856134978074511,11272038237183075423,262144 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4392,i,1156741388369968744,206288306205266390,524288 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4500,i,1153574531880948345,2626278318904769600,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5892,i,12254583761897926485,5690730993368450332,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5920,i,2176296681839698127,13968634286665191835,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5796,i,6927181495422127454,16046156783039235243,2097152 --field-trial-handle=2032,i,10518345353809698334,13872597766800736514,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:3348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

511dd3ab-16da-4e16-8f9a-66aaf03e901b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\511dd3ab-16da-4e16-8f9a-66aaf03e901b.tmp
Size 414B
SHA256 bcfd505f7ab6501754f6d76968c4baef6f2669e8a8df28827acac129b2492b66
MD5 fa7af6666ec3e06785e9fa7b5e8c093e
SHA1 45a51e95c9827a39d47841cfed42733db76399e7
SHA512 40ff0bc3a13e193029d9024cfe409643835d6ef76e316f53742101dc32d12b69272c5c81c3a3daa2cd02b5b186f4963c22163f05660852e3cd3cd84ec721dbf9
TLSH
T181E02B6AC861DC2714FD0718A0105785D768139B2B819D4B7F3CC50C8FF66364695C5C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 972f5fd196fb9a606925712c27280559b84d7c613c4dd5189f7f24980ccfb204
MD5 fdfc652b594b91570ed929bde341ddfe
SHA1 0cc9b101625f5fffd77da8fb7aee352886a9a2a0
SHA512 72e842ae74f8d8eac547b5270b5906850cfefebf884516f6374b43bf6eaa9f789fc28cf887948cba431c954acbcb5ae086a20117578bd0dbb71dfcdab52b9d95
TLSH
T1EF41B1F793B4857D8A0196F4EB156F1FCE690524032C7CA688D46E1B43F2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5db9dc73bb0648a5ce24693e7d4504430cef44aa776eaa4efd553427ce093b1f
MD5 429ff373705f1e119b637dd95d6483f7
SHA1 1765befe81128cd67bfd584d68fc8e2eeb11f3bb
SHA512 d9779ff9eb1c22db425334bfd87636e64156461e79c183048957c56aaf8134a4249550592466d53cc3584440bc2dc1f8a322b69896809e056b06ba73d9417328
TLSH
T18741A0F793F4857D8A1196F4EB156E1FCE690624032C7CA688D4AE1B93F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 293fc034ae24385881413e094ef52dfb88a68bd250b8f8d72396efcd52560e09
MD5 877400f3e824c9110b70c23c4c5664b5
SHA1 0dbafb6894a94fbcb0421b45950a0ed4cca24f9b
SHA512 a653a2eaec0e63aa21b7a60622bf6c37ad5f3fc53c835046660ee6d462b68c2dcb6e142a6dc7c494780da6500bae16c4761b3c74906469e7b64a368128240549
SSDEEP 192:IRngjwst0zDVTQUEv70p2PRpkdD1Z9+HOa8b+WNnntFPjjoZ0eG2MWlVyIsnAUgE:IRngjwstepQUggeXC78O1nfPjUZI2MGE
TLSH
T10F52B62BAA50697B7CDFC229F9617B97D7F6102125A11E40E7FCCA2C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9dec91286cf00eef1c3b077a11f9a9c5bd5d5c0e243066a3260ef2bb2cb72c05
MD5 e0c004d97a4bc3c37d7c76ac7d7025f2
SHA1 d4edd4fe0b6ac32c758a44534f6f30b77df5a2c1
SHA512 ca6aed34bd3c4ab8b480b89be5ff62ab0fecae76b42c7e14e7e34e1d8e8eff1a3abcc473bac9f1536c7b62d28863f749dc92cf9dcbc940514acd80a4a26544af
SSDEEP 384:IRngOwstepQ/ggeXC1C8OZnfPjUZI2MGE:SfosDg8OZHj92i
TLSH
T12A52B72BAA50697B6CDFC229F9617B97D3F6102125A11E40E7FCCA2C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f2b4637c8e88f4dbaf1039b087d3bccc25ba70eea07250d253875400314d6312
MD5 40b4706aae7128f588c9d0a49f9fb068
SHA1 ced6ec2a5b5e7622420df4d15d6d9a118698ca9e
SHA512 c2c1a8a4f2b78050ce9f4bceae0d60404ea46c0a5940ee7c2a496ba69117a67392f7ed8ef3ac15002a660dc89c23aaaf6f80910d3db2c688b1ed69feefe196ee
SSDEEP 384:IRngOwstwpQ/ggUXA1C8OZnfPjKZI2M6E:SfKs/g8OZHj32I
TLSH
T1CE42B52AAA50697B6CDFC229F9617B57D7F6102225911E80E7FCCA2C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 24d9f674bca2c305c41262013438f536ea09f01eda1bdfa1afbe0669ec4e79c8
MD5 86b57d701184bd336346063a9004d3f9
SHA1 fef24dd74ac8fe7d4f9b21570fb20e96c873ac11
SHA512 dd4039dfa447c48d14dcdb617108324c8548e5062a1d1794a6377879ca55d7e0cc402c87c243228e464e50a16f740f0d019bbf37c1ddb1e74d77e47287f81dd6
SSDEEP 192:IRngjwst0zDVTQ/Ev70p2PRpkdD1Z9+HOa8b+WNnntFPjjoZ0eG2MWlVyIsnAUgE:IRngjwstepQ/ggeXC78O9nfPjUZI2MGE
TLSH
