hxxp://vogue-glamour[.]com

Analysis

user interaction
yes
max time kernel
300s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vogue-glamour.com
Sample260804-fx196swwct

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3540	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302941673427417"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
3788	chrome.exe
3788	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3440	1236	chrome.exe	85
PID 1236 wrote to memory of 2200	1236	chrome.exe	86
PID 1236 wrote to memory of 2200	1236	chrome.exe	86
PID 1236 wrote to memory of 3540	1236	chrome.exe	87
PID 1236 wrote to memory of 4596	1236	chrome.exe	88
PID 1236 wrote to memory of 4596	1236	chrome.exe	88
PID 1236 wrote to memory of 1764	1236	chrome.exe	90
PID 1236 wrote to memory of 2840	1236	chrome.exe	91
PID 1236 wrote to memory of 1764	1236	chrome.exe	90
PID 1236 wrote to memory of 2840	1236	chrome.exe	91
PID 1236 wrote to memory of 716	1236	chrome.exe	92
PID 1236 wrote to memory of 716	1236	chrome.exe	92
PID 1236 wrote to memory of 764	1236	chrome.exe	93
PID 1236 wrote to memory of 3960	1236	chrome.exe	96
PID 1236 wrote to memory of 3960	1236	chrome.exe	96
PID 1236 wrote to memory of 2012	1236	chrome.exe	97
PID 1236 wrote to memory of 2012	1236	chrome.exe	97
PID 1236 wrote to memory of 5076	1236	chrome.exe	98
PID 1236 wrote to memory of 5076	1236	chrome.exe	98
PID 1236 wrote to memory of 3704	1236	chrome.exe	100
PID 1236 wrote to memory of 4032	1236	chrome.exe	101
PID 1236 wrote to memory of 952	1236	chrome.exe	102
PID 1236 wrote to memory of 3404	1236	chrome.exe	103
PID 1236 wrote to memory of 3404	1236	chrome.exe	103
PID 1236 wrote to memory of 1348	1236	chrome.exe	111
PID 1236 wrote to memory of 1348	1236	chrome.exe	111
PID 1236 wrote to memory of 3788	1236	chrome.exe	112
PID 1236 wrote to memory of 1400	1236	chrome.exe	113
PID 1236 wrote to memory of 1400	1236	chrome.exe	113
PID 1236 wrote to memory of 2668	1236	chrome.exe	114
PID 1236 wrote to memory of 2668	1236	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vogue-glamour.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe5910c728,0x7ffe5910c734,0x7ffe5910c740
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,13945831460992147016,10640568007727717650,262144 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,5749652533184008003,9152302279355619128,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,3931902763515199668,10371914681769899629,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,4039747651627380170,4936985929405345849,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,11134804864754160550,9303387974123859860,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3104,i,8586151943836049890,452655928780244295,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,1297150600909134132,8816480951232982036,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5412,i,7209839060320620396,13695022643925117649,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3180,i,15109415367039607713,17043388992164954940,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5776,i,4504647505030081281,563608144453619096,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,6824404371603279006,12356690502780771408,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,17221865686352389685,8234205178871519702,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,8883746734949497660,7545112550245329160,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5340,i,3913571773698335882,4502534054535001517,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6076,i,11792980768417416542,17383783711225507437,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6020,i,15189569383989076193,4151860835175298022,262144 