hxxps://seminuevos[.]com[.]ec/

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://seminuevos.com.ec/
Sample260724-x9fbxaej3t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2268	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293951905503452"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3552	4460	chrome.exe	87
PID 4460 wrote to memory of 2268	4460	chrome.exe	88
PID 4460 wrote to memory of 3616	4460	chrome.exe	89
PID 4460 wrote to memory of 3616	4460	chrome.exe	89
PID 4460 wrote to memory of 3900	4460	chrome.exe	90
PID 4460 wrote to memory of 3900	4460	chrome.exe	90
PID 4460 wrote to memory of 2328	4460	chrome.exe	92
PID 4460 wrote to memory of 3424	4460	chrome.exe	93
PID 4460 wrote to memory of 2328	4460	chrome.exe	92
PID 4460 wrote to memory of 3424	4460	chrome.exe	93
PID 4460 wrote to memory of 4728	4460	chrome.exe	96
PID 4460 wrote to memory of 2844	4460	chrome.exe	99
PID 4460 wrote to memory of 2844	4460	chrome.exe	99
PID 4460 wrote to memory of 1212	4460	chrome.exe	100
PID 4460 wrote to memory of 1212	4460	chrome.exe	100
PID 4460 wrote to memory of 1436	4460	chrome.exe	102
PID 4460 wrote to memory of 4680	4460	chrome.exe	103
PID 4460 wrote to memory of 700	4460	chrome.exe	104
PID 4460 wrote to memory of 1828	4460	chrome.exe	105
PID 4460 wrote to memory of 1828	4460	chrome.exe	105
PID 4460 wrote to memory of 1096	4460	chrome.exe	106
PID 4460 wrote to memory of 1096	4460	chrome.exe	106
PID 4460 wrote to memory of 4184	4460	chrome.exe	107
PID 4460 wrote to memory of 4184	4460	chrome.exe	107
PID 4460 wrote to memory of 4832	4460	chrome.exe	108
PID 4460 wrote to memory of 4832	4460	chrome.exe	108
PID 4460 wrote to memory of 5112	4460	chrome.exe	109
PID 4460 wrote to memory of 5112	4460	chrome.exe	109
PID 4460 wrote to memory of 4364	4460	chrome.exe	110
PID 4460 wrote to memory of 4364	4460	chrome.exe	110
PID 4460 wrote to memory of 3036	4460	chrome.exe	114
PID 4460 wrote to memory of 3036	4460	chrome.exe	114
PID 4460 wrote to memory of 4664	4460	chrome.exe	118
PID 4460 wrote to memory of 4740	4460	chrome.exe	119
PID 4460 wrote to memory of 4740	4460	chrome.exe	119
PID 4460 wrote to memory of 2056	4460	chrome.exe	120
PID 4460 wrote to memory of 2056	4460	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://seminuevos.com.ec/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe455bc728,0x7ffe455bc734,0x7ffe455bc740
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,6711347447471410526,10617529726093012133,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,2622363998042015353,8868829728952013832,262144 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,1206054501308952696,7617218072384446623,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12179120191250747035,14464953096253960230,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,15978667432021430153,10976636247156618064,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,6750579504623086631,7023230278887784074,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5176,i,16289612488131729965,16371909099114449846,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3924,i,5602135003609513881,4924985173472578554,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,9887578337088717227,10208696241583516596,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,18208258087706186867,18147994535170181971,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,3672258292531242888,5737541380908143836,524288 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5588,i,2080509731013098801,9984025090695878670,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5384,i,3458707125937721516,15347108676595890915,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5528,i,4457435787568694083,11547897951696500024,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,6710587071032239334,13031398865231710813,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3464,i,14120452333671157243,300684801640025043,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3924,i,2090955782511373032,7604150865531731682,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5764,i,8284766948853585208,3398173144101815874,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3432,i,2399722067353046410,12982859802099062648,262144 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3428,i,11198996804428536743,15793317488148223061,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5320,i,12330775308847544477,15431752926553499857,2097152 --field-trial-handle=2028,i,18279370979043175815,5041894180197431946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 21bededa52403e2d3019f9d8078946bc9d5603c4235ae37d0cb259385326b4c2
