hxxps://atpscan[.]global[.]hornetsecurity[.]com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield[.]securence[.]com%2F%3Fp%3D1[.]1%26amp%3Br%3Dssepulveda%2540ymflaw[.]com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0[.]0%252C0[.]0%252C0[.]0%252C0[.]0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell[.]com%252Ftask

Analysis

user interaction
yes
max time kernel
128s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atpscan.global.hornetsecurity.com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0.0%252C0.0%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell.com%252Ftask
Sample260730-t835sscd69

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
540	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299034934362457"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3500	chrome.exe
3500	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2172	3148	chrome.exe	86
PID 3148 wrote to memory of 4428	3148	chrome.exe	87
PID 3148 wrote to memory of 4428	3148	chrome.exe	87
PID 3148 wrote to memory of 540	3148	chrome.exe	88
PID 3148 wrote to memory of 5092	3148	chrome.exe	89
PID 3148 wrote to memory of 5092	3148	chrome.exe	89
PID 3148 wrote to memory of 1936	3148	chrome.exe	91
PID 3148 wrote to memory of 2136	3148	chrome.exe	92
PID 3148 wrote to memory of 1936	3148	chrome.exe	91
PID 3148 wrote to memory of 2136	3148	chrome.exe	92
PID 3148 wrote to memory of 2176	3148	chrome.exe	93
PID 3148 wrote to memory of 2176	3148	chrome.exe	93
PID 3148 wrote to memory of 388	3148	chrome.exe	94
PID 3148 wrote to memory of 4512	3148	chrome.exe	97
PID 3148 wrote to memory of 4512	3148	chrome.exe	97
PID 3148 wrote to memory of 1160	3148	chrome.exe	98
PID 3148 wrote to memory of 1160	3148	chrome.exe	98
PID 3148 wrote to memory of 1048	3148	chrome.exe	99
PID 3148 wrote to memory of 1048	3148	chrome.exe	99
PID 3148 wrote to memory of 3476	3148	chrome.exe	100
PID 3148 wrote to memory of 3476	3148	chrome.exe	100
PID 3148 wrote to memory of 1260	3148	chrome.exe	101
PID 3148 wrote to memory of 1260	3148	chrome.exe	101
PID 3148 wrote to memory of 2520	3148	chrome.exe	103
PID 3148 wrote to memory of 1840	3148	chrome.exe	104
PID 3148 wrote to memory of 4300	3148	chrome.exe	105
PID 3148 wrote to memory of 3500	3148	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atpscan.global.hornetsecurity.com/?d=onSf8GFR0vqofEgH2g4uw-HLLk8CanH7P8MyIwKm6_tQ5Pu9pbPNj1T55lzhrQIv&f=2TrzmaoNa_fHxePczYo8Zh7jQ1FipSZ75Zn3PWhrv32zzXeGC4g9Tqt1SwRPmKg1&i=&k=KC8o&m=s1wSWZI0LBnhLyhGaVleben3yM-qbBcJviRWI8nkhul5wRK39IQc6GP6YW1C9RMKYJziKbopo1O5P4auVi7LPMLzpQKhemeDqtgyjead3RVwjA2eD90Cq6YLMln3bJNw&n=8OzF6WRzDSHYwCD1IC5CpQSAnKFiPgbncrURgIZwL0tTlQ7yAmYRbw1JmTzk639lT0NnlQoi0VwzaSqua3RaJA&r=xfurpauvb5op_IQMDDXJ4fCIDNuRLqY6VE2CCeHvCfvTILk5TwnDIHJNpQ2cJgAS&s=49425cb1d12282feff739cd58c303bc6532f06ccbdc0b2b4540d5618d6d6c69a&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785349984332-042-00051672%26amp%3Bs%3Dyt4nfvfy%26amp%3Bn%3Dbt6xsnv3a%26amp%3Bms%3D0.0%252C0.0%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fsheriffjaycantrell.com%252Ftask
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90109c728,0x7ff90109c734,0x7ff90109c740
