hxxp://videogamermedellin[.]com/sitio/wp-content/uploads/2025/07/WhatsApp-Image-2026-07-09-at-4[.]25[.]49-PM-2[.]jpeg

Analysis

user interaction
yes
max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://videogamermedellin.com/sitio/wp-content/uploads/2025/07/WhatsApp-Image-2026-07-09-at-4.25.49-PM-2.jpeg
Sample260727-rcvgnsfp21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296346193416286"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 400	4468	chrome.exe	85
PID 4468 wrote to memory of 3012	4468	chrome.exe	87
PID 4468 wrote to memory of 1516	4468	chrome.exe	86
PID 4468 wrote to memory of 3012	4468	chrome.exe	87
PID 4468 wrote to memory of 4828	4468	chrome.exe	88
PID 4468 wrote to memory of 4828	4468	chrome.exe	88
PID 4468 wrote to memory of 2028	4468	chrome.exe	89
PID 4468 wrote to memory of 2400	4468	chrome.exe	90
PID 4468 wrote to memory of 2028	4468	chrome.exe	89
PID 4468 wrote to memory of 2400	4468	chrome.exe	90
PID 4468 wrote to memory of 3620	4468	chrome.exe	91
PID 4468 wrote to memory of 3620	4468	chrome.exe	91
PID 4468 wrote to memory of 2084	4468	chrome.exe	95
PID 4468 wrote to memory of 1896	4468	chrome.exe	98
PID 4468 wrote to memory of 1896	4468	chrome.exe	98
PID 4468 wrote to memory of 1492	4468	chrome.exe	99
PID 4468 wrote to memory of 1492	4468	chrome.exe	99
PID 4468 wrote to memory of 2592	4468	chrome.exe	102
PID 4468 wrote to memory of 3264	4468	chrome.exe	103
PID 4468 wrote to memory of 540	4468	chrome.exe	104
PID 4468 wrote to memory of 552	4468	chrome.exe	105
PID 4468 wrote to memory of 552	4468	chrome.exe	105
PID 4468 wrote to memory of 4876	4468	chrome.exe	106
PID 4468 wrote to memory of 4876	4468	chrome.exe	106
PID 4468 wrote to memory of 3224	4468	chrome.exe	107
PID 4468 wrote to memory of 3224	4468	chrome.exe	107
PID 4468 wrote to memory of 3448	4468	chrome.exe	108
PID 4468 wrote to memory of 3448	4468	chrome.exe	108
PID 4468 wrote to memory of 724	4468	chrome.exe	109
PID 4468 wrote to memory of 724	4468	chrome.exe	109
PID 4468 wrote to memory of 4528	4468	chrome.exe	114
PID 4468 wrote to memory of 4528	4468	chrome.exe	114
PID 4468 wrote to memory of 456	4468	chrome.exe	118
PID 4468 wrote to memory of 456	4468	chrome.exe	118
PID 4468 wrote to memory of 4280	4468	chrome.exe	119
PID 4468 wrote to memory of 4280	4468	chrome.exe	119
PID 4468 wrote to memory of 3312	4468	chrome.exe	120
PID 4468 wrote to memory of 3312	4468	chrome.exe	120
PID 4468 wrote to memory of 4688	4468	chrome.exe	121
PID 4468 wrote to memory of 4688	4468	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://videogamermedellin.com/sitio/wp-content/uploads/2025/07/WhatsApp-Image-2026-07-09-at-4.25.49-PM-2.jpeg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb4ca8c728,0x7ffb4ca8c734,0x7ffb4ca8c740
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,12979083066845774293,5520568585123860149,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,7902396340933070942,2263344283976499192,262144 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,895389975706577298,13851352085449514898,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,3044367552673855806,4250090051445240100,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,8086430635665236254,6864935729891486651,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,15121430935983633660,9279824304177402662,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,9734874780377207719,843065263945572408,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5624,i,7065069921384935708,6148767692036991656,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3292,i,16500309994392772065,11662682802495804306,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,1686238587531653330,1159738546066816869,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,5396284583058382386,8094822205585335059,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,4154536524648809456,8985291836009415917,524288 