hxxps://images[.]google[.]com[.]bd/url?q=https%3A%2F%2Fdaseindia[.]com%2Fwp-content%2F4HC5UUpLIxsy0Z%2FrzlQ[.]php&sa=D&sntz=1&usg=AOvVaw0zWS9HM2uZr9j1X2GLdKN7#GJ1IS60VFamily=jpermantier@twininginc[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://images.google.com.bd/url?q=https%3A%2F%2Fdaseindia.com%2Fwp-content%2F4HC5UUpLIxsy0Z%2FrzlQ.php&sa=D&sntz=1&usg=AOvVaw0zWS9HM2uZr9j1X2GLdKN7#[email protected]
Sample260805-a92htagq8s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2080	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303649655115878"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4908	4312	chrome.exe	86
PID 4312 wrote to memory of 4388	4312	chrome.exe	87
PID 4312 wrote to memory of 4388	4312	chrome.exe	87
PID 4312 wrote to memory of 2080	4312	chrome.exe	88
PID 4312 wrote to memory of 3688	4312	chrome.exe	89
PID 4312 wrote to memory of 3688	4312	chrome.exe	89
PID 4312 wrote to memory of 1788	4312	chrome.exe	90
PID 4312 wrote to memory of 1788	4312	chrome.exe	90
PID 4312 wrote to memory of 1800	4312	chrome.exe	91
PID 4312 wrote to memory of 1800	4312	chrome.exe	91
PID 4312 wrote to memory of 228	4312	chrome.exe	93
PID 4312 wrote to memory of 228	4312	chrome.exe	93
PID 4312 wrote to memory of 3460	4312	chrome.exe	103
PID 4312 wrote to memory of 3460	4312	chrome.exe	103
PID 4312 wrote to memory of 1760	4312	chrome.exe	104
PID 4312 wrote to memory of 1760	4312	chrome.exe	104
PID 4312 wrote to memory of 2336	4312	chrome.exe	105
PID 4312 wrote to memory of 2336	4312	chrome.exe	105
PID 4312 wrote to memory of 3768	4312	chrome.exe	107
PID 4312 wrote to memory of 4296	4312	chrome.exe	111
PID 4312 wrote to memory of 4496	4312	chrome.exe	112
PID 4312 wrote to memory of 220	4312	chrome.exe	113
PID 4312 wrote to memory of 864	4312	chrome.exe	114
PID 4312 wrote to memory of 864	4312	chrome.exe	114
PID 4312 wrote to memory of 4964	4312	chrome.exe	115
PID 4312 wrote to memory of 4964	4312	chrome.exe	115
PID 4312 wrote to memory of 3772	4312	chrome.exe	116
PID 4312 wrote to memory of 3772	4312	chrome.exe	116
PID 4312 wrote to memory of 4736	4312	chrome.exe	117
PID 4312 wrote to memory of 4736	4312	chrome.exe	117
PID 4312 wrote to memory of 4648	4312	chrome.exe	118
PID 4312 wrote to memory of 4648	4312	chrome.exe	118
PID 4312 wrote to memory of 1520	4312	chrome.exe	119
PID 4312 wrote to memory of 1520	4312	chrome.exe	119
PID 4312 wrote to memory of 4132	4312	chrome.exe	121
PID 4312 wrote to memory of 4132	4312	chrome.exe	121
PID 4312 wrote to memory of 4644	4312	chrome.exe	122
PID 4312 wrote to memory of 4644	4312	chrome.exe	122
PID 4312 wrote to memory of 3552	4312	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://images.google.com.bd/url?q=https%3A%2F%2Fdaseindia.com%2Fwp-content%2F4HC5UUpLIxsy0Z%2FrzlQ.php&sa=D&sntz=1&usg=AOvVaw0zWS9HM2uZr9j1X2GLdKN7#[email protected]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff878c728,0x7ffff878c734,0x7ffff878c740
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,7681058119082537750,9497778957636669043,262144 