hxxp://thunaitech[.]com

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://thunaitech.com
Sample260723-shf2xaeq31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2004	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292928508523942"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe
Token: SeShutdownPrivilege	4060	chrome.exe
Token: SeCreatePagefilePrivilege	4060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe
4060	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2760	4060	chrome.exe	86
PID 4060 wrote to memory of 4396	4060	chrome.exe	87
PID 4060 wrote to memory of 2004	4060	chrome.exe	88
PID 4060 wrote to memory of 4396	4060	chrome.exe	87
PID 4060 wrote to memory of 1752	4060	chrome.exe	89
PID 4060 wrote to memory of 1752	4060	chrome.exe	89
PID 4060 wrote to memory of 1328	4060	chrome.exe	91
PID 4060 wrote to memory of 1328	4060	chrome.exe	91
PID 4060 wrote to memory of 1604	4060	chrome.exe	90
PID 4060 wrote to memory of 1604	4060	chrome.exe	90
PID 4060 wrote to memory of 1888	4060	chrome.exe	93
PID 4060 wrote to memory of 1888	4060	chrome.exe	93
PID 4060 wrote to memory of 5036	4060	chrome.exe	94
PID 4060 wrote to memory of 5036	4060	chrome.exe	94
PID 4060 wrote to memory of 204	4060	chrome.exe	95
PID 4060 wrote to memory of 204	4060	chrome.exe	95
PID 4060 wrote to memory of 1960	4060	chrome.exe	96
PID 4060 wrote to memory of 2664	4060	chrome.exe	100
PID 4060 wrote to memory of 2664	4060	chrome.exe	100
PID 4060 wrote to memory of 3348	4060	chrome.exe	105
PID 4060 wrote to memory of 3184	4060	chrome.exe	106
PID 4060 wrote to memory of 1408	4060	chrome.exe	107
PID 4060 wrote to memory of 3680	4060	chrome.exe	108
PID 4060 wrote to memory of 3680	4060	chrome.exe	108
PID 4060 wrote to memory of 2632	4060	chrome.exe	111
PID 4060 wrote to memory of 2632	4060	chrome.exe	111
PID 4060 wrote to memory of 3416	4060	chrome.exe	120
PID 4060 wrote to memory of 3416	4060	chrome.exe	120
PID 4060 wrote to memory of 2176	4060	chrome.exe	121
PID 4060 wrote to memory of 1120	4060	chrome.exe	122
PID 4060 wrote to memory of 1120	4060	chrome.exe	122
PID 4060 wrote to memory of 4908	4060	chrome.exe	123
PID 4060 wrote to memory of 4908	4060	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://thunaitech.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9cc7bc728,0x7ff9cc7bc734,0x7ff9cc7bc740
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,16707470759452458400,444277068658550792,262144 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,17675475722258086598,3634747291917959760,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,18011088348067847309,665162873624956232,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,4675430197194274411,10103191618213894909,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,11112839157715904491,18124892434283028280,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,18220276698432325648,15650319448336593107,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,5886023524520778816,5172391560946332446,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4364,i,14110771329478594642,17727087543914953714,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,9954213750045220241,12548394951303275003,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4768,i,2219595174692191682,15533362530446739953,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,4192953745749244485,14601144608692318353,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,2477608180815901742,9785573324572230149,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,1008323271450049524,14980879736359701091,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5704,i,7623751249768657177,9833352750231876392,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5700,i,18321670989607797323,9427061515464292477,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4452,i,12156904238464207170,5042275648020228767,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4460,i,9782892277307869026,14724858713844176481,262144 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5692,i,9745887331823590312,2349278613093023107,2097152 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,2666448401042247752,8492754336872349021,524288 --field-trial-handle=2040,i,7892057684995190272,18233929351795334389,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b36450624c914ac9e38b8f6ec81683e75049fd5e4ce3e4c83490825076dc3d30
