hxxps://uploads-ssl[.]webflow[.]com/685b135d8d02b22ac30b6acf/689a806e7b2f7257b36c6509_21736583459[.]pdf

Resubmissions

22/07/2026, 16:36

260722-t4f5gahc823

22/07/2026, 16:04

260722-th8mlaha243

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uploads-ssl.webflow.com/685b135d8d02b22ac30b6acf/689a806e7b2f7257b36c6509_21736583459.pdf
Sample260722-th8mlaha24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2848	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292098893620011"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4748	chrome.exe
4748	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1352	4144	chrome.exe	87
PID 4144 wrote to memory of 2892	4144	chrome.exe	88
PID 4144 wrote to memory of 2892	4144	chrome.exe	88
PID 4144 wrote to memory of 2848	4144	chrome.exe	89
PID 4144 wrote to memory of 1264	4144	chrome.exe	90
PID 4144 wrote to memory of 1264	4144	chrome.exe	90
PID 4144 wrote to memory of 2340	4144	chrome.exe	92
PID 4144 wrote to memory of 4760	4144	chrome.exe	93
PID 4144 wrote to memory of 2340	4144	chrome.exe	92
PID 4144 wrote to memory of 4760	4144	chrome.exe	93
PID 4144 wrote to memory of 3956	4144	chrome.exe	96
PID 4144 wrote to memory of 1224	4144	chrome.exe	99
PID 4144 wrote to memory of 1224	4144	chrome.exe	99
PID 4144 wrote to memory of 2388	4144	chrome.exe	100
PID 4144 wrote to memory of 2388	4144	chrome.exe	100
PID 4144 wrote to memory of 2996	4144	chrome.exe	101
PID 4144 wrote to memory of 2996	4144	chrome.exe	101
PID 4144 wrote to memory of 2668	4144	chrome.exe	102
PID 4144 wrote to memory of 2668	4144	chrome.exe	102
PID 4144 wrote to memory of 2824	4144	chrome.exe	103
PID 4144 wrote to memory of 2824	4144	chrome.exe	103
PID 4144 wrote to memory of 1860	4144	chrome.exe	104
PID 4144 wrote to memory of 1860	4144	chrome.exe	104
PID 4144 wrote to memory of 2752	4144	chrome.exe	106
PID 4144 wrote to memory of 3888	4144	chrome.exe	107
PID 4144 wrote to memory of 4132	4144	chrome.exe	108
PID 4144 wrote to memory of 4224	4144	chrome.exe	115
PID 4144 wrote to memory of 4224	4144	chrome.exe	115
PID 4144 wrote to memory of 4748	4144	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uploads-ssl.webflow.com/685b135d8d02b22ac30b6acf/689a806e7b2f7257b36c6509_21736583459.pdf
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c87ac728,0x7ff9c87ac734,0x7ff9c87ac740
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,15254869765069780403,4462966545926027667,262144 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,15731379274716643783,12889485912584797431,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,242987114358618034,14942521567559535048,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,6729666185130689248,16217937301978593977,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,7292202641043650998,15945673485059237333,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,2618330624586282837,7964133349950591612,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5384,i,4697480018622724643,7824629500599004853,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,6706864565434269568,2854132631783216017,