hxxps://t[.]rdsv2[.]net/ls/click?upn=u001[.]3D48gIrzn98WNdDPiIQSjvGKGdGM-2B-2BI6JXOPX6K60uK8Qg-2BdW4Plul-2FxViqNq-2FEt32MP6WUHoomnSyP49mj3iJ-2BY23XPti3C6oliKyWF2USENETkUKwhXbVw4L2vZRs9jSIuXip6Olu1EzsMKlG0da7poHF5lRx3clytG8Fi-2FbIQvqXm1kKDxJDTRguPva-2FIZLcysJR2UWIYdycgMgogjGEorrPZHv3NC9QwAQzv2QvzG3Ch6E30ONf5pHdCsBwB08U2_Lsz-2Bbc7cmv92bINl-2FoHEMWerK7KF0igj6cpG1pIXfPPCAsfjhT1E54iegGRJhFpk03yqPJrfGUss-2FOiQMjzdmqP-2Fjz-2Bk-2BlrDIy1rMDUrmx9AhTGoeVS6BHMuaG4UOqppLMhm-2Fu-2BVzIqf3EtdkpxduxdcZA5ghnkC8PpEk796e0KHr7JJk7bFr0EYxOTnMQI9dv115-2FhI3WFYq25KaqM-2BUCim0IwUYYsFrjY6iXeoIdm-2Fys3PR3-2Fa60lA4zA8YZLUB2FpSMhOzF7IHhuzkph75Pd2ryvOMgetAeoYAb3ExipZZcXMpx5qBocVA673SGNcxLK5amRTjslA6LWekZeCtFeUSqVZRP0a7sXLFzYFOadPUes8v0hJ7Ew9UjICKZmlLZFoLUQjqdhHOXLGIkHyxwVyw8u3WRHL2TMCP-2BmCgwmKF09fMUlvMURbGhZKnFbC-2Fv7yw38xzbJIxNF3RxpDiavebtj0S4vg83U-2BeAyGUuNpXQFkqzE96ti7YcZIJFlNxNPS-2FRDLkd3-2F3uTjKSAoh0HOkNEq0kGFYD-2FkoPFr-2FTvCYNPg7gnCOJLYfG-2BcVJ84DGHM7gXzFdX0G5ElJqvxoPIAo-2BxtNdc8EHmYMMjujGho1POfc1GerN2rE7x7nFUbntxpVPAaO0nPE-2BpvuIx1ftBm9nKQkJM1MRGMCzyiwEz7PTo9JaN-2Bo6tw0Wvgt4ayCcvymuO8F4esgy-2F-2B4n7dVtrVGhuFWyNI11B4IBeNWxs-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.rdsv2.net/ls/click?upn=u001.3D48gIrzn98WNdDPiIQSjvGKGdGM-2B-2BI6JXOPX6K60uK8Qg-2BdW4Plul-2FxViqNq-2FEt32MP6WUHoomnSyP49mj3iJ-2BY23XPti3C6oliKyWF2USENETkUKwhXbVw4L2vZRs9jSIuXip6Olu1EzsMKlG0da7poHF5lRx3clytG8Fi-2FbIQvqXm1kKDxJDTRguPva-2FIZLcysJR2UWIYdycgMgogjGEorrPZHv3NC9QwAQzv2QvzG3Ch6E30ONf5pHdCsBwB08U2_Lsz-2Bbc7cmv92bINl-2FoHEMWerK7KF0igj6cpG1pIXfPPCAsfjhT1E54iegGRJhFpk03yqPJrfGUss-2FOiQMjzdmqP-2Fjz-2Bk-2BlrDIy1rMDUrmx9AhTGoeVS6BHMuaG4UOqppLMhm-2Fu-2BVzIqf3EtdkpxduxdcZA5ghnkC8PpEk796e0KHr7JJk7bFr0EYxOTnMQI9dv115-2FhI3WFYq25KaqM-2BUCim0IwUYYsFrjY6iXeoIdm-2Fys3PR3-2Fa60lA4zA8YZLUB2FpSMhOzF7IHhuzkph75Pd2ryvOMgetAeoYAb3ExipZZcXMpx5qBocVA673SGNcxLK5amRTjslA6LWekZeCtFeUSqVZRP0a7sXLFzYFOadPUes8v0hJ7Ew9UjICKZmlLZFoLUQjqdhHOXLGIkHyxwVyw8u3WRHL2TMCP-2BmCgwmKF09fMUlvMURbGhZKnFbC-2Fv7yw38xzbJIxNF3RxpDiavebtj0S4vg83U-2BeAyGUuNpXQFkqzE96ti7YcZIJFlNxNPS-2FRDLkd3-2F3uTjKSAoh0HOkNEq0kGFYD-2FkoPFr-2FTvCYNPg7gnCOJLYfG-2BcVJ84DGHM7gXzFdX0G5ElJqvxoPIAo-2BxtNdc8EHmYMMjujGho1POfc1GerN2rE7x7nFUbntxpVPAaO0nPE-2BpvuIx1ftBm9nKQkJM1MRGMCzyiwEz7PTo9JaN-2Bo6tw0Wvgt4ayCcvymuO8F4esgy-2F-2B4n7dVtrVGhuFWyNI11B4IBeNWxs-3D
Sample260804-vf11eadh49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
856	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303362488499288"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1932	3408	chrome.exe	84
PID 3408 wrote to memory of 3932	3408	chrome.exe	85
PID 3408 wrote to memory of 856	3408	chrome.exe	86
PID 3408 wrote to memory of 3932	3408	chrome.exe	85
PID 3408 wrote to memory of 5116	3408	chrome.exe	88
PID 3408 wrote to memory of 5116	3408	chrome.exe	88
PID 3408 wrote to memory of 4560	3408	chrome.exe	89