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5556,i,13047342736658532752,12236811650460687404,2097152 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,557074610866110670,12651851983696601113,524288 --field-trial-handle=1992,i,4464303476561871349,6627745660104395053,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

102e1b8c-36f7-4e85-8098-831d50285132.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\102e1b8c-36f7-4e85-8098-831d50285132.tmp
Size 12KB
SHA256 b008fb6a0f7626b7e766a213bec251aeb279f1cf0f809ac525ea2a012a9483b7
MD5 b4b17b69ebb06b42545b60b63ce1af53
SHA1 9c31d5abbd6191843d5d9ad6fc4bee033c49c03e
SHA512 647c84350bc310eb47c9012b384782d6ffc7de17b849eae1d524e95067c5984d2bddd3831450bd010d3f5d95493849c9f42367444ff9bda834391fb4161ab492
SSDEEP 192:IR5T7CSVCv70pAPRp2dj9+HHDb+WNnjbw1Pcam2raekwhHVyIsnAUge:IR5T3OgUX685/2Pch2OeTe
TLSH
T13842B52EAA50697BADDED229F9617753D7F6102224D11E80EBFCCA2C05E75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 048bb5810323cae8d77d49b72016c68044b3385bad0a823c94f14a3e81fc48ed
MD5 ab6a89f5bd0566d4df7f60713f959786
SHA1 903380493a3a215472f5b67a64c31193d80ba42c
SHA512 915891f02fb6d8e115dbbb7bab0b1574a59ee27dc3623543ddf270bf36d6d3a67e15013a30f1e060a590ecaf319cfd5a588f7be96a4f2f85f612ab1ecbbdefa7
TLSH
T12FE02BA5D861EC3714FD0718A0505745D758239B2E409D5F7F3DD10C8FB56364D85D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 36ee4c0d9503e54b51f6fd3683b481e8a1eeadd5a1fe07ab5bc0bb09b4c4042e
MD5 02318d2cf2cef8316fc692664b3484ba
SHA1 32318f4a309453d776ee383eb7a9aca841e37ef7
SHA512 211d2e67ad568e70ef76c70040279e676474a94a6eac17f2b969fe49c0125586427440fa9605e8b74d7caadb5e0a7ef9d40904209732ea4237371ac59d8d3608
TLSH
T1D7419BFB93B4997E8A1196E4EA156F1FCE6D0524131C3CA6C8D46E1B83F2872D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9582632a8c04b316ecd827cf428222b7681bc080c099142c341c9ef451d8b611
MD5 f4de0e8133b67fc9bde17be3376f1b07
SHA1 3144067a196463e7de1f1d393a5eb0cd4d348f8c
SHA512 70e74bbf4d1a34a4be5f0f0ea74384d80ef502c79b3b8287854afee20de62c5dbc9166ccec974d9427462bc1767dd239a35bfd42406ea77dc5457b300a554a30
SSDEEP 192:IR5T7CSVnv70pYPRpKdXE9+HH7b+WNnjbw1PcKm2raekwhnVyIsnAUgE:IR5T3vgkXL8B/2PcR2OeDE
TLSH
T16F52C72EAA50697BADDED229F9517B53D7F6202224D11E84E7FCCA2C05E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c4dc9c04cc3884d2de1af8dd80edfab5ec4ddf0a893663d57bcab1b5e1eb785
MD5 31b1aa3164a5a629727a5f7d83c892e4
SHA1 05805ebfdff9129710b6bc37da5f6f28e6f7a9ab
SHA512 fbd505f97f3211f553349cbdae61b9927dd6851a1a8f91a5618ab3d994526e7a9eb791bc6f05122b6a523bed57dfa08f8394f8fb2801859d20c3d5b5ce991812
SSDEEP 192:IR5T7CSVOFv70pAPRp2dXE9+HH7b+WNnjbw1PcPm2raekwh7VyIsnAUgE:IR5T3O1gUX/8B/2Pcu2Oe/E
TLSH
T10342C72EAA50697BADDED229F9517B13D7F6202224D11E84E7FCCA2C05E75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1290a231edc2d6b5731fd9fd904234d8f8991df9c1248902ca1c0f9566cb74c0
MD5 71c4bb9f781f277aa44bc87e9e33d706
