hxxps://smartingroup[.]com/accounts_folders/secure[.]html

Analysis

user interaction
yes
max time kernel
72s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://smartingroup.com/accounts_folders/secure.html
Sample260730-evtxmsbe75

Score

6^/10

discovery

Malware Config

Signatures

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298585883960153"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4880	4452	chrome.exe	87
PID 4452 wrote to memory of 3368	4452	chrome.exe	88
PID 4452 wrote to memory of 3368	4452	chrome.exe	88
PID 4452 wrote to memory of 3608	4452	chrome.exe	89
PID 4452 wrote to memory of 3872	4452	chrome.exe	91
PID 4452 wrote to memory of 3872	4452	chrome.exe	91
PID 4452 wrote to memory of 2036	4452	chrome.exe	92
PID 4452 wrote to memory of 2036	4452	chrome.exe	92
PID 4452 wrote to memory of 784	4452	chrome.exe	93
PID 4452 wrote to memory of 784	4452	chrome.exe	93
PID 4452 wrote to memory of 4044	4452	chrome.exe	94
PID 4452 wrote to memory of 4044	4452	chrome.exe	94
PID 4452 wrote to memory of 4868	4452	chrome.exe	96
PID 4452 wrote to memory of 4236	4452	chrome.exe	104
PID 4452 wrote to memory of 4236	4452	chrome.exe	104
PID 4452 wrote to memory of 2904	4452	chrome.exe	105
PID 4452 wrote to memory of 2904	4452	chrome.exe	105
PID 4452 wrote to memory of 2324	4452	chrome.exe	112
PID 4452 wrote to memory of 1752	4452	chrome.exe	113
PID 4452 wrote to memory of 5012	4452	chrome.exe	114
PID 4452 wrote to memory of 4632	4452	chrome.exe	115
PID 4452 wrote to memory of 4632	4452	chrome.exe	115
PID 4452 wrote to memory of 3428	4452	chrome.exe	116
PID 4452 wrote to memory of 3428	4452	chrome.exe	116
PID 4452 wrote to memory of 3748	4452	chrome.exe	117
PID 4452 wrote to memory of 3748	4452	chrome.exe	117
PID 4452 wrote to memory of 892	4452	chrome.exe	118
PID 4452 wrote to memory of 892	4452	chrome.exe	118
PID 4452 wrote to memory of 4004	4452	chrome.exe	119
PID 4452 wrote to memory of 4004	4452	chrome.exe	119
PID 4452 wrote to memory of 1624	4452	chrome.exe	120
PID 4452 wrote to memory of 1624	4452	chrome.exe	120
PID 4452 wrote to memory of 2396	4452	chrome.exe	121
PID 4452 wrote to memory of 2396	4452	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://smartingroup.com/accounts_folders/secure.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ff827ecc728,0x7ff827ecc734,0x7ff827ecc740
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,433077840454365080,17190476744623170135,262144 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,11311941453565321740,2712964696295886858,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12053954724879673547,2751347115542510185,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,5066608350529660601,7792175671184540776,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,10672208882866967275,14312863739869949382,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,15131720007504411316,9560628756573106810,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,4649794876733862633,8585198051066915454,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5636,i,9691380628575866900,17747724326927002806,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3252,i,4500815453347405710,2917658835022929086,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,4193623487290959936,12403948578629101484,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,3007803930277033849,15634234816809031592,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,201685553809271511,13012155249518643845,524288 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=212,i,4570856357079011378,860602001117511306,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5576,i,4290165522037581626,10172043955280606657,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4512,i,14385216892365738754,9299766490746549200,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3180,i,6410039439496149241,5111111127466513671,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4408,i,7161282006154680893,13364873715162979213,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5744,i,8744945973768674217,12579901878921443107,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5972,i,13302923219656395173,3255512180046674785,2097152 --field-trial-handle=1988,i,16884970763090537806,16375213076353223088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Password Policy Discovery

