hxxps://jnkie[.]com/flow/a7a60c5e-c38c-433c-bd90-36f06abd3435

Analysis

user interaction
yes
max time kernel
76s
max time network
77s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jnkie.com/flow/a7a60c5e-c38c-433c-bd90-36f06abd3435
Sample260804-h2wxcsfa83

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
94	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303013296968363"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{40D3C368-E68D-4F94-BF4F-EC62B3AAF6B7}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe
Token: SeShutdownPrivilege	2360	chrome.exe
Token: SeCreatePagefilePrivilege	2360	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2744	2360	chrome.exe	79
PID 2360 wrote to memory of 2556	2360	chrome.exe	80
PID 2360 wrote to memory of 2876	2360	chrome.exe	81
PID 2360 wrote to memory of 2556	2360	chrome.exe	80
PID 2360 wrote to memory of 6072	2360	chrome.exe	83
PID 2360 wrote to memory of 6072	2360	chrome.exe	83
PID 2360 wrote to memory of 2336	2360	chrome.exe	84
PID 2360 wrote to memory of 4496	2360	chrome.exe	85
PID 2360 wrote to memory of 2336	2360	chrome.exe	84
PID 2360 wrote to memory of 4496	2360	chrome.exe	85
PID 2360 wrote to memory of 2812	2360	chrome.exe	86
PID 2360 wrote to memory of 2812	2360	chrome.exe	86
PID 2360 wrote to memory of 1144	2360	chrome.exe	88
PID 2360 wrote to memory of 1144	2360	chrome.exe	88
PID 2360 wrote to memory of 704	2360	chrome.exe	89
PID 2360 wrote to memory of 704	2360	chrome.exe	89
PID 2360 wrote to memory of 4740	2360	chrome.exe	90
PID 2360 wrote to memory of 5840	2360	chrome.exe	91
PID 2360 wrote to memory of 4424	2360	chrome.exe	92
PID 2360 wrote to memory of 1064	2360	chrome.exe	93
PID 2360 wrote to memory of 1064	2360	chrome.exe	93
PID 2360 wrote to memory of 2756	2360	chrome.exe	94
PID 2360 wrote to memory of 2756	2360	chrome.exe	94
PID 2360 wrote to memory of 1096	2360	chrome.exe	95
PID 2360 wrote to memory of 236	2360	chrome.exe	97
PID 2360 wrote to memory of 236	2360	chrome.exe	97
PID 2360 wrote to memory of 1720	2360	chrome.exe	98
PID 2360 wrote to memory of 1720	2360	chrome.exe	98
PID 2360 wrote to memory of 5612	2360	chrome.exe	99
PID 2360 wrote to memory of 5612	2360	chrome.exe	99
PID 2360 wrote to memory of 4520	2360	chrome.exe	100
PID 2360 wrote to memory of 5736	2360	chrome.exe	101
PID 2360 wrote to memory of 4520	2360	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jnkie.com/flow/a7a60c5e-c38c-433c-bd90-36f06abd3435
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d30c728,0x7ff92d30c734,0x7ff92d30c740
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,12216737315363210019,13660179664540575863,262144 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,17962461440250685798,9716046588929140374,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,15156981406391675860,12707292576299995944,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,14131051968451710882,8288742438735498762,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,18164716423930087827,13019017378806163873,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,4515736103724568389,5279877121872603308,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,16569856985633720666,9676714295837423936,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5112,i,13337794910656282931,5051897572509375559,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,12123853948887253702,15173267419763757387,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,7229978984889973850,14361012049213323566,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,9863958274344352501,16138209370981760171,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4812,i,11822996996887625317,9795633122861041379,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5096,i,317728726886559325,17069133854261851445,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,13678849960040186365,4468940629703420242,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5000,i,15273681807076899710,12029813457211939883,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6392,i,4968703519063765016,1596468804251393530,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3056,i,12405113023854914647,1036823124372253169,2097152 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,16111376116656094382,10223157289810317074,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:12
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,113736087847325774,5475356735183644681,524288 --field-trial-handle=1964,i,1470543558010703911,5434097072441535657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 67ddb55aa830d11effb98b4a40fa68eda57fb5d46a3da207454b54731c388a12
MD5 0fade58cb16699989b662bfbfcb46c79
SHA1 89f7a0020f6d04a18b4f7a67ff231bd060372ca1
SHA512 6c086af975f1b47d13bb9ad0a9daae8e50f1153af39b4771463a3b211be5f9da7fb575014ca390008f722f08f5d8c969433a9168e2487c68a5f80afd2950bf48
TLSH
T161E0E5A9C821AC2708F95B2D66511349D76113172B805D5F3F3DA10D8FB263A414581C
MD5 SHA1 SHA512 TLSH