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,6316368287370099546,13574492536912329637,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,8373292877109812582,15277327876978448818,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,8472689548583538395,14292984124769644923,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,10154544468553485961,2624592499015440588,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,11992871609856195559,318232036322592942,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3904,i,476777426832955991,16839030380157792087,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3504,i,8863136316554546748,509601267976623320,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5112,i,10036856597402044228,10708157652366026078,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,3842329415464801524,5711462793383288944,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,8883510553573592354,15444240381718503591,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,6878933960906815645,418485939527638973,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,7018854599141402853,14620601084018818416,524288 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3244,i,12376685105330437657,12671089781149461523,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5096,i,9529276382918520774,6193019665946787093,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4528,i,8641341457879241196,11380684352921119859,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3424,i,17012364102385223100,12398622777684247052,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3244,i,7261421674609909265,5286705117601831654,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5080,i,14390243708544691639,2942010383256766430,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3928,i,6387965852605545300,9026120553417386484,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4932,i,9990007174468290028,11007306884303548679,2097152 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4444,i,794502177054243606,7522946804007101243,262144 --field-trial-handle=1884,i,13359636598518301535,1422807627714223105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

617fba92-96d7-495b-9955-03634feca623.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\617fba92-96d7-495b-9955-03634feca623.tmp
Size 414B
SHA256 e3e3af1e65e34c96971039bd2575cfbedfd8c4bfc3c32d1c6007f0b22d0aa28c
MD5 b967b32b2b98b0a3ef53433ddcb54e5e
SHA1 495239cb49dce00f84eb7651626cd0f94ea1b778
SHA512 98afc3900a097fa5e7870962d8bc982474782a63890bc70a837052c704f2ee670fa9c1c2a1c25e313e7e018c5abe3709221aacb29b4c99dacdc9e7199e74cca2
TLSH
T1A0E02BBACD61EC2B28FE07286051C749F654535B26404A9B763C950D8FF0A3F5646C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d4b2ae4d96e6eb33e1b64bfc53b84733acea164e8e24bbc9ceb760da204450e5
MD5 3e8c984744491d09affbee01e5dd47df
SHA1 b1c1f44f899ea6d761329e42d05aa6db9ee8f843
SHA512 40172e483f106b05c298bda720f99c74d0dbab4502d524a90133cd1d07fe382b28df593f414042814c8585f106dddb3c43099d45e742408233f93e9ac06e0592
TLSH
T1F5519DF7D3E48A7E891156F4EB156F1FCE290528031C3C66C9D4AE1B93E2972E104A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ef1c05c66912d9fee74f1465399c48f881c66336cb2096ddf3664f0fbb6b7636
MD5 2c9d145955d2c8d12f7b9047fd17af80
SHA1 bb1e426650a49a79d9759a265828fb70f5c9c8ab
SHA512 247bd8de3b4a0c7f9fa5ed592571f971783ba4ab0260d02b91da240a55bf90daceec1161cc011206716c7201da6bde32e02c126aba1d4cb31d445b03c3d94a34
TLSH
T19931ACF793E4957E891156F4EB15AF1FCE690524031C3C66C9D4AE2B83E2872D104B9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d5fe8ed78b72a5be7038f6b0d07699a16e71496d0dc551da01dc25267c5c86dc
MD5 2c64c1de1209a8a80317054070baeec8
SHA1 24ca889ac89c0959f3e1588997b0ac4d749fb7f4
SHA512 d66c0688f0f41f4b29979786f756190005d185fa894816c94ebaf2d44e986a822bf8b88effe2755f5d1a2e156ae5abfa056f0c0205949acc183ec5650d3c0421
SSDEEP 192:6RWoHp4gv72vAPRp2TD9THsb+WNnDtca/02Lk2mJ7D2VyIsnAUge:6RWoa8C6XUFwG12o2mMe
TLSH
