hxxp://s01[.]w5874[.]eranet

Analysis

user interaction
yes
max time kernel
124s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://s01.w5874.eranet
Sample260722-e8ttssyeme

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291686376755184"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
5544	chrome.exe
5544	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4908	3196	chrome.exe	86
PID 3196 wrote to memory of 5800	3196	chrome.exe	88
PID 3196 wrote to memory of 4720	3196	chrome.exe	89
PID 3196 wrote to memory of 5800	3196	chrome.exe	88
PID 3196 wrote to memory of 5372	3196	chrome.exe	90
PID 3196 wrote to memory of 5372	3196	chrome.exe	90
PID 3196 wrote to memory of 828	3196	chrome.exe	91
PID 3196 wrote to memory of 2368	3196	chrome.exe	92
PID 3196 wrote to memory of 828	3196	chrome.exe	91
PID 3196 wrote to memory of 2368	3196	chrome.exe	92
PID 3196 wrote to memory of 3396	3196	chrome.exe	93
PID 3196 wrote to memory of 3396	3196	chrome.exe	93
PID 3196 wrote to memory of 2836	3196	chrome.exe	94
PID 3196 wrote to memory of 2836	3196	chrome.exe	94
PID 3196 wrote to memory of 1400	3196	chrome.exe	95
PID 3196 wrote to memory of 1400	3196	chrome.exe	95
PID 3196 wrote to memory of 3292	3196	chrome.exe	96
PID 3196 wrote to memory of 1652	3196	chrome.exe	99
PID 3196 wrote to memory of 1652	3196	chrome.exe	99
PID 3196 wrote to memory of 1848	3196	chrome.exe	101
PID 3196 wrote to memory of 1848	3196	chrome.exe	101
PID 3196 wrote to memory of 220	3196	chrome.exe	102
PID 3196 wrote to memory of 220	3196	chrome.exe	102
PID 3196 wrote to memory of 4632	3196	chrome.exe	103
PID 3196 wrote to memory of 4632	3196	chrome.exe	103
PID 3196 wrote to memory of 3896	3196	chrome.exe	105
PID 3196 wrote to memory of 5880	3196	chrome.exe	106
PID 3196 wrote to memory of 5652	3196	chrome.exe	107
PID 3196 wrote to memory of 3724	3196	chrome.exe	115
PID 3196 wrote to memory of 3724	3196	chrome.exe	115
PID 3196 wrote to memory of 4524	3196	chrome.exe	116
PID 3196 wrote to memory of 4524	3196	chrome.exe	116
PID 3196 wrote to memory of 5544	3196	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://s01.w5874.eranet
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff470bc728,0x7fff470bc734,0x7fff470bc740
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,6943879357995838317,1826218603766492030,262144 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1548,i,3556481955671606546,8526904905488449557,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2704 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,4614217538254499084,1020973933753282315,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,13016863909277696694,10229140599426430968,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,4372381381917362089,3952196973570492226,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,13639534014573017310,11047202862671713501,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,14535123662800522955,6495162790031380,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3160,i,3894613199949233974,5787200695816680561,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,16778811695126233393,3737469683766390234,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4628,i,12262722291615047884,8443556583891577187,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5896,i,1283183762665715559,7282622704850894276,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5744,i,7655897180596145597,14751050428114200317,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,7113507677482627196,11950647286275654845,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,17179571818338633179,13173267933512572607,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,4350906005150946995,15473517925670025464,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,11450496648884044213,11858342910238862415,524288 