PID 3408 wrote to memory of 4560	3408	chrome.exe	89
PID 3408 wrote to memory of 3840	3408	chrome.exe	90
PID 3408 wrote to memory of 3840	3408	chrome.exe	90
PID 3408 wrote to memory of 3884	3408	chrome.exe	91
PID 3408 wrote to memory of 3884	3408	chrome.exe	91
PID 3408 wrote to memory of 3176	3408	chrome.exe	92
PID 3408 wrote to memory of 3176	3408	chrome.exe	92
PID 3408 wrote to memory of 2928	3408	chrome.exe	93
PID 3408 wrote to memory of 2928	3408	chrome.exe	93
PID 3408 wrote to memory of 3024	3408	chrome.exe	96
PID 3408 wrote to memory of 4188	3408	chrome.exe	97
PID 3408 wrote to memory of 3752	3408	chrome.exe	98
PID 3408 wrote to memory of 4924	3408	chrome.exe	99
PID 3408 wrote to memory of 4884	3408	chrome.exe	101
PID 3408 wrote to memory of 4884	3408	chrome.exe	101
PID 3408 wrote to memory of 3840	3408	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.rdsv2.net/ls/click?upn=u001.3D48gIrzn98WNdDPiIQSjvGKGdGM-2B-2BI6JXOPX6K60uK8Qg-2BdW4Plul-2FxViqNq-2FEt32MP6WUHoomnSyP49mj3iJ-2BY23XPti3C6oliKyWF2USENETkUKwhXbVw4L2vZRs9jSIuXip6Olu1EzsMKlG0da7poHF5lRx3clytG8Fi-2FbIQvqXm1kKDxJDTRguPva-2FIZLcysJR2UWIYdycgMgogjGEorrPZHv3NC9QwAQzv2QvzG3Ch6E30ONf5pHdCsBwB08U2_Lsz-2Bbc7cmv92bINl-2FoHEMWerK7KF0igj6cpG1pIXfPPCAsfjhT1E54iegGRJhFpk03yqPJrfGUss-2FOiQMjzdmqP-2Fjz-2Bk-2BlrDIy1rMDUrmx9AhTGoeVS6BHMuaG4UOqppLMhm-2Fu-2BVzIqf3EtdkpxduxdcZA5ghnkC8PpEk796e0KHr7JJk7bFr0EYxOTnMQI9dv115-2FhI3WFYq25KaqM-2BUCim0IwUYYsFrjY6iXeoIdm-2Fys3PR3-2Fa60lA4zA8YZLUB2FpSMhOzF7IHhuzkph75Pd2ryvOMgetAeoYAb3ExipZZcXMpx5qBocVA673SGNcxLK5amRTjslA6LWekZeCtFeUSqVZRP0a7sXLFzYFOadPUes8v0hJ7Ew9UjICKZmlLZFoLUQjqdhHOXLGIkHyxwVyw8u3WRHL2TMCP-2BmCgwmKF09fMUlvMURbGhZKnFbC-2Fv7yw38xzbJIxNF3RxpDiavebtj0S4vg83U-2BeAyGUuNpXQFkqzE96ti7YcZIJFlNxNPS-2FRDLkd3-2F3uTjKSAoh0HOkNEq0kGFYD-2FkoPFr-2FTvCYNPg7gnCOJLYfG-2BcVJ84DGHM7gXzFdX0G5ElJqvxoPIAo-2BxtNdc8EHmYMMjujGho1POfc1GerN2rE7x7nFUbntxpVPAaO0nPE-2BpvuIx1ftBm9nKQkJM1MRGMCzyiwEz7PTo9JaN-2Bo6tw0Wvgt4ayCcvymuO8F4esgy-2F-2B4n7dVtrVGhuFWyNI11B4IBeNWxs-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdb80dc728,0x7ffdb80dc734,0x7ffdb80dc740
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,15108188959798359281,3471450947793677093,262144 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,12417142423155650041,431882613359617390,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,14752140685090377076,10136371739595896586,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,5823718567645576830,5353656495497318792,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,8031088606618198427,10245558870621775594,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,11799241868296629968,13179897875730182052,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,2770358383966333294,700499317339064412,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3420,i,1247629399432529818,7223503431500470841,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,5686774192559582330,18259119681671158485,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,3635033713898159991,2362938490248029755,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,7148359828646718205,5967835585834458733,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,17293205238696321582,4399671081431408709,524288 