T1201

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6f61cf370a21756d7419765c8059a22fccbbca1374ddbea1365a49d85b1ffa65
MD5 e8b18245cc4451db75a4371556fa82ef
SHA1 b1d84292808036c80443cef242c22329e4b3b7cd
SHA512 94571187db59f406ad008add40bb4999d0db265b803691e7c6a153573f278b8351d0f98112a8f26ba0d677e0bc12ddaaa479ea49d549d927b53ba9b9be68303b
TLSH
T146E02BA9CA22EC3719F86718A4658705EA81131B6740A94F373E420C4FB873A4586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e0ce79a2cedd6134448ddfb63d5e3ee73408eb8766e9a6c5c39d415cb56e9682
MD5 b38dd3824cf1d80cd0a432f656eba632
SHA1 049487acaf7f3971f6b936e02812936661faa017
SHA512 11a6847ae61e2875e62b8440c23c892168802a6c5ee8b77b143f4229b89b3c51827a516736d69e592088e7e67c3d0a5734ff7707cd6d57957954f9ce7a5c3267
SSDEEP 3:MsEllllkEthXllkl2zE/ld:/M/xT02z
TLSH
T11E44040C7FC10C47D500313140D5C3505374DC10071357437C530437DCC57444C40014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2c02921143c327644cd5e40ba111837328ec74adb91a7d7a321c92d035196007
MD5 4078e381de1a9a71939fb5a8cc0a5817
SHA1 ad13813c77fe0f98f6aa92a2126286b9741088b7
SHA512 1ebe1bd68187751afdd7f482a210efcd528e0a77e4f1c3605d5fd0254be33d1ec36631dcccd09d1372519a41592ef12b2f9d734a0d9e9cbb9307cde7a279da91
TLSH
T14B419DF793B4997E8A1192F4EB156E1FCE690624131C3CA689E46E1B83F3872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e40c6a172fd01d8c918edb846cc05f5bdd4bd15aaeb73d1f924acaedf15014dd
MD5 583cd5aed18636501be3f923067a782c
SHA1 89763d18da32d10b3429289bce3380e12f4fa73d
SHA512 49e0721e035c2e4bc2bd9cf0d3537fa8df5babb0afce6dc2a112d4fb60093e8ab30063ec5354bc7dcd3f1ae56698e63d82e396353e13e8b8179f8f1c2db658af
TLSH
T1AFF059A7A26EB01350B985FB2E40BC0A25B9B87101815CF4CF6AC17DE0955F30F16457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9c472205f63e16ad3721d825955d0f8c7ce5190119cb3233b5f31df13a1d3ee2
MD5 f3e4b0b07334e022df2f6d80e1108427
SHA1 a96e6ed0e77cfc28e71ec233b27f2a8fbe453b85
SHA512 a2cccc6226289a0037c1e4cb752e9a5655ee1a50df1bb19269304f64179e5d68d08d9eacd5dcfa74f7572cd085247874e20b23b82d8be9ab99906c01c66f6456
SSDEEP 192:FRb7qUrh72v7MF+pfPRpXG29HHsb+WNnxMPbR24WO8jPyIsnAUgE:FRb7bCgotXN1wePl242XE
TLSH
T1D852B55EAA12297B6CCBC229F9267F53D7F5202265D02E84E6FD8A2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc521fc570da5ee81c3c163b416bedaa76e3a58fca9086df89988e40340c2d9c
MD5 631889b6d478c24c365f57e63277f7ae
SHA1 2f8c6a516aeb844cc048ba028f40c8165c98bfe3
SHA512 6eca754e5a80bc8af3bb139a5d78911634979622882bd7199d9aa9ed4c8efc0ee121736f0ead1b9a036e2bd0bbce485c3faee9c40e408b36a580f396b8124f97
SSDEEP 192:FRb7qUrhh0v7MF+pAPRp2S9HHsb+WNnxMPGR24WON+VyIsnAUge:FRb7BwgoUX91wePe24/2e
TLSH
T10142B56EAE11697B6CCBC229FD227F53D7F5102161C42E84E6FD8A2C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c753b731ba7b2895a6bf8397af0e5b52135d2b5c9a38c30ca6b3f430aa12c198
MD5 9048a14421f94889dd39fb67d8752c3d
SHA1 a520721722085c0a6d075c9a1d1444d762abb637
SHA512 3aadc24565f62e3b32caa4f6de0db06276e768b36172dbc642a152f1ddd02446b036b6531990004206ee543ba2ace92c8693dc9b0973ae8e060ce64c20c15ef5
SSDEEP 192:FRb7qUrh7Av7MF+pAPRp2Gi9HHsb+WNnxMPIR24WOq+VyIsnAUgE:FRb7bcgoUXw1wePI24c2E
