hxxps://cutt[.]ly/Oyy4cKt3

Analysis

user interaction
yes
max time kernel
82s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cutt.ly/Oyy4cKt3
Sample260727-whfmxsbj21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296485177478126"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe
Token: SeShutdownPrivilege	4508	chrome.exe
Token: SeCreatePagefilePrivilege	4508	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe
4508	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3412	4508	chrome.exe	85
PID 4508 wrote to memory of 2656	4508	chrome.exe	86
PID 4508 wrote to memory of 2656	4508	chrome.exe	86
PID 4508 wrote to memory of 2940	4508	chrome.exe	87
PID 4508 wrote to memory of 4436	4508	chrome.exe	88
PID 4508 wrote to memory of 4436	4508	chrome.exe	88
PID 4508 wrote to memory of 1296	4508	chrome.exe	90
PID 4508 wrote to memory of 1280	4508	chrome.exe	91
PID 4508 wrote to memory of 1296	4508	chrome.exe	90
PID 4508 wrote to memory of 1280	4508	chrome.exe	91
PID 4508 wrote to memory of 3280	4508	chrome.exe	92
PID 4508 wrote to memory of 3280	4508	chrome.exe	92
PID 4508 wrote to memory of 2712	4508	chrome.exe	94
PID 4508 wrote to memory of 2712	4508	chrome.exe	94
PID 4508 wrote to memory of 316	4508	chrome.exe	96
PID 4508 wrote to memory of 316	4508	chrome.exe	96
PID 4508 wrote to memory of 2356	4508	chrome.exe	97
PID 4508 wrote to memory of 2356	4508	chrome.exe	97
PID 4508 wrote to memory of 4448	4508	chrome.exe	100
PID 4508 wrote to memory of 4448	4508	chrome.exe	100
PID 4508 wrote to memory of 3544	4508	chrome.exe	101
PID 4508 wrote to memory of 1932	4508	chrome.exe	104
PID 4508 wrote to memory of 1932	4508	chrome.exe	104
PID 4508 wrote to memory of 4260	4508	chrome.exe	105
PID 4508 wrote to memory of 4260	4508	chrome.exe	105
PID 4508 wrote to memory of 216	4508	chrome.exe	107
PID 4508 wrote to memory of 216	4508	chrome.exe	107
PID 4508 wrote to memory of 1280	4508	chrome.exe	108
PID 4508 wrote to memory of 1280	4508	chrome.exe	108
PID 4508 wrote to memory of 2192	4508	chrome.exe	109
PID 4508 wrote to memory of 2192	4508	chrome.exe	109
PID 4508 wrote to memory of 2948	4508	chrome.exe	110
PID 4508 wrote to memory of 924	4508	chrome.exe	111
PID 4508 wrote to memory of 2508	4508	chrome.exe	112
PID 4508 wrote to memory of 1452	4508	chrome.exe	121
PID 4508 wrote to memory of 1452	4508	chrome.exe	121
PID 4508 wrote to memory of 4432	4508	chrome.exe	126
PID 4508 wrote to memory of 4432	4508	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cutt.ly/Oyy4cKt3
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd2f6ac728,0x7ffd2f6ac734,0x7ffd2f6ac740
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,8011326777197282374,2599788992066844940,262144 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,8517240467666403105,7152603972213910706,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,3435217798716913930,583356462380708467,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,17960494902077411282,2386209170467359835,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,7633450862755697840,1769929942107457895,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,14016796002427862956,3745351472935551368,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3976,i,11441165819182784897,5290861102778911875,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4916,i,17701114974804428581,2144957973549293525,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4740,i,12352288438273911630,7463179201676853138,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3324,i,7919588269796932113,7397862601722034745,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,1378967566370587210,16781608025674030040,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5760,i,12010293767251237159,10954927901776629689,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4988,i,3555168572552766685,17221995801102157120,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5168,i,13143282395517583788,3962937095185358316,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5788,i,1926901011559389810,572391363396605897,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3388,i,12309865617868432771,11575050806067192514,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,11270161665782155096,11016152058921315215,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,12565180941667140650,2176036598188131578,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,3899643154980118189,3415794879260858221,524288 