MD5 4d663676a45601383433d5c7facc7eee
SHA1 10fadbbae8d57e4e013fbc72a6c9a1c5b24cd305
SHA512 95f7d34acd16e83679cad856d3c04d558e8bb9f512b41d8134561897829f18b01415a5aee135365a79cfb49f9e0e60164a1dc18c31f6c74bf1818841b63136e6
TLSH
T123E02BAAC932EC276DFD472DA0904F46EA6113671760889F763C81088FB06B706C686C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6eb5b9fbfc5f32bce647ed91ee3538f7a321e007096f178e6c57922164ae22da
MD5 5a068c19ad0aae835e046541de067989
SHA1 17e4f726cc5de0b3b683e4daacf61a941b86f91c
SHA512 243dba7649437566856eff9787a09bd4825b68b2812d1a67e392fed053471cba6b7f2b0cef62b8416f5ce8a18ffed5f56f1b3631e311d4fc284a840588afd58f
TLSH
T183417CF783B4997D8A1196F4AB157E1FCE690624032C3CA688D46E2B83F2972D10478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3d7f1d52e3c3021f16ee9afd38c138553fcff4c63201a843c2ce0805ea34c568
MD5 96bafb1329cf2ad2af6fec34cee30046
SHA1 32c65c6922d0a3a44c8008670ebfc2f85d26b509
SHA512 c347858e1f32a009aad1234354fd4b3f865997be597e14e096569967bfd0fb85b85e9ff09045acbeae1ef95d1c2d0a34e9e4ef2d7219120cb746f77cf4dda07e
TLSH
T1B2418CF793B4997E861196F4EB157E1FCE6D0624032C3CA689D46E1B83F2872D10478E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a7a85e972242df0f7c3c534cf3c7ff6c74fb1333dc18511ff5b807dfd3f43057
MD5 8f453e711b7d60637b35f6d3795dfd58
SHA1 148366eb388d379bf74ef1245b1ada55ae8b3a43
SHA512 ae2fbfb703d031466eda52a362eb8be8fde8ccac6ccf5785846056a2988a889c43dfac8dfca991854671dded8a7a8f1eaeec5fafce9b43c637924a94a363758d
SSDEEP 192:IRTCtiw8ZKxxv7ApAPRp2kn9qHMDb+WNn1jPIWQEJo2LenaUIVyIsnAUgE:IRTCsLahkUXtkKRP4E22qaTE
TLSH
T1C142A42EBA10693BACDBC219F9657713E7F5103561942EC4EAFC8A1C15E75CD222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2721fffe56e2cb41e17ad3cca70ab8f3a038271f22fd9080acd3f420d2c2ff2
MD5 ea865afc28048f90df90c869529ffa32
SHA1 a9c253dfb4356a27af6da14a116bcbe338fa3a2e
SHA512 158309218644876527b7e01624ba3ec576fed1851c154178b0d023cc3fff418163f1b563f85710af3ba0ec1f1ad734c3aa3e07847860bfb31b668f132b66237f
SSDEEP 192:IRTC/DYM8ZKxxv7ApAPRp2kn9qHMDb+WNn1jPvWQEJo2LenaUiVyIsnAUge:IRTCLYHahkUXtkKRP5E22qahe
TLSH
T19C42A52EAA10693BACDBC219F9657763E7F5103561942EC4E6FC8A2C14E75CD222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bcf656330d6c7e3a71acb51b220fbb82d4e91a5fee276e2f0244e187bcfd1027
MD5 dbd88e82f40c28f0acf7d0041f08b499
SHA1 05a904967462c6924409662866506337b4c04832
SHA512 8a432e709f513bebd6670156102a1fe2f5c65a73e98635230848135b10ce00601212d83c8ee13a15be748d620afad4f51c3a59c442b8e911a0a75e9912e23a57
SSDEEP 192:IRTCtiw8ZKxcv7ApGPRpMkEV49qHM3b+WNn1jmea82qWQEJo2LenaUiVyIsnAUgE:IRTCsLaIk6XMV4keR32yE22qaPE
TLSH
T18352B42EBA10693BACDBC219F9657B23E7F5103561942EC4EAFC8A1C15E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 34d9268dd578b44870d3f3a827e419e78dc7237f45826f36da605174fdedc16f
MD5 041113673830ccaeac63075f20122722
SHA1 4e10a485eab4694a0ce5e0cb212600a76babc303
SHA512 87d8a7ed3ef317bbb4f80bb29c0a6f8be59565cba4a615f321b20a5fa7f749ad8765a9464f6fe2a90ab8075ea90fdf47e387dad63d12371c23eeef57d2481927
SSDEEP 192:IRTCtiw8ZKxgv7ApGPRpMkEV49qHMHb+WNn1jmea82qWQEJo2LenaUiVyIsnAUgE:IRTCsLa8k6XMV4k2R32yE22qaPE
TLSH
T1BD52A42EBA10693BACDBC219F9657B23E7F5103561902EC4EAFC8A1C15E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 347c1306ea60cb3ccdd958c6edc74969a67f71712853f57a6e158803f4b12b23