TLSH
T18442B46EAE12697B6CCBC229F9267F53D7F5102165C42E84E6FD8A2C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d4125952deb63aee2062d910689981fb21cd327adb0a127e02491210039ba137
MD5 4d7f3d0f0739f0cf060de3e52cc78f45
SHA1 8614a8bc5a923a5b5d2d8f5f28949c2ab428687f
SHA512 d7c1f3624a36bad28d6003b233a25b9620a4421223c83403f057b2bfc27ba0229c9d2030cbecec29fbf22677ad1fd08eef43e0fbb40f345e14cf9cf8b5b8f832
TLSH
T11AB0128080516541C42302F41343159C7118EF10961A5F0143F0692689395618414194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589390.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589390.TMP
Size 96B
SHA256 fe16c978ab00092370a9edfa2df3d45636f65b708ef3474225efd0dac900c94d
MD5 42b9721dc8e13f8ebe2bdf85c850a404
SHA1 383036c9275fdfc669d82e2c1a7494ee9c77ca65
SHA512 8c8f121fc7525f76bec0b12267f4153d313c8cc63bc28dbe1d350d82634512ec55ed14aedb2dbcd2f3db58cb8a191929a7d067f747d6289f778977d80af59326
TLSH
T128B02202C0023322C0C283B0AA8088C832A0CF2ECF03020382F00A2ACC222200028830
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 154KB
SHA256 82c2f0d78e77de3789ed2e3c0ea4436a2bf43232da404b1331057ef1e5a30f8f
MD5 6052ab33f8ea4d424cb1ca93e47ce84b
SHA1 edbb1b6a2141d4f7e9ae49a93cfda1dc4153563e
SHA512 89f03c19a73445b64a9bf7be2f3343acee9bb6089d4e70f9b172ace29ac6eb308d4415bd0e3b8631f7f9f6b8eea2a1d4c9e9c860072b3420c6ebac1015fff1b4
SSDEEP 3072:euRw8+p0VaK25SKYYcRDFOGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:euRwM+IKYFRDFJm7Rkm1tYpBeh2BAoM
TLSH
T129F3121B5E796D3B8CA8F759B18F1B1E1EF20A568C34E985C0D12A0877F9BDC0A49C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9be365595a14ed70d1fb7f3f5560b9516abb0790accef0d372f7f429e19b3018
MD5 7c68f7b438dbfb226fd8f03268976c6a
SHA1 8cce4b8567f41b64c92cc1f2561e305caed15bfe
SHA512 6b28878a67dc278545cabaa9939a689dacd41bd36408dadc9cefe4c245457cc198812f594ce3b5602f22dcd48cbbc405bb4bd86a99bdeba4513d79b5066bd7df
SSDEEP 3072:/rGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/ym7Rkm1tYpBeh2BAoM
TLSH
T1BFC312275E75E9375878BB0EB08E0B1F1EF14AA6C930DA92C8D86B0467F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e54b83e6b19f1b457823b1b59e919dc4245fcfd3d9075f79d719a1225074ac31
MD5 c0fd3f9f1739296e3141ea697bb84676
SHA1 f3029608a01ebbe94134a4b8208e52f633f173c5
SHA512 9dc3cb631c35f78ad5426989dfa18b5aa00f382c772f36708cef0b40bf9aed39a9c15f97db4564cf4adff86b6ae8277468707423d9c708ebd9d5f8f8b282de42
SSDEEP 3072:ePGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:eem7Rkm1tYpBeh2BAoM
TLSH
T18CC3122B5D75AC3758B9B75EB04E0B1F1EF149A6C924DE91C8D85B0823FA7CC0A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cef09908cfbbc6467b53d675712eef88dda6a4d437d6a56c3c9ac54aa3c3ee62
MD5 26693058dafd12eb6548ae8c906c498a
SHA1 5454374e703f777575f41d3e593f93cd50f7b7c6
SHA512 fe335b7074c9bd56934c89d18a36496e3f069a9bbbb21db6454d6be625920bdfcd444bd63f6134e117a3733f040e7abcaf69373078667b656497dda3fc4c6485
SSDEEP 3072:bPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:bem7Rkm1tYpBeh2BAoM
TLSH
T1B2C3122B5D75AC3759B9B75EB04E0B1F0EF149A6C924DE92C8D85B0423FA7CC0A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download