Submit Download

2fec1ff5-08f5-48bd-b5a7-98d90d6ad2ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2fec1ff5-08f5-48bd-b5a7-98d90d6ad2ff.tmp
Size 5KB
SHA256 3650f9a5aadf74e28823c9edbd020df02de7737caeec7d06de0e9e0c4eadd6e0
MD5 7df90fc8c9cc3d44616635baeaeee8e6
SHA1 91472e31ac07207e596ab61e751fd445baa3fdec
SHA512 56a1be1e1db3a6f4b1d52761cbbd412b625f248ee899ac9b29bf95e70f707fd331a7cb9c7598445ab5a596776cbefb478f5ac2f3a333c57d8bf7f47439ca1756
SSDEEP 96:D/8aIaEdbPNDAaPcIT+FnucbCsec9XAuZ8oeH:D/8aIaEdbPNDAaPcIT+FnucbCsec9Qum
TLSH
T12DC17CF783F8966D8921D2F4AA185E1FCE5D0924431CBD7A89D8AE0B93E2471D20075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 94793913cdfeec186b9abaa67d455a6626912150fa4d298f478f8f85d1eeef49
MD5 ced2bfdac54ef8265b66c5f9c1d563d6
SHA1 2a1d8cb4dd7b03c8d6b81721f796ef14bfc9d7c9
SHA512 3d509e108849aa523388314ee697513cdfd4f817ed340346305b40f24c4f847cb503ec3dedacfea1a23b7bc4edcff57d07d7e3d67a66481606830df3d04ab089
SSDEEP 192:sRedvYkcsBiv7HpAPRp2ohl9DHsb+WNnxcGp92BePqME0vVyIsnAUge:sRe9XujUXT5wWS2Bkxe
TLSH
T1F142D82EBA206A3F5CCBD259FA657B57DBF6202120D41EC8E6FC992C04D79DC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b1a789850408f9b1bdea99bc0a6cc3b3a79e2728f550d6753659afe0da037f64
MD5 aa0aca0b70c0fb85af898fb650edd792
SHA1 213c7869a5e7d1d3a99fe5d58b1d3a3b23d71c6d
SHA512 e4ceb296e29e691e03e3cb5bcf01e86756ba2b82a8f55938014259088539ef952d39cdc4e38c722c94f00b4f90fa54ed4a30f28f4e6c2250b679e8bbc4043ba7
SSDEEP 192:sRedvYkcsBov7HpAPRp2ohZ9DHsb+WNnxcG7zedePqME0rVyIsnAUge:sRe9X0jUXz5wWiedkFe
TLSH
T12542D82EB9106A3B9CDBD259FA557B57EBF6202120D41EC8E6FC992C05E79DC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 483a65b34dad3ae59fc14e293e2bc6fa02c17e5fd2095159c8559fb7ab165636
MD5 72377a18834b52f5fecc0df69b7d9958
SHA1 495d300706bd28e9bab3f9acd69d77809674daf4
SHA512 fe9572e5f7437e68f940e5d90c7329bc8d5f0125034054bff7057e48bfae57dc0d5a58ee21903b40529cd8d1655c58999db3eea8d23a61cf01407d93da0a1a7e
SSDEEP 192:sRedvYkcsBfv7HpAPRp2ohZ9DHsb+WNnxcGp92BePqME0vVyIsnAUge:sRe9X3jUXz5wWS2Bkxe
TLSH
T10C42D82EBA20693F5CCBD259FA657B57DBF6202124D41EC8E6FC992C04D79DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 c7702db277b1192f925261046b26e37553832e3ed1b4278366be037bf97d6a7d
MD5 110f95022f19c1c9dad13ed4ab5ea5bb
SHA1 553e4568b8e2dc705364e510d1b742d6af47a786
SHA512 41fd94f4c64d463d82494b51f5ba4f2b092a78815aeb4220f05da68e5559b257c015e01e7667d473bbbfcbc73b321a093d774803c7f061afca9f45cd7032a1a7
TLSH
T10AD0970BE82648A0EB6A4BB00A21401E83722CC840E240ACC816342828B46B7D912EC3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe592f73.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe592f73.TMP
Size 138B
SHA256 f0943a0617ed012a8d9533f55fc38ca6b6f6542307628e4bfdd273e56268e905
MD5 bf282510bc2b9c76044378cd23d3c2be
SHA1 29fd34f7b603c4033e926832d2764e65402864ac
SHA512 c50e63580d46175332488b910c60c72584b408b7c63d9cc51850ab2655d1f348c352a733b782c0a006603d1bdc892f0d9e7a07b45b372f87f96f29b54ab6ecbc
TLSH