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5180,i,784936874261253688,6299822001091822099,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=728,i,8748414160777049909,7137879830702925862,2097152 --field-trial-handle=2040,i,13712480393796612842,16693867844104814850,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa7622d3c18cccfe510d8a40ed66fbd0df6a8fec1a1bbd40f46ecd15487cee3e
MD5 a53b40e07db612a0a3dd30894adfcae1
SHA1 c314a0a378566a10950611d1a2509c70a2cb48d3
SHA512 bd5c99d3e14728a09b9e3bd24f51092d711bac6d1fe0ad168c285e86998deaa9232cec98dba4a1a95269d53c85ab86fe9b3270990efb4ea1a3e72b2b4c28fb48
TLSH
T186E02B69C861DC7718FD0B19A0505786D754139B2B40D95F7A3C910C8FB563A8685D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 596b15ae514b787dd84f461a3806c35bbeb2b4f4a0a1d8b2197e9b194ac9b563
MD5 ef9c462391c747992497aa27bfb10883
SHA1 7583d3c798ffd23316f0a3b4e7fabbb011892f85
SHA512 078c823778c5ade5867f7bf4117beb8c0bb5196cc21beff09a8a4d3d75d42e2885d2c6174bdbaa8cd31bd26d33aad849772e13e9fb30c4bc6789bbad27ee72a0
TLSH
T102E0C2008EC2A20CCFAA80F624EB4CE0E635786DD16E1BA3B2D22011F45BBB2D416059
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5164f3f5b02660327acfc4da3ca7773cfc380eef59f69776a60b2b380beed97a
MD5 5cb6e79c4345bc57cd6c48a111c1fb95
SHA1 04c9aed33b2384a0d00c167296d5d0ace2f22979
SHA512 649ebcde07aaadb21837af683f20836be265d260d211926a9d2d9511d800c6043a8f44edb1d3a8859ff74d548fbedaa03cd8c4516e78d38ffde67165af087396
SSDEEP 192:DPWz8T5fz8aIaEdYi5DDRocrtA4UsTi/cg:DPWz8T5fz8aIaEdYi5DDRocrtA4UsTi7
TLSH
T18CD19FF7C7E8866D891152F4AB146E2FCE290D14436C3C67C9D5EE4BA7E24B1E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 98a142a948233a07f5fa98682148cc059d75eee3791fcecb39929489833780ff
MD5 03b190dfb8e7dade4ea04b75569f884b
SHA1 e86396b880bb95f1ee52c3a118b434db42bcb08e
SHA512 0315d150c52f5688e3bfca1d9e8be0d6257981bc07dcf445d4c466ca0d7a69b595062c14ed35803bbde64d358a367e6f8b078accba76e8421b4065b79f1fc0b7
SSDEEP 192:IRBHBxrk+eDv70paPRpAdU6A2P09+Hsb+WNUbqC1ZP4+QUS2arvau/X1VyIsnAU3:IRBHop7gGX38wIBG2uaubE
TLSH
T16B62D42EA9209DBBADEED269F9207716D3F5212265D01F84EAFCCA1C15D76CC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3086cc7ad7742d71d522a01ca11d74ce61a75dc90091295eeb077ae8be396d0d
MD5 229e2646d30aaf3416ba18ffbdc49c4c
SHA1 550050be5052784e3d16867e8d861d785bee4f72
SHA512 80d6000af5b9e8b9cd26211fb9627cd80382f29e9a8c9ffe72d28228d2f5dfe14b531a7ce5dbf9e33d52dd567b672af7363391c65c775d3c25cdc8c7d0b77c80
SSDEEP 192:IRBHBxrk+NTv70pAPRp2dgA429+Hsb+WNUbqC1ZP4+QUS28rvau/X/VyIsnAUgE:IRBHoSrgUXU8wIBG2gauhE
TLSH
T1CE52E52EA9206DBBADEEC229F9217716D7F5212665D02F84EBFCCA1C15D76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a9fc99b3c34a1758c7eedd303ad1b3067ff00111235060147cd3206fe231342e
MD5 75d96d1db4ab024b2e3aee5358c2ea2b
SHA1 932e6d752bb27e2a3ad89ff3597aad02ec03fbe2
SHA512 ebb6e0aafa281c3764497aaaed83c163e484209ff6cf5652836bd0177893658fae92a39b06d48ba9e621f0cdf52fa5e5276543c47bb7888cc4a34d6305aba4df
SSDEEP 192:IRBHBxrk+eZv70paPRpAdU6A2P09+Hsb+WNUbqC1ZP4+QUS2arvau/X1VyIsnAU3:IRBHop5gGX38wIBG2uaubE
TLSH
T18762D42EA9209DBBADEED269F9217716D3F5212265D02F84EAFCCA1C15D76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 efd4e8941045b3b0f3113d99998f457f6753e97aabf4237911fed50dd91fd8ee
MD5 16893f5eaf4225bd6a78115788d4ea15
SHA1 5c6023896021980b4c681d28b050c22d37e671a7