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,11396634092601079322,6013520875896784797,262144 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,9842903668186576693,3455664601266140100,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,3824186970615942353,12010712448317500432,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,5306069660777811754,17814561922704827151,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,10835585438994739642,14137619332009365724,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,16044730301651161059,299477759956206086,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,6701961715302714623,7066378539665828221,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5400,i,1361066322594333150,17722026305792342765,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5712,i,11396482086938676736,3683279073413289164,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5692,i,4579869319997860150,17934185549174417768,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,9466964304907439388,1769328435123103428,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5496,i,9296073239829907636,7322464210092953987,2097152 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,9080493421041991283,10573988001734579559,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,4436058211559485974,9711199956604062355,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,14837501027205331907,6982032306633501924,524288 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4524,i,15774659770496082668,14875305349369347764,262144 --field-trial-handle=2060,i,16080422076196004485,15844295558491483439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5f7de2c2487f40e3d3b876ff7f1a1127f431b7bf7ac4ad14b6669643974ef261
MD5 3a18de2e0a7439d8f89370843a0fd73d
SHA1 94bb420ed06cdad8271393a84bdc34166cefbe26
SHA512 06c31bdbbc0bb316941ddf11551c86ad7cebed492907f1318b9be31e2e01392b7009f275a17ebbf3b91c84d5df0dcbe5ac56c399dabb36c4ee337bb43d7b6e3d
TLSH
T147E02BBDC821AC3709FD4B195015478AE750136B2A80594F363D510CCFB062741C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 603dccaebeae5182342c0b41206fe2fce78bd087ec24f2372b8ed06d6a120c06
MD5 cf4a7bfcc212817cb594cbb79a7d99fc
SHA1 ddd652239d485c957bb2d7153c97166a4dd39aea
SHA512 6aac0a0e32553e6c0b1f6e5e3bbe36d9cdc81bbb4049b085b7ddce5e86a6b856242d1dc0773428b7b6c68fbf15ce064d600becf07b8b9a7984c074d7c73ee8d5
TLSH
T17DC09B341DC4D054C754CE7F54E7AAD531B43C5525337AC546DF00709631755D14D39B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f3cda5d8c8ca24ce29e8fae6d18b3618617d10d96138f347415a5d749e2b4252
MD5 fb21456aabc289ffcec9b2ba54560c5a
SHA1 542d16a466244880af0965c766c5b65e119d578e
SHA512 8998bb58cdc8e6be3931048a6a54e4b4590575be5e7ccda377670c7b36f44a71092bd8dbe8ccaa871a1d3c7b1d86734ba6725a254d9a0ea851a7e841ae5457bb
TLSH
T1BA418DF793B4957E8A1196F4EA156F1FCE690524131C3CA6C9D4AE1B83F2872E10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8813913a34719fb00f69c97a8716750dce07429e1c3363b28c6d257306a03874
MD5 09f71318d72239ff5802ee7bb810807b
SHA1 9be15eef7b4c803eeeaed65ce8339b2fd9c2d4bb
SHA512 1ab7459adc2cbeb079e6853c66a7662bb063e8d4f25a6edce4cd5c55373c8b690506b545183f9ed25c231d30f506cc19430a1948cf027d87c1eb7791f2a28201
SSDEEP 192:KRvp/TM7Z+v7spAPRp22F9wHsb+WNnFNPTb2/ePFo1VyIsnAUge:KRvp7q6YUX/FKwzP32mFoje
TLSH
T1DA42D63EFA54693B5CDBD22AF9227B93D7F5102171942D90E6FC892C11E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a97c6076180443565cfe38373536136c11708adfd46ac6d17968cfcd1f6786ac
MD5 fb92db019404c940788351ba0870dcca