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5592,i,18041887306887933364,3897446265219950042,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4548,i,2566860047435133551,12023609643301068535,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4424,i,7395587128139070882,14112660150102309143,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3324,i,15101211905278268150,17967896910699726907,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4492,i,6871215949097434642,5242069312069849769,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5976,i,1440279792035479661,3801107440543977544,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4152,i,4957720983365044492,5673480446467663437,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3488,i,17235066961311488101,9004901360213843303,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4480,i,11081668879869018981,3064521542722160503,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4472,i,7022673194774028744,9202786476402386041,2097152 --field-trial-handle=2032,i,3837895187666643994,2619886517800160038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 66e3956e772393a58760e2ecdcd4ce6767caa474d9f561fb8f8a464be803fd75
MD5 b55609ce2e49a3ea21e82d1ce801fbda
SHA1 8dc3e94fd0c47d424b216705bfa1017bed98999c
SHA512 0085ae01223636e15bac24d7e1ffdcfdfe0fc146e266f81d1640631232f6ce6c4f10f15fb88eba3f94da3009c2951b4a29d00d8b29462e739a73861176be007e
TLSH
T1EDE02B69CA63AC3718F81728A465474AEA81235B27409C0F7B3D910C5FB473A8196C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 299f318423fbeb6b344f76e1c2c4a2050eac0777706ce273669126c088752034
MD5 320f4b7bfe5106639cb792a435c57046
SHA1 a9bad2b3acdf1400256caedf647eeec0d5153962
SHA512 6ada85a02e036a3b2901063f06cab8ed4adb9a9e59f9c0989b9ff404e41d58a6325147bc21595d789fedaec00547e1a3fcaa898cebd25695cdce4fd690fc895c
TLSH
T146418CF793F4997E861192E4EA156F1FCE690524131C3CA688D4AE2B93E2872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d1931c333efd87f031b7e1f2ed6cc1232860dcce96ba0b7c9acac19c5409a8bd
MD5 139063b913daa1ce25fb0516b6d2519a
SHA1 281ec7e21e7c54e1edd3838197aa4e2fd79e1f54
SHA512 70bf839f6af302b6f1081e344b38fa70cc4d4523b569bed49a33f78bc06e3150dd1a1eceda8af9fb9441be35fb435c05a98206d9b685639197650d016d89b7bf
SSDEEP 192:FR2bFBjRmQuv7MF+pAPRp2S9HHi6b+WNnDSBPAQPmkweuFwVyIsnAUge:FR2bFDKgoUX917WBPA6m2e
TLSH
T1E842A66EED11697B5CCAC229FE12BB57E7F5103621C01D84E6FD8A2C15E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca099cd9178a71e728f2b3424ea9b2275fa11842b2c902b3a91093a962abb55d
MD5 257d801b45b3408b7bafb7313c56fbd1
SHA1 5099b5adeda280935b7eb04b78cb7aec7df3f671
SHA512 060833637f4603300e3d2819ecd382945fa54c3cba7c38d88b6e0902ff07114b48457b564c43df4a750fd1ce08167e056b97bb7e4c79d941fe7b58fc338e486b
SSDEEP 192:FR2bFBjRm+0v7MF+psPRpU3f9HHieb+WNnDSB8Zn2tQPmkweuFhVyIsnAUgE:FR2bF7wgoUXa13WB22t6m5E
TLSH
T14F52C76EED11297B6CCAC62AFD12BB57E7F5103261C01E84E6FC8A1C11E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f7bc755bf2c9d4a455c38c5f2f952cd86d4de26540dbe2b04c3be0e3a89bf456
MD5 8fc75ca8c0d4ae76282a030c5388a12c
SHA1 a40142cf9b213f75c206447e4208ba3ca9ecd3fe
SHA512 7ce73fb48aadf1acd77bf2375d141b400bbcba635c01f0c3ecc2ea1dd44069276354ec4de74891dcedaf22a34def8e815d8c73f4c6e680d53fdba07703872b2b
SSDEEP 192:FR2bFBjRmhOv7MF+psPRpU3N9HHimb+WNnDSB8AW2OQPmkweuFhVyIsnAUgE:FR2bFAqgoUXc1XWBa2O6m5E
TLSH
T13852C86EED11297B6CCAC625FD12BB57E7F5103261C01E84E6FC8A1C11E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5e1a1ca28fd1fc3517deb12ff74bc3f0090f40d9105358364ec0da1b91aab028
MD5 abf80b2732cf549be3ac65e4d1d25488
SHA1 d9a092865e19e9b382f150cfa197388a30a56ea5
SHA512 955cd9bd6db7c093bc1e8dcd5e1672ab9a7fc5ce2ead1804b3e82f248fb47e8198d2ce2e06ac725ce5769de87088692ae78a9a3700981bf4fadb731cad01fb2c
SSDEEP 192:FR2bFBjRmhUv7MF+pAPRp2369HHiJQb+WNnDSBPDQQPmkweuFvVyIsnAUgE:FR2bFAQgoUXl13WBPDQ6mbE
TLSH