T1ED42962EAD20297BACDBD229F9617727E7F6103225D42F84E6FC892C15E75CC212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 17e75826297dc7eb71c4cc68231215191f043da2a4d2744ab82b20e79076b8d6
MD5 8bba1db70eae7552489b68f96451dedf
SHA1 bcf18603985ef8d1c66b04a7d0aebfe5eb1e46c2
SHA512 82104f72829034070bc1173bad9d2695804e1cf777e60e8119ffed0f7b50302858cab98449843bdb4b35e589c0833a7152170772739c4e263d944267e7026bc1
SSDEEP 192:6RWoHp4bv72v0PRpGatD9THsb+WNnDtca/022k2mJ7W2VyIsnAUgE:6RWoajCuXBFwG12z2mdE
TLSH
T18542A51BA910297BACDBD229F9617B27E7F6203225942F84E6FC892C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f570f6b16c316b099258ac442b18f625c87595e945bde74760b26b9789c794f2
MD5 3a41c49d0ac6cda29a9557fab4aacf0a
SHA1 536f3f8c700de5e85362053e146e52f6522a818e
SHA512 eab7bcb4980f808fe9d5aebd5921f453d8dad229aba2ac628bd38bb9e1a26fa6a8aa72d48d4d102f280f3476c89355e419b3e60fcef4fa2004c8635cc95c6888
SSDEEP 192:6RWoHpKbv72v0PRpGawD9THsb+WNnDtca/022k2mJ7W2VyIsnAUgE:6RWoIjCuXuFwG12z2mdE
TLSH
T11A42A65EA910297BACDBD229F9617B27E7F6203225942F84E6FC892C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c5cd3e3a12a105d125234f7ac0d3f150d146c32c605e5e6c20c64b6bdde0e4a4
MD5 545ce7fe7c8a6d0f12a4c9cfafb8e84d
SHA1 797ca0e2c25f65d66821257480efc370f40a876d
SHA512 7152712601bcaa4901d7d427b3793834d5657c60a544d1578df8feac8c93270279150dac9ee10c9e9b18dc117e88b6b646b668b7b210ba4fb052bc7cd2a13a71
SSDEEP 192:6RWoHp4rv72vAPRp2atD9THsb+WNnDtca/02Hk2mJ7C2VyIsnAUgE:6RWoaTC6XpFwG12E2mZE
TLSH
T10B42966EA910297BACDBD229F9617727E7F6203225D42F84E6FC892C15E75CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3434e5972e8c56e392552855d3a08e2530d148f66e72b286729a92008ac50b65
MD5 35eabb9c3b955dbf2ab52d9b41ec3e35
SHA1 24ea3f2bbad42016f8de8390a582d4e569cf23bf
SHA512 9c37ecc235960ab6ce6ae93de7084babafb970992b3195993555b20e8c831cbdafcef32c2702fdaea49f9110e568c65345b87f55fbbec44092d1257139776c4b
SSDEEP 3072:qVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:q8m7Rkm1tYpBeh2BAom
TLSH
T11BC3123B5D74E9365DB9B71EB08E0B1F1EF14AA6C920DE52C8D85A0433FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 290725404ef53e385e9d9c85978366f26bcdf69d07a73d0881c81ef910497140
MD5 9f8951d44bde540322516841fb24712d
SHA1 7f366551e447bf7f07b4b21cb4386097b5aa6ea2
SHA512 6d1cd7d916d968d6f5b5e7749b80cb59cf84dd6780e2c2d1ed20c1aa6ba08980f56e2e74304521ec3677095493207ac06544089466a08258c1d7b2ee160190a6
SSDEEP 3072:hfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:sm7Rkm1tYpBeh2BAom
TLSH
T1DCC3023B5D75A83759B9BB0EB08E0B1F1EF24AA7C920DA51C8D85E0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41a6d25433b3457ecb71bf0d1adfa816a37a02a8b12bdc2e073a4ac3fecf0c45
MD5 8caa1a044e1c4fbd7acdd3100cf4d451
SHA1 7d9d73787dbe390f67a39cfd38913543163abd13
SHA512 3658703d6f4d805af2460f6cb6d6cfa43f1aca1430741012d1c003d8bcbecaf1e64c633f2c5bbdb0048799820ae5c1e3c86167cdf0d009df079392630f0a02b4
SSDEEP 3072:lVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:l8m7Rkm1tYpBeh2BAom
TLSH
T169C3123B5D74E8365DB9BB1EB08E0A1F1EF14AA6C820DE52C8D85A0433FA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8aad52bfc3c260e61cd474a770ae6da885ba82d39ee8549ed1216d0e57c2fbac
MD5 5a636534c4e7a0592a41e7f7384a61f2
SHA1 09e54d2eb88d67eec3a5ecb521c7a53a9b8a512c
SHA512 250d1743eb5c680a34c719ea2bfcada4aa935c15ffa75c98574578adf6725d796b9c020f5953bab1463590d36919730d541c5ce90791015c224a130d349293dd
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Vm7Rkm1tYpBeh2BAom
TLSH
T169C3123B5E70E9775979AB4EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download