SHA1 a2f582c09de23b55f0dc227dc990477c8a3ccc9e
SHA512 9dde0f7ef187e678b39fdbf3c1a039e77ff0e3c21e531d7d034a54e91170d3bf92e555876d680fca8c5ce5b56da84086c9a90831731e3024328476b87412f915
SSDEEP 192:KRvpPpx7ZGv7spAPRp22cc35N9wHsb+WNkHFNlcj2+b2/ePFoiVyIsnAUgE:KRvpxbyYUX/pKwGS2Y2mFoiE
TLSH
T16252D63EF954297B5CDAD22AF9227B57D3F5102162941E80E6FCCA1C11EBACC321781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b3ae5a9c1840821ef6283ca2fe8c8d3eb30307f048f46a81ed7351ea8f9625db
MD5 1f947325d09a83970ea74b85fe16eb89
SHA1 0f7eaa67a2720bda78d34252cb5f125c255ef513
SHA512 f2153e92ddfb85b372d5e4da2ae0466f3b8fd65cd2a3c6e9bfc04d9c10552eb451a7ad3e931db770e2910b123ea50dac6ac3820b31a1e070c1b8e76cd8e84f93
SSDEEP 192:KRvpPpx7ZKv7spgPRpG2cc35N9wHsb+WNkHFNlcj2vb2/ePFoEVyIsnAUgE:KRvpxbGY8XvpKwGS2j2mFoAE
TLSH
T19C52D77EF954293B5CDAD22AF9227B57D3F5102166901E80E6FCCA1C11EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5861b3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5861b3.TMP
Size 96B
SHA256 eed0f7cac016e97ae6dc44bac81e502c390aa5d7d898a97bb657ac70554f4da8
MD5 52a50da0d81e7df3eacb56f86901a07d
SHA1 d24e07beeb293d4a6f8a8cc028a31f1d086c3007
SHA512 0b48639e46ec5cfb8c4aacb50b66f350313a6152f3039d519db6c00c9070d3e5cf339a312ed6bf9107db356d81f79fe14eb9336e3d1a5df61486e5c90b75a242
TLSH
T1C6B02220C00B22C3C00303B038A082C83023EF20CA0F020383F00A23CC322208038330
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 75d1d84b4b94ee08a49dceb62e4ae7556a7e95abe2fc9a7855ae57594570f2cf
MD5 1ae7891bdd1b9c68568bb42e8fdedd81
SHA1 69c965a60b14669ab1e43abc39ed56790df994c7
SHA512 a7d8abe4dce3ac2c74933a8308d07f76fddfc6c7342b5c1b139064101f32eba9c07148e9220b5b066198829e5f89b265538f58fe4fe617cde53631e41a1cd362
SSDEEP 3072:cGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:vm7Rkm1tYpBeh2BAoK
TLSH
T14CC3123B5D65F8775DB9BB1EB08E0A1F1EF149A6D920DE52C8D85B0823E97CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 48580ff98e21993138e8349f0272bdcbdae74e86a7f4763e413c1f594ec7a781
MD5 aa6747abb3ad3881f1e3f3ee4416971d
SHA1 e0944b43b846bf4c79ddc21ff213939e77f831a3
SHA512 1fe487e853e116946da61396a75511649e4189ff2e470d81765bb78ed672dd893b4b3452fd1e368179ee72671f70ab0b70e97f97772d34e8f05e798914577614
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:km7Rkm1tYpBeh2BAoK
TLSH
T104C3123B5D65F8775DB9BB1EB08E0A1F1EF249A6D920DE52C8D85B0423E97CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 99f33a7c851dbe828be08837180537a4a08ac7f107fa913c8cfadf5e2ed5e997
MD5 78dd2fa67aa469d82db00e04a7850bf6
SHA1 a688792813dc3fc7be9a73d86b3e44d5d393f768
SHA512 484b928cd3e5af1849fe0ec5a92f713281c76848ff4f09e0fad3584b39eaab3b2da81b8e28a15f5703a4d716e77245e805977a01962886a96c87e753bcca3315
SSDEEP 3072:42Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:0m7Rkm1tYpBeh2BAoK
TLSH
T13CC3123B5D75A8379DB9BB0FB08E0A1F1EF249A6D920DE56C8D85A0433E97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4a45534779cb6f23bd3779fb85a97a8c5bddcca118bbebbbd5c525e97a5a7895
MD5 778efe77f8c21c59d542188344ff6d7c
SHA1 9328d5870c035b6c45fae8ad066925d8d41d424e
SHA512 39602560587b39b557b59f25e7cc5d0e82c1a49f12c3315ef329db1fdb21f0b9b08785a9be92e966dd0f9a7db4127538f90e33bf915e6b53a880f345c3178d5c
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Vm7Rkm1tYpBeh2BAoK
TLSH
T1F7C3123B5D65E8779979AB0EB08E0B1F1EF149A2D920DE92C8D85B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download