T15442A66EED11297B6CCAD629FE12BB57E7F5103661C01E84E6FD8A2C11E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2b6515e704dfaae9dc6807722b5df238224e658a62928090dca42e4e25dba1ed
MD5 e7a0b57d0abf9b08ca25d7bea72ccb79
SHA1 cf026f02749f83a18419926757b8856e8613c2dc
SHA512 7b8b8e987d79b037599e4b6a7f296d627a3d6fd898baeba272dcbc7eb10c5ff3ea5bca2fa6c7152dc4a6318c29e5d26ec1cef8fafd82319fecee1ebd5ed40fc5
SSDEEP 192:FR2bFBjRmhYv7MF+pAPRp23G9HHiKb+WNnDSBPDQQPmkweuFvVyIsnAUgE:FR2bFAEgoUXJ1bWBPDQ6mbE
TLSH
T12F42B76EED11297B6CCAD629FE12BB57E7F5103661C01E84E6FD8A2C11E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 beaded490388166b4986166d5587d0fba78c3390bc854abfced705abc890ca48
MD5 6ee3e4b470d521573adc193d5c6a82c1
SHA1 ac7335200a8c4fcc02d7fcfc26fa1eedd8425fc5
SHA512 a9de42b8b85e2ba4080beba33244ac9d62784258c559448286a37eac19e7e87e5a6b4f260874b4a0105fe852c5329651359e141e6c942d88c38bd2ddedf1da32
SSDEEP 192:FR2bFBjRmhMv7MF+psPRpU3M9HHi4lHb+WNnDSB8AW2OQPmkweuFhVyIsnAUgE:FR2bFAYgoUXp1vWBa2O6m5E
TLSH
T11152C76EED11297B5CCAD629FD12BB57E7F5103261D01E84E6FC8A1C11E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3dd3bdd04e44ec21865aa01dd4d8ad6cc218bd3d307108f9efec7966c3f40fdb
MD5 6efa56ce2b049111a817821a028f6cff
SHA1 6e32ce3b5235171dcd26c958185f4745b76eee3a
SHA512 c874789d4a9c1ae1386f9830bc9397ab6471d923bd9e3edbc7d8990befa89db49946b1be8c2e479c76584e6bf53826996fe978c02cbdf241e9d6c712dda53595
TLSH
T132B0120084039611C08243F11183148971145F22A60A170147E0E9F2CC251A6C028164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f4b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588f4b.TMP
Size 96B
SHA256 78ecca889abf99c8a398d9d08343727203f980334e0978148800054bfb4c1e5b
MD5 0a5d2be92852120464a0ed8dd4a8002a
SHA1 5b97b5ce461370cbd773ddd5d34296f0c8f275b5
SHA512 4e9c30495de3bdd8ec535880bb2b73e19c831b4ae8742a0863a7407f8e8eb5a763d19b88dfa4419fb0b64fbe4b34f6bd1a170441eb4d646eb16e6718d1ceb502
TLSH
T1D7B02202C00B220AC00203BC22C082FC3030CF22C203220282F08FBACC202380C2A02C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d6494ce8f6f5452a236d486177f549dfeda9e2614d4f63f18e472854cfee996a
MD5 08a05ce44bedbea4f0bf54d5418758ca
SHA1 a814191e9a89724011ec96ffe3bc55da20229616
SHA512 2a030253fcfb1ed1c5b25be272bd6d10a2671fe808ee1e1da60b9837810411b01164a0e0a27ab88c2d446b61c8f60ab4730af2e530e170ba2397c321e1d3058d
SSDEEP 3072:pHGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:pmm7Rkm1tYpBeh2BAoM
TLSH
T16FC3122B5D75E83758B5BB1EB04E0B1F1EF149A7D920DE92C8D85B0423EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 daa9ef8da055d8b61c125b9c461dad22d83fea8ff83d2fdc43baf88a483812e8
MD5 a956b364becf8855b0977dacffcd205c
SHA1 37b0dd510bf551f0fd3ff06a73cd547a23612d33
SHA512 61d23411ad27bc7a8f2a943e567a94c4a8297d87c574a15d65fd9092cb5c526e72998b5fad9100ffeb4034067e08f2d13a8dfb3fa348ca1431f5ce2a297e3e30
SSDEEP 3072:AUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:AXm7Rkm1tYpBeh2BAoM
TLSH
T11BC3023B5D75A83758B9BB1EB04E0A1F1EF14AA7D920DE92C8D85B0833F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1bbd1ff19b08c689bb8279950e4e3434a2697c4d03c7731785680427b9a9eed9
MD5 e2410af499d61bc2919d0f4194c9902b
SHA1 44981d42fb3e8537adb28099fe17afdc994647c0
SHA512 ad49834343d5e6ae67d8c6aff5d0e2fcb0e590e01b30ff187becb03ad46c39df7bdd81da18c1eaae509e7014a2dce5f28cbe0166dda4801d742b520c8a383afd
SSDEEP 3072:AHGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Amm7Rkm1tYpBeh2BAoM
TLSH
T118C312275D75E83758B9BB1EB04E0B1F1EF149A7C920DE91C8D85B0833EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 47f8711674f72d1f9434ab07907574e54154c24668abac31652d324c7e2fe4ee
MD5 6cfeec9152d27da60427c8b8ab9bba8b
SHA1 2e8046507d154660c29facf60d230d17eae04e0b
SHA512 aed37ada97d7cbff04750ca58a4b0547692cb86409b221cad6d18e69345ddd1b003e9b4b5272b0457f29be5ea2f7df284b5909ea2505163a0dc00f62893d94ac
SSDEEP 3072:/4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/zm7Rkm1tYpBeh2BAoM
TLSH
T100C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DE92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download