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4848,i,607370087281802929,18266633267929464015,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5632,i,10019475095864575198,9748967082322794863,2097152 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4392,i,17549461653662682689,15294271562789758977,262144 --field-trial-handle=2660,i,14624151724000416436,17728261682086182094,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2ca1f36900608e2744f0efc76bc4cf465945c198627c610c6bfb3f87291109e3
MD5 da7107c98d2fef8f8d08efda54253ddc
SHA1 f435a21b7beede20967f2b3de85c9c7149490eae
SHA512 7c77699deb827afd93c571ff42506d14e7a6654f36b282501acfb81767585aa875aa201cdd4c9b83071d373f3cdb7b8da8a542fac166f30510efc099c97c537b
TLSH
T1E5E02BAEC8619C671CFE1B3831144746E7450336BF90D90F7A3D82088FB5A3B8266D2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1e2eb80a9b356512dee1cfec75864197887f3e23b571efcb96dd4e896190e514
MD5 59f6986f355b7f2f6eaccd5a449a9be5
SHA1 b83ce73fbb8dcea0881e15191a936a12aae6524e
SHA512 7837b04d6ca6470c01ae2a5893356b49086d1e0d60436c2644b6351327670ace67a4b0f58da5c98d4d5e200f220980eaab6e4e1130a3d7dcb4498cb229723a04
TLSH
T1BF419BF793B4857E8A1192F4EB156E1FCE690624031C7CA689E4AE1B83F3872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71bc109932edc1a64e20eb327b5f75d559939931a5358242c850b476badab2f0
MD5 3074b2e16a85763f3dc55ae376aec597
SHA1 2da3d503ec98e51b39a48f8cf8d5bf5b1a0ac4cd
SHA512 6ce064fd0103c45488aae524dd91d88179bc4cb625ac7c86b7aac001dd38e219f1b299485e48fdcec2d16fa3b4f4cb6d92f7621fbad7452da7dc712ff255b43f
SSDEEP 192:4RDp9wmF9w/4seUrfeJwSv7cpAPRp2q3Dk9BHsb+WNnDBPPmWXt72aqMkwUa6z07:4RTwcwQslywUXl4rwZP1t72a0a6Y2e
TLSH
T1E642D82EED20687B9DDBD21AFA197753E3F5102225942EC4E6FC8A3C15E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dbc94eb7b454123f1ba4b071a89fc0cf0e500cd847abd7983fc14e331be3c31e
MD5 bb8ca1a791f55ad9e2ffcc72daeab916
SHA1 0d79afc612253357b0ed7e35be540c67ae36763d
SHA512 3b39f347779d8970a9ed47f78855ba63949867c0d8e471b804385fc6db26315dc0cfd49bbdc3f0d09f868bf55ced31db44e5108a7781d3252fba7d80a9df1c23
SSDEEP 192:4RDp9wmF9w/4seUrLheJfSv7cpAPRp2q3DW9BHsb+WNnDBPPmWXt72aqMkwUa6zi:4RTwcwQsfjwUXlqrwZP1t72a0a6Y2e
TLSH
T17442D72EE920687B9DDBD21AFA167753E3F5102225942EC4E6FC8A3C15E75CC321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9a3ce9f5cb79b4c2f0de95e6ac0a4a5c480b08f9287be78d331b1be094872a00
MD5 6fd85c5022895a2065f70e510721f58a
SHA1 652e2aab9099c348aa9f659702f737ca2eeaee6c
SHA512 578ac08e955a9d2eada4cc187ce2281a6ee9916337c26b8f7938ad8631afb3cbb4349336ca70864223d335279e2b6e54e383d8482fdbf922c5eb5de7c5beff57
SSDEEP 192:4RDp9wmF9wjok9gUrLheJASv7cpAPRp2q3DW9BHsb+WNnDBPP3WXt72aqMkwUaQU:4RTwcwBdKwUXlqrwZPAt72a0aQY2E
TLSH
T1B142E92EED10287B9DDBD21AFA1A7753E7F5102225942EC4E6FC8A3C15E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 018bf8ab9cb857a86a9c51ea30d701f1d7117f0eb13da07e8e46d6b0474c0187