SHA512 8989a2265024b75763e5adbe2dd14944ffb6224276cdb3e2c8bc45194ee4d4e0eb566af3abc4398358d30d4c539e90220faae2a1d86ea3210a45a2c8e5e3d17e
SSDEEP 192:IRBHBxrk+Nrv70pAPRp2dgkV9+Hsb+WNU91ZP4+2qrvau/XgVyIsnAUge:IRBHoSTgUX28wSB2+auce
TLSH
T1CB52C52EAA10697BADDEC269FD217713D7F6202625D42F84EAFCCA2C15D76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fa9218c2103bb3cc4f3fadd8508095cb2e5db0282e954a07cb99b72ea1acaa3a
MD5 e910edc0998cf47daaac17b1b26d763f
SHA1 638b179ba46715b3f7ea0af3e73121f746ed57c1
SHA512 ba5f2c32505f4b5e4c84ec786da9dbfbec6e68e7df38a4aa4a51ac94a6dabd289e44b6fe1c0596ced6e66c268e1c6e4cce3c9babc93081c7e7190d3792fa6b3b
TLSH
T1CFB0129080015511C04202F4264624887218DF10970E270143E069BAA8355608128071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b5ed.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b5ed.TMP
Size 96B
SHA256 cfa4dce1f0b25aa27b6bbe184d4d7dbe321e8a80a78882bf06ea33d1605df0fc
MD5 f16064a521bfc866d5e5ae5cd7adc6c9
SHA1 fc95adca531cb5687976873ac94ca1a71729047a
SHA512 1684032abc13a3320af557e9ae9f2e4e104a9d0792e99202101a899a642ea1b0e8edbb06c5099af82b6de52cb9de05c3ffb0fe4e6a183c44143f81570872bd75
TLSH
T15AB02220C0023202C00303B0288888CCB020CF2ECA0B020A82E02BE3CC382308028020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7d9a82c3024bd94e90305c41a6a14e42df5cc8486b9dded7b74dacfef197bf7a
MD5 c735f564fde1d036e59d3fd0ccc442e7
SHA1 1362ba8723ea6e2fbf6adebc9ff1e0de68c2ce9a
SHA512 b36b137211f543fa2bd207d2ee53a7cc53559cba1ab475fda60a80a34a568877e0dfe7ec0a1db80618602dd90369848f9d787fd3dc7a93edeb35a94dfb755c90
SSDEEP 1536:q3pyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Unqfd7NtZL8cHQRZEQ6Sps3
TLSH
T180C30237EBC25F339E83CB74B9130FD7A7B644A99034D301EAAD37AB6883595644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1fc01b1a63836f86b211e41993ac1c6a3e5b04f3afc2fa1e540adc8ef4bc1e9f
MD5 3a1108d35f5d09f68e688efef32bfda5
SHA1 c497bccf346bac88f05bc2760ab189a5330ee9bb
SHA512 53882caf815ecdca0528adc3577e32b348d1d8eda4108c5725a4809fcc008b64596cc8cc4fa4361447993b5fd97b0a7865e81c457644da88e3af35d5c5d5c18e
SSDEEP 1536:b6LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:2qfd7NtZL8cHQRZEQ6Sps3
TLSH
T126C30237EBC21F339D92CF64B9130FD667B644A99034D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 eccff5c199ccec519dfac7a1ea3124ab4eadfe9f685879a1681f01155263bb48
MD5 659bf03b726783f0a41720cec88c2de8
SHA1 c72a6f9c6fd5e8dc7ec97da0fe5f1d3329421de1
SHA512 e07f4980728344784e313da33bd1a5556d00d3435198a88b5cf4ea9117cea5efaab6eca0c64c2d3e342ed30579daf4c91e6ff0508236200107d80a5801640671
SSDEEP 1536:qLRyyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:8Rgqfd7NtZL8cHQRZEQ6Sps3
TLSH
T12CC30237DBC21E339ED2DB64B5130F9797F6049A9034D301EEAD3BAB6C93551A4424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 918830ffab9d79772e6994af45a52bf0703d14bf9f75ca9aff03351e523ab8c3
MD5 616eb2f44dff4af5b92770cf9806f6c2
SHA1 415b47ecaf97a30192f20b3dd97fd7477a10a2fd
SHA512 fa6a6dff15e0a28c546238fd76dce9a8f1e10e268fa724b2c6cb23ea482d3855d7ffc9804063357045418a803298d985976a33516d5ea6391589296b71a976b9
SSDEEP 1536:T3pyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:jnqfd7NtZL8cHQRZEQ6Sps3
TLSH
T141C30237EBC25F339E83CB74B9130FD7A7B644A99034D301EAAD37AB6883591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5acb666-55ce-4ac7-b761-b993c24f195b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b5acb666-55ce-4ac7-b761-b993c24f195b.tmp
Size 116KB
SHA256 e5237179a80d679e4fcd3217e226a97fce45999597cc6141d9e8d71ad5e28829
MD5 722405c2b1c7f27f07489abac7f7d1f3
SHA1 f7261d2af2dceb2bdbde0e67e41ab05e08d193f6
SHA512 92be0f63e295da1f4136bf6fd59b100310aa446ea76e8d000578b74ffdaabe27e0f60f54c2be0cca6ef89c823b17ad1d5a8befbb398148dd8d04766ab7144d64
SSDEEP 1536:qGryD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:RVqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1D2C30237EBC25E339ED2DF60B5130E9797F604AAD034D301EE6D3BAB6883551A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download