MD5 78a89fc508ee286f9e3524830289ed30
SHA1 ee192bd403ac03cef5d79e5281ca7a45478b052e
SHA512 2ea08f49df5d9cf138ba1845c110e40b1160e88d44732b2b32aba36186cadf02893f7f877e3aa4c79f6d572b596b55fd435c2497ff30f5b17ad06552439fc0b0
SSDEEP 192:IRTCIiw8ZKxicv7ApGPRpMkw9qHM3b+WNn1jmOs2uWQEJo2LenaUiVyIsnAUgE:IRTCLLaDk6XIkmRc2uE22qaPE
TLSH
T11652B62EB910693FACDBC219F9557B63E7F5103561902EC4EAFC8A2C14E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 fae566d103a5da02a3af444e57035772b5eed3272633ee64ba72c101c1648e95
MD5 eb01e6eb20acc8dbc4611bbc960722c2
SHA1 91a6f22742d2395b0f5460894cc719d978c0d5b8
SHA512 cc941941696b25a45b7b3637091126b1415262440147f4fd7539a364faeb46b58c8194eeb7666f7e7ddef2e4329d6727b5f1370e5ce19301f3b6bc09004f9189
TLSH
T1B1B0124080025102C00202F4214214DC7154EF209B4A1B0343E0FA23D827960C414054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589eeb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589eeb.TMP
Size 96B
SHA256 5dfb0c86d44a0a5cceec40ae592dfdc4df5db96a33f95f79d250b2d2f64bc3f0
MD5 10a4972559a0f583a02b436639c11817
SHA1 aad58fc046aea45a0ab388fbf4285e5df213d1ef
SHA512 da762742a724b72ef230ce0a411b277cb98f24ca795beca66867ccd0dadeee79e33c095b801e8a2ce75e3d764e2cc9222ad39cc4683f12fbe2e04b1efdd5c1a8
TLSH
T140B00255C657A273C04213F02F9599F87260DF35C7031616D2E06A66DC25FB05A35561
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 c1f2024b2269f1c598ebbd8c9ff709c18f204d0e928c6c71c21b68f9b6ec641d
MD5 2ed74ff21aa575ef2246e4d0a634b66c
SHA1 0c0a8ab103a59c69266de24be3c88dff6c842463
SHA512 c360d336df4c980dd884b7faa25e54f2fd65edf82ea9d8f190ae82c22d2b565636073a34b9b617999c07ec1d008b302174a24f328f302046269e7b810e673868
SSDEEP 3072:vFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Um7Rkm1tYpBeh2BAog
TLSH
T1E8C3023B5D75A83B59B5B70FB04E0A1F1EF249A7C920DE42C8D85A0423F97CC1A44974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e563510262724a7337d9d5bd8575268b7166c28c9df8247d4844fa6d4fa00f4f
MD5 4d2740c65e7ff4c371200d72c1dcaf7d
SHA1 25561d73796c2261cbb8f6a3485572939b815039
SHA512 21547d635e0f4679355e28ce87a90d3297e3d45a7c9589ebe3d40d4fccee4d4523158229a8ce143ea4008839706aa4c950c9eccd34ed2999a478a852afd923de
SSDEEP 3072:nlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:sm7Rkm1tYpBeh2BAog
TLSH
T18BC3123B5D74E8375DB5B71EB04E0A1F1EF249A7C924DE92C8D85B0423E9BCD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cd507fb6ed0b06a1df3512dc0da48eb1e3a73a79deabfa2383afa70ee157e72e
MD5 d2a66344f131a154c825bbdc39e8029d
SHA1 66db2544071e51113a8a6313a905320d73b18aa3
SHA512 443e5d6bec03982417965ce84e53ec9db7d7b32e36394c0d0d01e6ba3099607fdaad89fc27cdcc3dcc2ce2d76bf9ef8baba75526e3f6595b7d0cd3fe95758fea
SSDEEP 3072:0lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:hm7Rkm1tYpBeh2BAog
TLSH
T126C3123B5D74E8375DB5A71EB04E0A1F1EF249A7C920DE92C8D85B0423E9BCD1A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a33ec9828332895db62063dcffbf3f7bdf01ca7e20675bcea48f4dfbc25517a6
MD5 ec2deda2a4375c525b7921586cc38634
SHA1 b100ac89ef85fd2cddd44f3b578b73c18cae7b2a
SHA512 b549e8889cbe076868f516c17baa564c92da12e242d39108a9ca63207005e0b5faeeeb179510d057c5bebb0c494f0b59ff5f146c9ce70d8fac2616e502ad653c
SSDEEP 3072:nFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Mm7Rkm1tYpBeh2BAog
TLSH
T1D4C3023B5D75A83B59B5BB4FB04E0A1F2EF249A7C920DE92C8D85A0433F97CC1A44974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 878809d77e2f53abd6c8f59d9fe0bd4977e43a6475cffccba87b2bed15c60399
MD5 d1a284a344006554e3098c165de92a38
SHA1 523acbf6a2a82912b1045968c96cb4f75ae37e57
SHA512 2aee4afb3435512632e7c0038612fd81e49ec9d0433e16651c6396df14b5a228d9aea73e8f39106b2919cefaa6c61f69c362b198bf48c15c5c164d62446fbace
SSDEEP 3072:AGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Km7Rkm1tYpBeh2BAog
TLSH
T1F9C3022B5D75E83B5CB5A74EB48E0B1F2EF249A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download