MD5 cedfb6a68a09ef8dc00c7b14dae06731
SHA1 f02f6ab5919c941ccdea85cf9b61aaeb0da46409
SHA512 a6202dffd9a3caf157f29eda3a9b833444991258a051c1018b92a29bd9b7e45b3da235a21118d8f7428553a38d04b26fbcbcce2d4f8764aa00aa81ced2cc89ab
TLSH
T1BDE0E5BBDA259C2B28F9076C60505786E64013573B40894F7A3C810BCFB5A7A054581C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3611bba516ce3576fa2a90cb7534fbf518524e9a52b3163956c22c3793c65638
MD5 8d5955a9784d04b8dcdc32337573238b
SHA1 768fa0928507594fa5008dc703fcf60024d1fb30
SHA512 5c82383019c89af93e0d879e7d461eb1f9e23c1eedb00a57207b1850b670f7001ff609e0b713375323f169ded5ce51287b963fc083942b2a6a5abef1b54f6baa
TLSH
T124318BF793B4997E8A1192E4EA11AF1FCE790624031C386289D46E2B83F2972D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ae225df513e23026132d5302b8569b23bb32ca6ac7bda22ba2f5c29e75d17b97
MD5 dcd7e08e6579132ac2394516750092a6
SHA1 efc7dfb7860e4c01aaf33d24bccf0da605084020
SHA512 aa5a54bfa4f8fc7913acf6d56cbd0b01cdd56efed6505001b5c9865d00d4eb168581ec13509ae7eabe68f30a0d2d22f75ba987ed3ec9e80db95183bb9c2ff1d8
SSDEEP 192:/RkqxKgv78pAPRp2Vq9DHsb+WNnn4PMmgkwjTaAVyIsnAUgE:/RkqM84UXP5w4P63aEE
TLSH
T10842B72EAD10293BACDBD229FD657753D7F6102265D02E84EAFC8A1C15EB5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d4b974343cdc249ba86a588e866bf15e62b3e14b2bea86ac80fde5f48f01338f
MD5 5c16e77561a3e0168e3fb7ba7026b59e
SHA1 6a74ad985fda67798e249cdd6256e5b7c4f4e23b
SHA512 d6419da2fc0836400cbee7495f50b4b94276e0c54635c01a21e43a5c5d0e8d4da4e2dbe6c243d2dc6bbbc54902816a17bdb02eca7566e5165211fc3943c5425f
SSDEEP 192:/RkqxKCv78pDPRp/VZ9DHsb+WNnn4PJmgkwjTaMVyIsnAUgE:/RkqMO4RX35w4Pd3aoE
TLSH
T15642C82FAD10293BACDBD219FD557B53D7F6102265A02E84EAFC8A1C15EB5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8f7db72a9482c783058663b1257231f8d21c385e2decd51490612daa555af5fe
MD5 daa6abe4a6dfd55bf5d240f96ea20a17
SHA1 8108f7e4c8756744b1b856b4afc79620288bac70
SHA512 8fc7dcef0e10a58aafd3c7d5ffe503c581a04c65d0a132b0600af5e7694d6b8895bac01f448515e1cb825c989b5e0cdf66549ac97328d95adff0e67fe6d3bf12
SSDEEP 192:/RkqxKqv78pAPRp209DHsb+WNnn4PKmgkwjTaUVyIsnAUge:/RkqMm4UXD5w4P83aQe
TLSH
T16332B62EAD10293BACDBD229FD657753D7FA102265902E94EAFC891C14EB5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 00f6fa9d21f90e0bd5d26325c468ee314d32139860496b7a7115a2467bb0e3df
MD5 bd3177ba814f686721961ae2182e8cda
SHA1 6b5151f3fde708d4340959aaac5b6b8c093030fb
SHA512 3573b2207473509e18d30bf03c7215d5873fdc9cc910a63bbbb7ae9e15cece34301677631bd50dbcf4188d0987bf8e9cba637d68808ddcc7be4c13d668606f66
SSDEEP 192:/Rkq12Cv78pDPRp/VAY9DHsb+WNnn4PJmgkwjTaMVyIsnAUgE:/Rkq4O4RXF5w4Pd3aoE
TLSH
T16D42C82FAD10293BACDBD229FD557B53D3F6106265A02E84EAFC8A1C15E75CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b376eb09366eb764d1beb8630c50dc1ddf493306ca5cb77f392451b325826a27
MD5 80a5adbc9e16adfcbfa83f909d6f6a04
SHA1 a319a6c1de8cc76d9c441b3e8bbc44fac4b7e8eb
SHA512 c024c999bf4695c8c556453842a74aa4dcbcf7ca4f21cd25a1bcb260d456d3ceb3408bc03913df841d0fe39da6ee45fdff0d8fa54cbd2c7ce553d5fe93a15a9a
SSDEEP 3072:KvGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:K+m7Rkm1tYpBeh2BAoO
TLSH
T1F8C3123B6D65E9376CB9BB1AB04E0A1F1DF149A6CD30DE52C8D85B0423EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2ce3bf5215296583ac89e9bc967a3fadf755f12a707f7e215afea3523f2709e2
MD5 6b6cd1fcf72466effc62bf824933428a
SHA1 8f629216259104d6482ef36ab8323a4ab4df4f34
SHA512 51289f5c04e970ccc36df0e887305580c6eb11561ea13ed22a78b011fbbb7533493496ba724f5b4bec4b06144c92b20b960a42907f8dbd1b7ff9ee2bab61c415
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:8m7Rkm1tYpBeh2BAoO
TLSH
T1CFC3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE42C8D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8cf2c82a5dabffe75229fda6ec866a0698177a26cfe990e3880314ffdf291273
MD5 b7f57be3e6dc547d1311659b7d9b6d25
SHA1 0ad57ef3dc351980e31c5bb80792e6b8f8a06211
SHA512 4aa50d7cca5f22a25823ecfe4b984d6d22cecc06ad2b42fb9a8ee9690b45674519e02bf321ccde2bce16676e522b39083e9c6b850a70429e28f7c75760e10468
SSDEEP 3072:gXGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:gWm7Rkm1tYpBeh2BAoO
TLSH
T101C3023B9D65A8375DB9BB1AB04E0A1F1DF249A7CD30DE46C8D45A0433FA6CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 54f36c7c2b99693bfce4da77c04be436c3deffd1f5ff0fd729a02ffb4a8f136f
MD5 fd99c213d6ee4c5e55bb3dfbad9447af
SHA1 5cd4d26a148647d28f1547b6ab48d2ea795b970f
SHA512 720474d9763e4631a8b268719fcf27f89b16dcf0c736e47302604a5258006c642c7a28f95f739387d42a9f9ff7bb2f394318c2d9fbfcae6a36d82816092857e0
SSDEEP 3072:5vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:5+m7Rkm1tYpBeh2BAoO
TLSH
T15BC3123B6D65E9376CB9B71AB04E0A1F1DF14DA6CD30DE52C8D85B0423EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download