hxxps://mail-northcentralusazon11012007[.]outbound[.]protection[.]outlook[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mail-northcentralusazon11012007.outbound.protection.outlook.com/
Sample260804-dkybmsca93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302862993553373"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1752	2016	chrome.exe	86
PID 2016 wrote to memory of 2616	2016	chrome.exe	87
PID 2016 wrote to memory of 2616	2016	chrome.exe	87
PID 2016 wrote to memory of 1228	2016	chrome.exe	88
PID 2016 wrote to memory of 4840	2016	chrome.exe	89
PID 2016 wrote to memory of 4840	2016	chrome.exe	89
PID 2016 wrote to memory of 3488	2016	chrome.exe	90
PID 2016 wrote to memory of 4568	2016	chrome.exe	91
PID 2016 wrote to memory of 4568	2016	chrome.exe	91
PID 2016 wrote to memory of 3488	2016	chrome.exe	90
PID 2016 wrote to memory of 1944	2016	chrome.exe	93
PID 2016 wrote to memory of 1944	2016	chrome.exe	93
PID 2016 wrote to memory of 1528	2016	chrome.exe	94
PID 2016 wrote to memory of 3984	2016	chrome.exe	99
PID 2016 wrote to memory of 3984	2016	chrome.exe	99
PID 2016 wrote to memory of 3300	2016	chrome.exe	100
PID 2016 wrote to memory of 3300	2016	chrome.exe	100
PID 2016 wrote to memory of 5052	2016	chrome.exe	103
PID 2016 wrote to memory of 3172	2016	chrome.exe	104
PID 2016 wrote to memory of 5088	2016	chrome.exe	105
PID 2016 wrote to memory of 2064	2016	chrome.exe	107
PID 2016 wrote to memory of 2064	2016	chrome.exe	107
PID 2016 wrote to memory of 1560	2016	chrome.exe	108
PID 2016 wrote to memory of 1560	2016	chrome.exe	108
PID 2016 wrote to memory of 4916	2016	chrome.exe	114
PID 2016 wrote to memory of 4916	2016	chrome.exe	114
PID 2016 wrote to memory of 4020	2016	chrome.exe	118
PID 2016 wrote to memory of 4020	2016	chrome.exe	118
PID 2016 wrote to memory of 1616	2016	chrome.exe	120
PID 2016 wrote to memory of 1616	2016	chrome.exe	120
PID 2016 wrote to memory of 2032	2016	chrome.exe	121
PID 2016 wrote to memory of 2032	2016	chrome.exe	121
PID 2016 wrote to memory of 4684	2016	chrome.exe	122
PID 2016 wrote to memory of 4684	2016	chrome.exe	122
PID 2016 wrote to memory of 4284	2016	chrome.exe	123
PID 2016 wrote to memory of 4284	2016	chrome.exe	123
PID 2016 wrote to memory of 4476	2016	chrome.exe	124
PID 2016 wrote to memory of 4600	2016	chrome.exe	125
PID 2016 wrote to memory of 4600	2016	chrome.exe	125
PID 2016 wrote to memory of 956	2016	chrome.exe	126
PID 2016 wrote to memory of 956	2016	chrome.exe	126
PID 2016 wrote to memory of 4612	2016	chrome.exe	127
PID 2016 wrote to memory of 4612	2016	chrome.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mail-northcentralusazon11012007.outbound.protection.outlook.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe48c5c728,0x7ffe48c5c734,0x7ffe48c5c740
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,7538068418756427492,17920428474301281320,262144 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,5423985625320636798,9908458085687950367,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,16431954046436491094,590680976673957896,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,1871836325276795282,13738073104663952264,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,3072462671550361485,9157857901804642321,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,2913354660671800266,13536621005614241221,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,9031972830402740714,10794545063399011236,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5384,i,5253392874972171150,3702440752518562153,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3272,i,10811085588208411570,2001187583764914456,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,145781263374390576,654569333794224316,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,2544981035799012144,11681505809370847735,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,6105866769317445896,2178470360428821854,524288 