hxxp://PORNHUB[.]com | Triage™

Analysis

user interaction
yes
max time kernel
9s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://PORNHUB.com
Sample260807-dp2jvswfka

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
3288	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305459555586888"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4120	1676	chrome.exe	81
PID 1676 wrote to memory of 3288	1676	chrome.exe	82
PID 1676 wrote to memory of 3480	1676	chrome.exe	83
PID 1676 wrote to memory of 3480	1676	chrome.exe	83
PID 1676 wrote to memory of 912	1676	chrome.exe	84
PID 1676 wrote to memory of 912	1676	chrome.exe	84
PID 1676 wrote to memory of 3456	1676	chrome.exe	87
PID 1676 wrote to memory of 3456	1676	chrome.exe	87
PID 1676 wrote to memory of 3308	1676	chrome.exe	86
PID 1676 wrote to memory of 3308	1676	chrome.exe	86
PID 1676 wrote to memory of 2612	1676	chrome.exe	88
PID 1676 wrote to memory of 2612	1676	chrome.exe	88
PID 1676 wrote to memory of 840	1676	chrome.exe	90
PID 1676 wrote to memory of 840	1676	chrome.exe	90
PID 1676 wrote to memory of 4852	1676	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://PORNHUB.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7bd2c728,0x7ffb7bd2c734,0x7ffb7bd2c740
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,862081864188528255,3462001478930302097,524288 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,18017747374340827769,3014307594497426858,262144 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,11099781989002800287,14447873240108180498,524288 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2660 /prefetch:13
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,13732066269696069552,4445144724845022761,2097152 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,417829879766517463,5933527615646742732,2097152 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,2132017592255625377,17995783404076788862,2097152 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,12046897965319043432,9498532594394958254,2097152 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,2367205655753083729,9381133858596062337,524288 --field-trial-handle=2056,i,14022614552165476503,2861165085858665357,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 67da889c74b87ed8d9de1317c17f7beb91cc53911a74c940adf48f902c36ecee
MD5 950a5f59285be1ca3f1fd92ac3d1a616
SHA1 d1251881b8d84596169bc934f634d4bba84f4448
SHA512 276896db9b4fef90d4432b328ef76df548578f201b121b772dad001fe922636a4a1ec2096fa69827e782d2326cd213e62a97d459b902549e87dd8c58ad3de6e1
TLSH
T10EE02BE6C831EC370CFE0718A0544A49E715135B2A81864F3A3CA1098FB07360296D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 63KB
SHA256 d2a193529a04efcbd3a4a99ca4c0febccf9f723bb4fc59d6f07011a32a8e020a
MD5 92367cdff70963eac581c0e4e5dc9efc
SHA1 08a055f1d18f56fc0f9177987332ec8bcc409cea
SHA512 f5b5c838abf4162502cea5ad28aea0e53c95444edea76e26ee0fd4611ade3242e11261db5a31945f289fb9d7d3f91d0cbb76adc7bfd9365ca2cd1ee3330f7507
SSDEEP 1536:jcuVTygxO6NxaVL8CPOUhGSFV2W3nnQHFHYozL:jcug+NYVLrPphxv3yHYov
TLSH
T1905302DB21D5863AEF9D06B627FF9370D482D93765632045D18C67049CB1FF3AAE2102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 40KB
SHA256 1abf97d772f62540bb68649d0e9d9abe8d2efad5d24cd5e7052565e62e997dcf
MD5 99df7db602593b3c9efc0ba5db3145f4
SHA1 7180edada21fd8c876c81b8c1112384c7f12d725
SHA512 e43a970cdd93469dfc175ba97ce6c52c91ce0b441b191cab2d2a4c8c59125057906403ddf28c04357969d7370de6c3dc5a763983b1474e6b94a18b9e4f9277af
SSDEEP 768:sKRvEFKM612uHzSwmBWTTTdx30ihjIe7Jo4OViMuoFg1LPw9PN07eTvfhtrT:fRvrMqrmBCT7hjI6J2irrPW5vfH
TLSH
T14113F1C0A5A66617D759B0B55682C3CF3209FAE5E0B25613E8F3352CAED48C7AD214CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 57KB
SHA256 7d03a572d46db73e66ac51ae3714adf8281c64a03778cf1461bb37f0999be29a
MD5 026c4cec7e0d03adbe47646966774e5c
SHA1 41f52bcda6280f87d935b8a5abf044b595536aec
SHA512 15052a1157405240199f5be02f21180532c19c7de56de36e01e3d9708019f75cc5b6a45aa69ea3383684a13ad320b40a7a92c84b6b561e9e4d3228cf8c27b278
SSDEEP 1536:5klpFp1Z2YSrUHKi1PimiOWRiX+ZnlwdOX63s7hM5y:oFp1Z236P1WRiXknGoosNR
TLSH
T18F430171426B6651C96E36745D4DE2B4AE31103A53B3821D7F08BB3666D2E30012CEBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4f02d8ef350f2ddb3e0fb98cfc85294d9cde72a2372cbe224fa1fbb0d76f4fd2
MD5 6934f53fa9cabcda1fcefb968f5b032f
SHA1 e0adcd8f0b5afdb960d912094fb22c8a44562daa
SHA512 79e2447cf695730522f1058d6615e5b8fb067a497697ceb85597c6da71aaf8f02b3ffe654f0a5d6f08ec517e1292c99b1a897c96beacd6ffd88d857e567bfcf6
SSDEEP 3072:uzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:MWDfxA3OnjrYQ9EU0/hEV
TLSH
T101C302A11C36BD660DF8EE98B44D3A60BFF4AC9A91835DC362ED2F0C14FA5C81179970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download