T1A9C02B97B0000951DF1547920232411C93032CCC4CC3C05CE41738243070F736503ED1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 42d4ed147d7102c0a6c90e90d19a6be12b22ec7423d44f7f4221b64575942a3f
MD5 8176b896c92d6c4f6b247195a875fea1
SHA1 0ded7ac11cb3b96edb919fcbab0311d836d48979
SHA512 2a7d5cb505b09ada95f4f5766ba403e91f49ab7a9c511b2dbbc4fa100c0c106f06faa2b52126f6329377c62f0525da2a08dc38b4745a889a8f365a534b5afef0
TLSH
T1FAB0122080016512C54202B422465488B2149F11DA0E170543F16B22C8355618228091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5867fc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5867fc.TMP
Size 96B
SHA256 7dffa167112a9c103a5a3ec29721f3b4525458d4d4e38320f88beececd3cdf89
MD5 645e9f1fa944f0af12b1fc63e40efac1
SHA1 af6667483e164e8b371630d22c161ccb17f843db
SHA512 f5f3f142f3c3215fb8e41d6e6f737547066e0d454479d77d60f4409161a23d4d6b4a7468edf6952ce49ffe4f431e022135807b1133a954e41c2b2dc3b77125da
TLSH
T10AB02200C0022203C00203B820E08CC8B330CF28CB030202A3E02A2AEC32232003A020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 09d76bed3078c11131f2ef8b73943d2d48814c653997ff55f5f5ab85e9161a61
MD5 ec96fe7bcefc241a7dbae3eae9a40a32
SHA1 8fd315a8559012627bf54579055f0d7b68555c91
SHA512 d0559909fe62ff48a3de9904553590f439cdd709e6296aa51025ac2985ef6210dc6becbfb28fbabe61cbc54a9d8cc76d226f78771a07d545c7b16b2ba0fbfb9c
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:em7Rkm1tYpBeh2BAo+
TLSH
T1DFC3122B5D75A87659B9BB0EB04E0B1F1EF149A6C920DE92C8D86F0423FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5a2a52e2338092a1e2b29708f4bc3acad2cda6e5176d3e8a9632f4f85ecfb49d
MD5 2bf3062b2cedadec45c1ee1482276d0b
SHA1 c550daeae81119e0b51c330837fb2ed0ef44d737
SHA512 ad986dc3b2dce706ffd7b5cda2e4a0500f83c0e78adcbe9c10a7ac2dcc7f3f1208dd2643f381dbebb6fd24849d3fd66b2d3739ffde5decbcde1eb9f39226626e
SSDEEP 3072:CFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:CMm7Rkm1tYpBeh2BAo+
TLSH
T1A7C3123B5D75A9375CB5B70EB04E0A1F1EF24DA7D924DE91C8D86F0423E6ACC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 dd87a6b0232d12a53f7ad41f4ea8487168ca1a1c9fde0ccfc9366195ab247eba
MD5 1ebf055dbec133f383ca39116bdddb65
SHA1 2e59ada15877bd56b58c7c04b9d55fe92d509426
SHA512 5231417b7fdaf002dfb8b966cf3768ca3118eea5a4906dce09be369cb4332d966e8b457004c14471eed5236cea1641fe6cf5be1fbec4c53adb8e7e0e2992ad21
SSDEEP 3072:ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Ym7Rkm1tYpBeh2BAo+
TLSH
T151C3122B5D71A97658B5B70EB08D0B1F1EF149A6C930DE92C8D86B0477F66CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ad11fc64ec245e203e28c0ae2f3fc38ee902c6e3f03773b4940e59101d3ad533
MD5 8f78b0981e4418f0e820e924155191a4
SHA1 062a40a66741424e47184ca8d71d0105188d2d72
SHA512 a57bc16a0289fbb0e27abbbca6e5e7135212b13f3c2968ac13ed87217018798977b5fc1777ef6e92a4589b5f48b9077b4027eff94cf7c9f0b177f3d08f0b8e65
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Pm7Rkm1tYpBeh2BAo+
TLSH
T107C3122B5D75B87659B9BB0EB04E0B1F1EF149A6C930DE92C8D86F0423FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download