T1D052B62BAA50697B7CDFC229F9617B97D7F6102125A11E40E7FCCA2C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5c9c9b0fb28f0e40a8a6da0ec7a764bcbba86a5f19169d5b5f00f6d4eb219fbb
MD5 3af03d60223d80ef558ebe4f5430845b
SHA1 7b9a9dbfe55913962531f121e11641d0a3ec6496
SHA512 faeaaea5c2591028e21c827c6834ba23cea5d073739664a392134cf774504d270d1c23a532dd4f860d47cd8d77071d25e013418927477e902bf07b27c011c424
SSDEEP 384:IRngjwstwpQ3YggUXA1C8OZnfPpZI2Mxe:/fKJ/g8OZHg2R
TLSH
T18D42A52EAB50697B6CDFC229F9617757D7F6102225D11E80EBFC8A2C15D76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 23cb12411655e5f0cc6c3650be88dce906375b1386c35a5349c761b5f07082f4
MD5 a445646a6adf1003442e01b6983b0255
SHA1 aecbdc55809004f9c27b3f66d5c5da2e4df7e6ac
SHA512 0343715242592a85f42450e8832019aa301be6f71d2efb56573bd8107ce777280ed5bb1b73de89a79b82030aa4208aec583801a80863c40722f85c0a057b68f2
TLSH
T109B01201A0015512C04606B1518224E8B2555F20AA0E178353E0697ADC251658124050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587318.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587318.TMP
Size 96B
SHA256 0c3127f8baea571f2d1b1d2ee0b65470d1a2a1f3a7cd90ce481c122ed6cca774
MD5 fdf7ba8689288ce10cfc7a71cdc15e9b
SHA1 46c69e6f0d39646afb7835f1461037ba337d7d86
SHA512 b99c1d956568da0bf36ed0a087024c5d3a55d4be973865a9c29210611fb29005f329293c40b07d092746054186b323c4cc2e26a2a1f964b1986aee323741fc67
TLSH
T140B00255C203E212F28243F075D595D871A0DF25C70B12D293E05BBADC2967196393A2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 efe257a35c375683ebd6645e4d30e5e69f6a5b4acea7c44dd3943bbe2809bd9b
MD5 b0dad98a44c355f82f382a4c4b0a6006
SHA1 c3f53ce5ef6ffee97257f2b2d66930bfc59bcc18
SHA512 25af8003a7154c2000d5aed89528b46451490ea232c80343d18bdddc5ea66719544c183e0013ce892a9dcefa66fe067c03d05a8316d74107f7ddc78fdd94513e
SSDEEP 1536:QtwSyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:EXqfd7NtZL8cHQRZEQ6Sps3
TLSH
T176C30237EBC21E339DD2DB60B5130FD693F604A9D034D305EEAD3BAB6893551A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4a1bf99cbb3e6b6d58681e99e291053ce5dadcdd069fab2c33ae2d7e41d25866
MD5 53f5e6ac2b3ec33e4281ae3dd5010ff1
SHA1 2d3d8d54cead9f00a3e7744dce64f91388ab559a
SHA512 6ba61f431be64d7300ee74c57b9a42e1468178804840b6083e9bf73fe6e78b9ae0cc77fe49a43e33802063d668474ee91fd78c02e0ee67f9ec22f0df76e1e8a7
SSDEEP 1536:gJsyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:MWqfd7NtZL8cHQRZEQ6Sps3
TLSH
T178C30237ABC25F339D93CB64B9130FD7A7B644A99034D301ABAD3BAB6C83591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 15dbaf951821e7dd927c99f342b8a0c48b86a80c7ec26b9aa3bdd3524d861531
MD5 a75a3cc331e77d35ddde40b555a4c98d
SHA1 1762f8e784802cf73703508e3951b03509f3a229
SHA512 c9cbba8bda79732760a0d92499f0bf6e752bb39a674de4b0c2f9828f8d230d15d67c33509cc768f3f790a49711d079a8265df6e25afb71560835d542a7fd82b3
SSDEEP 1536:gtwSyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:UXqfd7NtZL8cHQRZEQ6Sps3
TLSH
T117C30237EBC21E339DD2DB60B5130FD693F644A99034D305EEAD3BAB6893551A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b882271e1e2cdca5cc602aef8bff044aa30a3d2b65f76aefbfef0f331132d201
MD5 24ca71dea3437b991a5cf59341bd9157
SHA1 eaae361fac3a981c958168ca47bafdaccb616e57
SHA512 2e7b59902f8895e8c64b508a5910838488ddb655fe48bb7c486c6facc6b998b0c8f78166cc5b385a351daa5b25d6a15b52adde54ced4ebea54c5aeb08f3e5ed6
SSDEEP 1536:bfLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:pqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BEC30237ABC21F379D92CF64B9130FD667B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4e0b35abffd7257f11d844beffb93815961f09c6e10c35c8900fa935d363d5ef
MD5 f89e6aff3e79432f848a51834ce960c1
SHA1 5b74006d141d453031c32c972523f250de57046e
SHA512 55aad9a5c16cb776af2c01e5718ea18ccce689ce2c149c399508bb31df134fb48d5b673e99ad4aac1a04030944e9f0318592e6d1d18a5d87d2dcd2493089ed9c
SSDEEP 1536:9JsyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:bWqfd7NtZL8cHQRZEQ6Sps3
TLSH
T10AC30237ABC25F339E93CB64B9130FD797B644A99034D301ABAD3BEB6C83591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download