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5732,i,14310910953979747438,15888334420662320809,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3884,i,11832558616435364987,11050254388113000804,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5696,i,2120417924181760070,9211342531412100909,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5312,i,13622365831538910433,13711583960070429311,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,4536361947904824550,1504747178786712498,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,16094673407601007091,7048698330721402922,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,16441712058367748105,16278211570086139385,524288 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6128,i,14828715295053367243,14336603691118753701,2097152 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,6538483307938235394,5048726382317281619,262144 --field-trial-handle=1920,i,14415763541482779660,775545924858791895,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5b9eb25891b4a89dfe2dcd457f39c0b99eaffa20b6245d4e5a387192c5eed7a3
MD5 5280212267d5252cc50fe0c769e6bde3
SHA1 e6f98a914c86b4d8fda81cdf820a3750cea5b5ee
SHA512 a1e30f9cbce38512bf7d0339fa0fce9a82f9d5239a535cca87e254ab6dd71bacfd8b8b71dec3a32c4ffd82fc2a4c6fcc408068a9fe22fd0d342da1c154ec7deb
TLSH
T1FCE0E5AEDA61982728F9272860505746E64013572B80894F3A3D8209CFB463B058682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 5a184a0ef478c359b7bb265e34ba153160001960ef2ecc507086731ec55d4357
MD5 4e8d8af3e5cfee49cd773eac8d3309b4
SHA1 93d54fe1e0c89e346ba0031c374a5b5ab1ce331a
SHA512 422626e4e35541bb7d5a8d0f9f986bda53ec5ebf380da02a0068b56f3dbc68469ee5e02b130fc5256d902c1799fab0538d001dbafcdcde2a27ef5b728002f815
TLSH
T1B3D0124629CD4193DF41053B2C9C3D44761704F847520F0FE9F440C748435E151CD142
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4446be0364b4306f5af17c3dff00ca222d6711db77209acfe139c25447c53d16
MD5 a97f5f18844944db90636c1538cb192e
SHA1 acf1af2e3be66c9bb51cc6764ff16849163ef42a
SHA512 855670309db905ea4bd560d513ffbeafda7750bcf99944a3951034d0d7eb541e0912f77e7e1b24bc1403b9dc048f76d1d9fb87cf5ad7a1959bff54d4b6ce00f7
TLSH
T130619BF7C3F48A2D9D2156F0AB216E2FCE6D0914531C3C6689E4AF1B53E2871D201B5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d38be46c57214c9d42e5411e52456a529aacedf0f018a88bfc5b433c6941c5b2
MD5 1c0d1d25ada1a4123d4d383fb3e3418c
SHA1 cfb15047feb7e5c4c7c0bacf9deea4ad352f4299
SHA512 9f6a41dd3e21221ea0e40bb59a6eb435dc497f9bf2b2803e061b525626d10585d9597a4bf408aaee824a4e121bbd49f1dd235a26d44de8f38b4f626a53577e28
SSDEEP 192:/RcSxJDGv78pAPRp262vT9DHsb+WNPTEa8Mj2dkLTwYpokwOlOZ+oAVyIsnAUgE:/RcSHy4UXk5wFP2SLTwYpoulOZ+hE
TLSH
T10542B62FAA10297B6CEBD225FD617B57E3F2102261A11E84EAFC8E1C15E75CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 99085f71b5587bd2f345fed168e8e242ef642ee55a61da092e652fbf4b0d047b
MD5 7b3970ed09bc4a1d43e9e267ff25e8fa
SHA1 7cf1085a9673af228ef78009d6652102bc38f88a
SHA512 d4ea3c681d84b66544ebcae7ba39f0a246e74a686162667e39da864ec3bf3b38c4fc9159d7bef8ad0f7331580ff2f131dabefa730ac980d3bdd06ffce3d8097e
SSDEEP 192:/RcSxJDJv78pOPRpA62KT9DHsb+WNPTEa6gn9Mj2RkLTwYpokwOlOZ+o0VyIsnAI:/RcSHJ4WXh5wFNi2WLTwYpoulOZ+nE