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5444,i,6101825193533992101,10596236391427041080,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3316,i,15183285129960794694,7459771091442674213,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5552,i,10685184682287614994,10778840672068438843,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5608,i,12637536400362467043,8896304454160297272,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5756,i,7772315826522997508,16017990473914558109,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5568,i,4137324628876772578,9438192537779155633,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5572,i,12526175265199921291,4027221126505612045,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5516,i,5003408929540196815,15761651812658818972,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5620,i,8162669841505571954,435657084515825914,262144 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3256,i,14131944911504891182,4944308494672569156,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5588,i,2685568907947858687,2625754381750077340,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3364,i,3077621950080597470,1531185857431244556,2097152 --field-trial-handle=2016,i,7991352539082595113,3304368309229956371,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bd0af2632dacbf17c760ed96d07a97661b3316d69f9bd396cb0b5972a56e6b34
MD5 5daab8d8cce8ca677aba85b5cd66cfe2
SHA1 3d44d2b62ec63da67af34abf457b2fc8ba46f08c
SHA512 eb24f74824e90dca550c57608678c711493f30d7801e0642cdea2ec09c0b220e7ca0ff5c365297af41daee15b07ad8fc632d41aeafb8e605c1b6d249f5580114
TLSH
T144E02B9DCC31EC270CFD871D50544645DA6113A72760845F3A3C9148CFB1677058699C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 726bd81718a7328d531f247db05122891098958774a2f2ff98cca8ea15dc4d74
MD5 3b1a60e245fb6d426c793a9568da6c0a
SHA1 5ed02d1e88afc6710ece48ad0f3a9312b1cd8385
SHA512 d70239e07217c25c5291303245e467ed40fe27cb104f2f667c80b3613de0396882a4cc1e8722798318ed232e3320d0b1334f353012c0e896bd5e3d97a89147fe
TLSH
T13841ACF793B4857E8A1192F4EA156E1FCE6D0624031C3CA288D4AE1B43E29B2D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc31974f518e473e0889bb136f4986d9008b33ccd53d1ecca3ae3d8fbd27c9d1
MD5 9959f68ad0f5814e7b0e2ddd4f6efcc6
SHA1 496050a86571764102703a5477270e143e120a4a
SHA512 838bc4d05dc6b130e52e908e8048a3714dbae4de0c3acd9b7c0423e5739a9431ece0c18103123dace082380668937029d6b31976e47ad332ced520e6124602da
SSDEEP 192:IRic7K1Q8Nqqv7ApAPRp2l9qHsb+WNnJtPdk2iWXkwZafVyIsnAUge:IRicGOmkUXmkwjPC2f5a5e
TLSH
T11142C82EEE106D3BACDBD22AFA267763D7F5103521902E94EAFC892C14D75CC212711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 90a4ecf26508600a8a8d9dd51844111a1ad6106910e6fcfc64e3704b0d74807a
MD5 3454ad1a679f48fa75f4e0b964587061
SHA1 80aabd075f04986cb72ff6787978859e3d1af574
SHA512 ed602dfd5e9107582547776b4c574d3d925f751544e77f09da7954da87a2832763b90e2f87de67e79b169bc618255d29f28b55cdfbf2d3daadc2d77ff7f81b04
SSDEEP 192:IRic7K1Q8N5Sv7ApyPRp4Pe9qHsb+WNnJtP11k2iWXkwZa5VyIsnAUgE:IRicGt+k+XvkwjPk2f5afE
TLSH