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5268,i,1220749655714222770,2147320497904399502,2097152 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14036611681292983584,12262578933422851151,262144 --field-trial-handle=2152,i,4711339131097717859,17238204004588284471,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8e78db486bf927c2823cd22430db7fa3602f8a9cf1576284fbee61fd6660f3ce
MD5 d0bfebbc5365e1ac11d93c35a7c36b52
SHA1 f838ecde7e2293427d77d238fc140528aca61ff1
SHA512 7b0b700cc250aaad6600d1f8ea1a6fb3b64a3159af1494173596198eb66472367b9a402130c46861dfca3b9ee2f01d5f035a7fd7be525ccb11685c88642d8083
TLSH
T1ECE02BA9CC21AC2749FE471950590786EB51135B2A81599F363D6108CFB0A2A4AC6CBC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 792B
SHA256 c9fcd416b0b8166065c6cea86f888c962831374eff3bc6c62ecba7c34ac8a127
MD5 a69340f80b3fbba3d73e8ba926ad6fa4
SHA1 a0cacd91b7fbe9f969127b34a368f95fca7cccd1
SHA512 7b9836576c7f2849cf1d4bf02b49b3422224854198aa439ecc393b9c86841dedd248ada910ee7efbdd5b0f12f786a790168a24b224b36f21f56c67e7eaaaffdd
TLSH
T1F40146F167823A6CEFD08A7022D80A06B8F56B14156F2FFF95650FB2435FB98418AC40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 3b39e75051180798b2f5bc53c0eac76e4f492c69c0feada99741caf21fd1d76e
MD5 22a75897c24b6c7b3b4429b8e9275ffe
SHA1 0a0c0d3bb18e22290a6b854cc1c002f68d587826
SHA512 af275f987a282f62ac74fd2c6c414696be84ea2668683001ae3a1f197fcf3facc195fc6d4d2d50ef80239fa7bb77c310242627e21466ad9b8b527e92bcce121b
TLSH
T1B801C2E167833AACEFD0897022D8191574F56B14156F2FFB95251F76834FB88118A844
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 039f064688afcdd414b287b1d889af06d1297e47b107c7b34c6609125596fec0
MD5 9c41e11a97b900572537dd2f36710cfa
SHA1 04963e194ff4b7a18432a068f4b826e230ce0524
SHA512 ab9cd2ca9ccbef3f0b444b0319a20ae3a0865cd73e30623ea4240d6ef8b25f89b63e618c4227a04c0afeae6ee4cd8aff45d6b349e286a7b650b47ee1af856764
SSDEEP 192:DAmo1MWgiEakkKe+aaIEd7/xcYptV3wwNtpSTU5Qt1O1a5IGHjpauiGp:DAmo1MWgiEakkKe+aaIEd7/xcYptV3wZ
TLSH
T15C12BDF7C2E8862DCA5252F09A15BE27CE5E0D18832C3D59C4E87F5B53F24B1E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 bead7f8ff5a3b2537c529f4400f6f168f73cdc00443632760a7f4feccb479fa1
MD5 257c0e3d46f419e9295e4f91ec010cdc
SHA1 4e79a33fdbe8c5bce3f86dc2e65b70a6e0e65545
SHA512 0731dc99dfd26dc0747cf106798ee63fc3f71c1a808cf191d2a97f24bf569801036863b0c466ba59e38eecdf50f4d380ada9e92a22db857ab8bea4a73f4f92d8