MD5 a7c154d50d04c59ca3a9903f63c1a230
SHA1 8712519b1762be40c72ad525ec0a1ebb3dfa50e4
SHA512 2288b96fc7ca81877c0b4881488d809e9ea9cb6637c6f680c6e8dd03bc3b7ed476814b56d946859d20453167df6fc747301814b06f88176b1cc2cf07c2b535b3
SSDEEP 192:4RDp9wmF9w/4seUrLheJASv7cpAPRp2q3DW9BHsb+WNnDBPP3WXt72aqMkwUaQzo:4RTwcwQsfKwUXlqrwZPAt72a0aQY2E
TLSH
T11E42D92EE920297B9DDBD21AFA167753E3F5102225942E84E6FC8A3C15E75CC231B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4b0cb2066144b7516b280e042d229c7b244d2d2a97dca4d73df72ba3f4a22113
MD5 0f598a860c6c944dec27706f162a9a1c
SHA1 b303cd954050b2a191cd6d3b90d000ed3f0d3ed2
SHA512 dd3330b48496d5eac8e9e25f75cdcbe4aa85a6e302a4bc791f1727e13167908b56ca6622df8754c108807aab93d35f4b9be2cb9c9cc836f85b6c39ebc7208bd8
TLSH
T106B0121080039693C45206F0114614DC71249F20970E1B0543F4AE72C8371E18014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593dda.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593dda.TMP
Size 96B
SHA256 959fa132e52edfe9896ade3a4bcaf7641e0a46fc8f0773e95cc45ff55b5f1b9e
MD5 1ef34663f046e35d853da80c6c1adf77
SHA1 7168cf7f4e19c959d49f81e5c7000626d84af35e
SHA512 ef1465d72ff1d613202b8a64955746297a95af88de449b0a3215382da450d6b3c804ce92b9ec9ccbc6be646114bd9710294a9a213903a0cf894b0d2241ffbc74
TLSH
T1BDB02200C0022B03C0020FB02080A0C830E0CF2AC2032302A3E00F3BCC282F08022020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8d018aedcdd6bca6f79406e5e88242b8f3b8536756ac1538bf79d66d5225b293
MD5 3627cb5323b31db1f39f91698d28d6dd
SHA1 3514e607fb52d9076ad26be500435881d89d6acd
SHA512 522b7ad0b6bc6fdf688aa67db3bfd98fd74a5c1a1ab5337b595d09ab33df77412b12e8397fc7e6fe048f52702fb82a5124916a4c29612db0fc4dcc41ba2ece8e
SSDEEP 3072:SEDRFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:ZDRFmUi21rSm8uUVNSlzY/
TLSH
T1FFC31214B9A7B8B3EF9930447BDF26149D6C0D418290C60156739E415DEF3C66FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bfa146c9a3d740057ff3b8b221e34cf12c5a9c1cad650463560c6b5680b4fb7a
MD5 1c491593af72641c22ed547f97dfaa83
SHA1 b1c4481a01fb7246b9a8449a1eed0d6772ea1a7c
SHA512 016a8e223b0e7029334aa527b2a864437492e08e621d13b26bcfea950ca20a0b8abc01c710b9df78fabae7f0a69eafe29838bd33410b09827a03d2325a707f43
SSDEEP 3072:SDFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:eFmUi21rSm8uUVNSlzY/
TLSH
T130C31300B6E3E8F2FE5930447BEE2A149D6C4D818291C64152739D419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c71ac0190f88e27b8028dd6cafb5d0fd1c0fb4aaf82688ac055873abdeebd892
MD5 d5b3afc686a0b6534f8fa9aa7d8e2b1a
SHA1 98538f877543bbcd687016d88ac562611f1f098e
SHA512 29e8068115e9334faa53bb4e0ce490f55ade888f32c820ca7bab29e201cd181fa87bd63b42e62c868e54776bbdd3cb4c3fa658f853f153c0586bef33aa048f5c
SSDEEP 3072:SbbFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:cbFmUi21rSm8uUVNSlzY/
TLSH
T1C2C31204B9A7F8B3FF59304476EE2A158D680D818291C64157739E419DEF3C62FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d96746d8989996578295e3b6a51eccd8835951ea0f88f736a94ca0c170f8cfdf
MD5 f2905489d98fe005b04a68490a6d0441
SHA1 0b76bba6c3f8cb5dd70aa5a45172e39c4443449a
SHA512 1cd6438c5fb28c019377fb1602a9b5faf33b39aa2735c6262a3ae0a472c1dc51d60f6f4453380682871aa76d439f20f76597ef2413391e6a9c996a8d444a1dc2
SSDEEP 3072:SEbFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:ZbFmUi21rSm8uUVNSlzY/
TLSH
T1E7C31200B9A7F8B3FF59304476EE2A159D680D818291C64157739E419DEF3C62FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download