TLSH
T12852B62FAA102A7B6CEAD625FD657B57E3F6102261A01E84E7FC8A1C14E75CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 13037a547cea262e4bfaddaf71d0aeac16e6a5b67d662477d8e6474e786132f3
MD5 1751e568b466924b607d5562b4ef3161
SHA1 04a68c133bbe4119f144e80c2d5f7271b19e6e7e
SHA512 63dd74a888164ed6b45ee11cba1b05ede5120adcec5bc5d406e81743a58eb97df56d2959944e6c871ec177db8e8b724199067686623feefb5290f0b04f755ae3
SSDEEP 192:/RcSxJDYv78pAPRp209DHsb+WNnEaPAkLTwYpokwOlOZ+oaVyIsnAUge:/RcSHE4UXD5wZPjLTwYpoulOZ+be
TLSH
T1E532D72EAA10697B5CDBD329FD657B53E3F6102271A12E84EAFC8A1C14D75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 2abc1bcc51f5e97e2fcc65dda22f02227115ca9d051d698297c81e7eec5f5df5
MD5 4cb92a81bd3bcd40e0f89e750d956078
SHA1 d56bc4be5dc3506512dfa0ab9be690dac9cddf76
SHA512 e0b171b60e8e90f2af0114e0a22441fc263bbc8aa4524ed131ec6c3d921ab6923152abc4fce308aa7a8690b2720cd5b6662b61962ab6e97daf4e67f93e911641
SSDEEP 3072:NfuGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Npm7Rkm1tYpBeh2BAoO
TLSH
T12CC3023BAD75E93759B9B70AB04E0A1F1DF24AA7C930DE46C8D46B0433FA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4faa3077f921ca5bd3057e75239250fe5dc1e60424909747e5d62306648c27eb
MD5 03a498c82734bd21e13908847b115c09
SHA1 93eebe4a8db03f46a4756f2210a5d5d2c1e48b78
SHA512 a4bdb7320e362e0a4c73f25b0d00a3ca625f2785743490c52ef1aa9004b4635264c849f71ae2f422f83c3c46154c5150fae0367ecbd57b7702bbea857d7789a9
SSDEEP 3072:MUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:MXm7Rkm1tYpBeh2BAoO
TLSH
T1C4C3123BAD65E93758B9B71AB04E0A1F1DF14EA7C930DE52C8D86B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1c06539662b8cde10c9896ea7a1935333cc226769b824c7b066ebbad6faa5572
MD5 f274d4fb59cca00065b57017bc09cded
SHA1 a21624470f03f0f072e984ad4861202fef3a8a3d
SHA512 fa7db93688c319f82188183f0a4e2b6508c17b01ad6c6e1dda3fff16b8c59555bc1acbc8add4c7d67ac3db89145e0fa8171a1929810206e0dba78e77d2887b69
SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:lm7Rkm1tYpBeh2BAoO
TLSH
T154C3123B5D65D9375D79A71EB44E0B1E1DF14AA6C930DE42C8D46B0437F97CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72831451017aee85f2c69e7c1d0659f53d3f770f3d4f7ee016b547807dfe570c
MD5 c5abe7846e439393009fe4627b789fe0
SHA1 05d5f8b48e60380f96a2413386f6342cc0536a54
SHA512 e337eb43f9e7468aec378b0b37041633c68ab9eb908a1b63d723466336e3ad24989e2df2587a1d03715619757245f210a74825b44f97a0ac91543007715b3618
SSDEEP 3072:5UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:5Xm7Rkm1tYpBeh2BAoO
TLSH
T10AC3123BAD65E93758B9B71AB04E0A1F1DF14EA7C930DE52C8D86B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1eb9296ad3a1fdf9ef4d57e9beb675170b98b81c51f3a408b7bca97a6ff09bba
MD5 163f4edc2388d22c2a62a09237beefdd
SHA1 5902d93c1b7d10384d54a735fcc97f34f05ff448
SHA512 810d70931bb31cc408c47af384c274835e1d454072128873ea162ce24aa089514883410fd75d4b2f5f0e9bf7ebe40c4cbd2fbb94b9294058240b052cd000f727
SSDEEP 3072:XfuGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:vpm7Rkm1tYpBeh2BAoO
TLSH
T15DC3023B9D65E8375DB9BB1AB04E0A1F1DF24AA7C930DE46C8D46B0433FA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download