SSDEEP 192:DAmo1MWgiEakQaaIEd7/xcYptV3wwNtpSTU5Qt1O1a5IGHjdiaQK:DAmo1MWgiEakQaaIEd7/xcYptV3wwNtk
TLSH
T14C02BCF7C2E8862DCA5251F09A15BE27CE5E0D18832C3D59C4E87F5B53F28B1E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ad5d6d93f2fd9abd2adfa5ca7fb38ad8d654b29ed41e248b22e541b1dc37e17a
MD5 30970fbf7ff7d9ace2a18277a691b113
SHA1 6d1f1e7acefde7b2f45ca80ca37a90b58cbd63a6
SHA512 9603cf4366645e1e54e1847a4ef5c8886a68e7be7eb7dbc10bf071eb9804d2f3abe9976e829b48e9f838ddf9ecf195eb211d0c68a63c93b73d4852eacecb45ab
SSDEEP 192:KRO5Y1xXaQv7sp3ylSPRp22KD9wHsb+WNntw/1Le8PfMQYVyIsnAUgvaw:KRO5QIMYFyiX/wKw6JeiSvaw
TLSH
T16A52C82EF914693B6CCBC22AF9627B57DBF5102121D42E94E7FC892C15E79CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d6e721557bee1f5338947a402c6295204025d9e054bafc36cfe2e8140e423e21
MD5 c4b4165c65e7296a7dd6bd39cc1f6a96
SHA1 83c5bced62769d32247557c859b2bcfb680e7b0c
SHA512 423f8ca88867550fdb146b5ce8ca21831a8227296d284897d4fea027bfd841da31a9c5e821f04295e2b94ea45caec1f6ab82d8d5c75242d6ce3390a09ae4b07f
SSDEEP 192:KRO5Y1xXakv7spAPRp22KD9wHsb+WNntw/Q22ePfMQcVyIsnAUge:KRO5QIAYUX/wKw692w2e
TLSH
T10B42D72EFD14693B5CCBC229F9627B67DBF5102121D02E94E6FC892C15D79CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 331979ef85b487f962f73232b8783c608acd5b06b727d9254140667fd15f19ff
MD5 b6d429a9d63b143d4c1a610d88b94627
SHA1 c37b0947aa5f3174dcb5c314da97b588d0ab007f
SHA512 739ee7414e225a068072634a90fb6fee8e4eef7d48a33b06b98e33a3484355c7ded461ec208f7c6340ceadd332c06986da32bb34ef9246d9b6e2703b95270251
SSDEEP 192:KRO5Y1xXajv7spAPRp22KD9wHsb+WNntw/Q229PfMQYVyIsnAUgE:KRO5QIbYUX/wKw692xSE
TLSH
T17442C82EF914693B6DCBC229F9627B57EBF5102121D02E94E6FC892C15D79CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 92bdab75dd4a172425eb5a74c8db29d02348444c2381b0ee7773c6a9141da68a
MD5 bf75240febe6459908c7d637f1c278da
SHA1 d9de5e60939c89c09d4863d6e529ff2173a9b8e0
SHA512 69ca016e8bff51af03d1f114922024853ccc56343581edb81c5d1e987c6021ad3b48d8ee80069ff348ee2d9f3d915697d170ce9eca0f2ad24dbf1b61198ae7bb
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLILc2jCDXODUr+ErU3/mH1cmygnqjmA:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pI
TLSH
T16172F9676C4C8D370F94C6CCD8277F4FADB5025B65E9886483FA982903D5ACB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2ec978034719adf462c55a1e3a7e4ec742973b40f0712e326096a5793b411529
MD5 e70b3c7556762feafe22849382f7dec2
SHA1 2b94c8037e8e9ca5dcf6f2b33d76f5834e7b578e
SHA512 6699a076b370137532c507e59ca9ec497d4db1254332300786a606532f014d26a0826d4e8303bfe64157f3f0f6da69af93ec97bd6bc07a3c3098803698fa8ab9
TLSH
T101B0129084419211C04342B011421498B134AF11960F1702A3E0AF73D8295618414450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4f81330dc36754348917c7db4fc23cec851a7a6d587788a62d9228d3c2e1bc24
MD5 8eb4bd50b0e055a0b4e8027a93c1900b
SHA1 688756fb35dd4dc35fc37311e30f0ba546385836