SHA1 478aa13e4adab705054a6cbcbcc3001d1896b0d8
SHA512 e0a492035d7eef9774cdc98393678fb22441fcb834e2c58854e7c857c251bcba45c08f509f4d6e0e53ad693ef0ef7416ce9f959c38b20d97e32956c04160def6
TLSH
T132B0128084436262C00203F411435C8CB1149F14AB2A170543E469228D25E508025060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa16.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aa16.TMP
Size 96B
SHA256 4013aebb73d439788539951e2250b06ca899c473f79114e60f9af9ee0650ba9d
MD5 eaa44020a36cfb0f46ff92f31943cc84
SHA1 16bab10c9d8f1f38874f493a09dced27c8fb0f8e
SHA512 7cee2b01536c4c183076f1a805a56b2460d524d12fbcec221e03984a34e03c510f8c8f3609afcf3acc7ade5e373847219a7d731260b3d0595497f02e6cba2cc7
TLSH
T178B02200C282A223C20203F03A8280C8B0A2CF32EA03230BC2E00A23CE20A380030CB2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 6b478aca01291b132e90dc376070fbc653f3ed187b71de39380a8b77f1bff75d
MD5 216e832222eaf4662f560f8566bfc021
SHA1 e8a98c9a90787a3a923aab1ea2e39671ead8373e
SHA512 a00a8c8e06d688a6d5e0fcf4bf0a00c0d92781e1750ee1a20bdff65c72c3d2fb3147899d0eb3dad1b9d93fdea82d5ea86544d35bc296073dbcf90c0d77789319
SSDEEP 1536:WJGayD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:KGoqfd7NtZL8cHQRZEQ6Sps3
TLSH
T132C30237DBC21E339DD2DF64B5130ED653F604A9D034D305EE6D3BAB6883595A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 47d8e043ff49ab6be86a59789a1ea0c7b5e169dba386da08208ded6849c8c355
MD5 b694641d2dac5ecb1f47205d440a518a
SHA1 c9ecc00e16742d595b5088fa41bfe66e1a559ba4
SHA512 09df49385f878af62ee1c60cd128dbcd2d173708063aae3d3211c2d6aff873c34d1af21e89618dc6de563c0fc3583918a06d8f2544a744ba6c7d6e1333f204f6
SSDEEP 1536:bULyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:gqfd7NtZL8cHQRZEQ6Sps3
TLSH
T119C30237ABC21F339D96CF64B9130FDA57B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 68ff73dbbe41a6eccf98d28635393ee3c2bd9db4ad5512219c28a966d885969d
MD5 2530d7e457da6771284f899866fb09bb
SHA1 caf2e90f0a6d72ba73155a083ae07bbd2e2eeedf
SHA512 9bf17816ed315638526c38c0aa0da3fe8bc42bedc89d596972ec9e891fbe09419d84555ebfd36a78d008ca720e0f8f920d634412671c0a13bee1e08c848cd2b3
SSDEEP 1536:SJGayD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:uGoqfd7NtZL8cHQRZEQ6Sps3
TLSH
T11DC30237DBC21E335DD2DF60B5130FD693F604A99034D301EE6D7BAB6883595A8424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 867450c8a3387c13e48875e9e7a1a178579f76bacf9ca66649a0c6d3af6f1d13
MD5 d78e9567a82017129f40264399847e4b
SHA1 684f74f37ffc66754ec7f7c52797db3febd32055
SHA512 57f1c13bddffc019666bc56f10f8da227cdef88779e0e4709d495fe2a128594ed2d16eecd3815bc138087172da9172cc2683d5cea8e3168f36c1d7043b3fb0f0
SSDEEP 1536:rWTyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Kdqfd7NtZL8cHQRZEQ6Sps3
TLSH
T12CC30237ABC21F335E83CB74B5130FD797B644A99034D301EBAD3BAB688359569424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8414e5cce4a3aa2ea2b18f6ed6522dbc24724a2a853d5a892b6776f7839d4773
MD5 0c663775ede76eed6f2b4599dfe4d4fa
SHA1 c115c262e1efa7ddc1c08ef3087b991abe7eb562
SHA512 4c06cb9cfb4fdfbd57f4949b32ad8c4d6d46bfd2bfbc68465da69898595d62c2b193c8072658a11c29f05355cc80aaff002b93f3a709bb91b85cb0ce5563a096
SSDEEP 1536:SWTyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:xdqfd7NtZL8cHQRZEQ6Sps3
TLSH
T145C30237ABC21F335E83CB74B5130FD797B644A99034D301EBAD37AB6883595694246C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download