T1FB52C82EED107D3BACDAD22AFA167763E7F5103521902E94EAFC8A2C14E75CD2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dca950181a70af8644e63a0d627eda201e6f41de13ad2484ccc8dc4137e7b421
MD5 dbfaf97b77d09b701fc9f2399095d0e1
SHA1 03c311dc2a7c8d1e691f6816678ce131d707e355
SHA512 c204d8b9320c8f652d9525da0b603f917dfead607a7d5c82a7eaef55fc4fa73cfd5e96403c36c957afa57de7d42ae7862dc28a6920a740f5f6b22a456e1c9d1f
SSDEEP 192:IRic7K1Q8NqSv7ApyPRp4Pj9qHsb+WNnJtP11k2iWXkwZa5VyIsnAUgE:IRicGO+k+XKkwjPk2f5afE
TLSH
T17152B82EED107D3BACDAD22AFA167763E7F5103521902E94EAFC8A2C14E75CD2127117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9159f91f455899d02758e5c4e8c95ec88a863aa773d17b8912a4288296073fde
MD5 2d36a7ac2769dff3e060dcf1caec2875
SHA1 444495e5d6659d7f8ad62d21592b2fe25d0a5a68
SHA512 d65128675a81502cdb7d4a1a9167a176f151229341bc58e1cd6e8e4f92ad521cb695704340f1aa188b18abb6bbb8aed870b2a7b3dca4aadd9ae9a565349b2d07
TLSH
T109B0124080455111C04242F01147148871549F10B64A1B0573E06F23CC251618414190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58adfe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58adfe.TMP
Size 96B
SHA256 bdd2d5047f2a1f77e6bade4d4735088e12c77befcb7c0e54c6f5959b40bf5b79
MD5 4697d9e688fbadbc753b88d37137b858
SHA1 429b04562e13796d86cb5fea6eb9cb7090dfe1b8
SHA512 b5ec7e5b0ae42ed0fd058709cf90b4af1c8c9636ddd6dbd8b3ee4da9b2369f39535e32c4c28c162d775d3fca35f9346a4f185b0250ab65570ef61d7fc90ac1ec
TLSH
T161B00269C5026712C54303B426D696EC73E0DF39C7431213D6E01A66EC6A671462A1A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e951b1d9ae4cb1fb7712d5715141a8bca36281f6ea2d84e721cb5290dd8bf51c
MD5 1c106630fdbb2b7fdadd453f288f4c73
SHA1 a18ebd94d3d332c961df6d0079b3d25d97bd1434
SHA512 bb7f4f25e960d6e2502a3a8b0d28dabd15a4f5484b0d32a2467ea30528f58aa414985bfe29955afde6d1c738fc6b35a5d56a78a97e227de96fe858b9e2cd3db2
SSDEEP 3072:AbGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:lm7Rkm1tYpBeh2BAog
TLSH
T1B9C3023B5D75ED3B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 eadbf81cadd4470758e041291664bbd9b6a750395e6b49269ac94ab2e84ca467
MD5 ba64e81a15b73f36375cdcd65c7431c4
SHA1 55623db96f6bcc77546702bea20790414972f519
SHA512 ae73d5e957f895ba7e891dcff9c08b78da45aabaf1adc61bb924beb3bca8555d6f0fdaa5aaf6604f7f16e73a55f764c56b52d1536d155a23393757481bf0ab52
SSDEEP 3072:3QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:rm7Rkm1tYpBeh2BAog
TLSH
T1A5C3123B5DA4EC375DB5B71EB04E0A1F1EF249A7C920DE92C8D85B0427E97CD1A44A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 01fc0fff166b76c41a502eb2b4071134af0690c62c883bd8dd752815f2093ed4
MD5 f8fdc678b158d44331ebc99965d8104a
SHA1 7af57e45638b1774db52fa3d2c4108e518aa3ddb
SHA512 40d3f5a975c6ebdd8d2bcd6ce73db32426750a927e83d2820ffa494401f278b6719af16029612fb68120716e783d8e3bbb909418d976567f1a581ba98a46689e
SSDEEP 3072:kQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Cm7Rkm1tYpBeh2BAog
TLSH
T190C3123B5DA4EC375DB5A71EA04E0A1F1EF249A7C920DE92C8D45B0427E97CD1A44A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 692c5800de96928c82d4e63331957d11c8e1aed7e513d3d7fb03f945f9626f30
MD5 4ffc48c7b14ebaad4002cddcc6efaaca
SHA1 9263dd2a408e354e3a0abf87b3b245ed56f9545b
SHA512 b13b5a2d4c547fd85d9a4e8163d63701a6ce8a2e7feb6e5153f6b0e8c9a7042b8699957339ccf219e95faff7c82f9c46f8cca25144438f3f9408535aeeb60457
SSDEEP 3072:3mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:hm7Rkm1tYpBeh2BAog
TLSH
T1D1C3023B5D75AC375DB5BB1FA04E0A1F1EF149A7C920DA52C8D85A0427F97CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download