SHA512 8ffc910593255dafbd7a9b70f64685c7cc3d9d788695563e6271e207b447540379f3e834f097f5762277f673f1a8b79bccedb66afbfa08b77927e63d8aa4bcc3
TLSH
T15CB0128284015301C0C20BB097431888B1645F14D60A170243E06A26C8251618219051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ab4e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ab4e.TMP
Size 96B
SHA256 61bda353d6e00f2339b468116c9172875312380f36308d0740acbe3d17ebd5fc
MD5 a162c57459accd5ec2f0e2fb12fbbad0
SHA1 6801d13c7637d5921ac67c49073efcdb708cfcf9
SHA512 5666815aacad6a06c13dd493bf29e9a4a75e6f14ddc90f392252e19b3a289c61da99a350d845fe63162287365e84321f965dde8e0ab86d64e00f0cee642f3838
TLSH
T162B022A0C202A303CA0203B02080C2C8B020EF30C2030202E2E08B23EC202F02B28330
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7f856b6ed228ffa01ad7247a16ef3f6e0ae8e71c1d415d20f3119d6e3d025c50
MD5 9b2fea3cecb6eb6f2e4a627afdb2cef3
SHA1 7a533743e2615adea65e57bd184f2e2afe685551
SHA512 579c55a48aa82d62c5c1989b76668e67a99dd70dd68428b1ff4d0fd62989b0b30249991a2d9fb4811b16ca356b4187ea407a277ac9f65af823bbf762469b9aba
SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:+m7Rkm1tYpBeh2BAoK
TLSH
T1B1C3023B5D75AC3799B5BB0EB08E0A2F1EF249A3C920DD56C8D85E0423E97CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 947553405e61461542b86a98583342085039ec4eda50f927628eb1f7697df212
MD5 8d28d5c73d163e173940480ec3ff5e38
SHA1 199605c427686c20c3bd9e82ae725943f1b1379e
SHA512 298ce998c22c42dd1ec567f9a288be8b110057d9a1c39c3df5072ae25e9bcd71763f49ce034ea4bc745d3155c8f6032bdcd16a141590957cf4ccfc1b712a7e30
SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:5m7Rkm1tYpBeh2BAoK
TLSH
T1E2C3123B5D65EC775DB5BB5EB08E0A2F1EF149A7C920DE92C8D85E0423E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 54107be54b2adf5a17eaa1f6aab38f43cc548ca49c71f22c49edb7579b256692
MD5 e327f121dc2d2fedd8642ab40430c577
SHA1 6f4db89c11f2c21506275b1b414dbc9b8fc8b8f9
SHA512 992531167f2feedc566fe960676e8db2ad1a36470114eebda19ab46cf09f1f45fd0da3816be988102a3c30b87ccec080b58bbcfdeed10bcb5f582a2182fad26f
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Rm7Rkm1tYpBeh2BAoK
TLSH
T108C3123B5D75E97B9979A70EB08E0B1F1EF149A2C920DE92C8D86A0437F97CD0A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcd11f22-70fa-4b51-932e-5caaa02c1e3f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bcd11f22-70fa-4b51-932e-5caaa02c1e3f.tmp
Size 116KB
SHA256 353901d6cbf7f47a1a96286e5c80fd98b139a33d381e63983d0891537f6a8ef8
MD5 2a6f0368bc97319a4e5c49b003ef20cd
SHA1 68645f5eaba2c05c425ad1ad6d48c44d6b780d3e
SHA512 00b52d23d764b1a678c4f196c0671cb51cea1e3a76aefff114adb91b680d48eacd62338d31b6f0a8501af1a4e5dc256c7dfcc2f9e043a36b644af44251d81e14
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:gm7Rkm1tYpBeh2BAoK
TLSH
T1B1C3123B5D65EC775DB5BB5EB08E0A2F1EF149A7C920DE92C8D85E0423E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download