c6aae68265c821f68e0a45e179f987ec4717a1153a59d84f0a01be06bbd889ab

Resubmissions

08/08/2026, 08:59

260808-kx9nrstdmh3

08/08/2026, 07:39

260808-jgzyysbp2s3

Analysis

user interaction
yes
max time kernel
161s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 34KB
Sample260808-jgzyysbp2s
SHA256 c6aae68265c821f68e0a45e179f987ec4717a1153a59d84f0a01be06bbd889ab
MD5 64380e132ece1438b365047c7a522a17
SHA1 7042e836d8002ff4f666c3f890baa6430d846a42
SHA512 c3ff52c67070aaf5af219af72a3f9e169df8a79e2e7a9a2b19dd94907756fa1c781084cc1b4df2dbc3de2474b90c6563606acf8a2bd505ca39b142818cbcf82a
SSDEEP 768:mP6X64Duwc6pTCf1PbS/MrHpavsAEqwjrGZgM:dX6auw5hCf1PbJr8EqwnGZgM
TLSH
T1E4F20112E7551D56C0FD84F1E0272B689094A39A53161BF0F2EA7F7779C68B22AD338C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306483815863135"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
568	chrome.exe
568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3820	1104	chrome.exe	84
PID 1104 wrote to memory of 2888	1104	chrome.exe	86
PID 1104 wrote to memory of 2620	1104	chrome.exe	85
PID 1104 wrote to memory of 2620	1104	chrome.exe	85
PID 1104 wrote to memory of 4912	1104	chrome.exe	87
PID 1104 wrote to memory of 4912	1104	chrome.exe	87
PID 1104 wrote to memory of 4216	1104	chrome.exe	89
PID 1104 wrote to memory of 4216	1104	chrome.exe	89
PID 1104 wrote to memory of 4632	1104	chrome.exe	90
PID 1104 wrote to memory of 4632	1104	chrome.exe	90
PID 1104 wrote to memory of 5112	1104	chrome.exe	91
PID 1104 wrote to memory of 5112	1104	chrome.exe	91
PID 1104 wrote to memory of 3208	1104	chrome.exe	93
PID 1104 wrote to memory of 4848	1104	chrome.exe	107
PID 1104 wrote to memory of 2228	1104	chrome.exe	108
PID 1104 wrote to memory of 668	1104	chrome.exe	109
PID 1104 wrote to memory of 568	1104	chrome.exe	112
PID 1104 wrote to memory of 4976	1104	chrome.exe	115
PID 1104 wrote to memory of 4976	1104	chrome.exe	115
PID 1104 wrote to memory of 4896	1104	chrome.exe	116
PID 1104 wrote to memory of 4896	1104	chrome.exe	116
PID 1104 wrote to memory of 4556	1104	chrome.exe	117
PID 1104 wrote to memory of 4556	1104	chrome.exe	117
PID 1104 wrote to memory of 4080	1104	chrome.exe	118
PID 1104 wrote to memory of 4080	1104	chrome.exe	118
PID 1104 wrote to memory of 664	1104	chrome.exe	119
PID 1104 wrote to memory of 664	1104	chrome.exe	119
PID 1104 wrote to memory of 2352	1104	chrome.exe	120
PID 1104 wrote to memory of 2352	1104	chrome.exe	120
PID 1104 wrote to memory of 640	1104	chrome.exe	121
PID 1104 wrote to memory of 640	1104	chrome.exe	121
PID 1104 wrote to memory of 1240	1104	chrome.exe	122
PID 1104 wrote to memory of 1240	1104	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffc388ac728,0x7ffc388ac734,0x7ffc388ac740
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,4694961690650069337,10603160394216430067,262144 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,8946681094472637262,8191969647337643247,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,8188204813891806626,9339929354959371576,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,14337406836439526136,5072261151974270160,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,5911888913196456228,9867747886598406683,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,7431197704878668330,14197472594490174032,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,14531015955597917161,12134149314660919110,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,2672011859664268936,10933673885034013467,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,14788696903494926005,5567498663162944508,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,8993878151361554067,1239117542018701006,524288 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4528,i,12999707896024881838,17522853982751473801,262144 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4524,i,2507285533979505198,9840917947335864930,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5540,i,17796326432628822891,1194513928542597968,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4516,i,13849324815397774065,9542563080109427114,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3240,i,3192861235659103912,391950264191838703,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5784,i,17866351341394301660,7006824204502008400,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5872,i,1778615475071727279,4509040488944429337,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4480,i,12838909220566955862,8220381292281393760,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4440,i,2250867961464827250,18172882474040774715,2097152 --field-trial-handle=2032,i,13891321728760414811,10730463093421290473,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a2b4a611965efcc0c902e61531e9afddc50588eca1e76b0dfa87b98eb540075c
MD5 c01f4fee8c1753485f5c38e8156fecbe
SHA1 2d191cd8edf1d409d3b36ffe8b28c80c1544c246
SHA512 79f70b627553259a0ab5d447dbb395d4fda7099139589b733f46b904af13404fdc276bc641f45d687fab2578ea64165376741526c85f66588471f704b9d262f0
TLSH
T1A7E02B66C962AC3B19FD1728A5A58749EB41131726409D4F373D510C8FB477A828AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c2009199874f67f68d38f7167295633078f5affa1cd0dde821a43ef33a92f8a9
MD5 2288d2bfd622bc7531cc60424d665fdd
SHA1 37bbde32d8c4de1dcd30fb5299524c678704fab9
SHA512 1e6476adde24289f6b6e58a5015ed2bd720f28cddd54b80bfdcc2cd314090efc96b91b446033701c387a344ad6fedbc7464f5c5669510a3dcae0630a4e50f4ca
TLSH
T1CD417FF783E4857D8A1196F4AB156E1FCE6A0514032D3CA688E46E1B53F2972D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a8430d4889c470fa13a4491a49bb62c62dc470aff160d4b47a95dc16c9405e82
MD5 86a8a08dc7d6380fbabd94293f22c56a
SHA1 3324440e1e9ebd578a96aeaa43898bb255fa3391
SHA512 9c90c8cacd0b3e3fcc61a6eb14f96687b0b79aa520ed67023f714aaa4b1ff54123e643bfeff50f7d91551a1673d183d84a6cf8760b6303ad456698d997d3b274
SSDEEP 192:FRDZrotc6v7MF+pAPRp2o09HHsb+WNnlBPLieQZVyIsnAUge:FRDZZWgoUXu1wrPs/e
TLSH
T18A42D66EAE1169BB6CDBD229FD227B53E7F5103121D51E84EAFC892C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 66cb9a146c7057fbf906142c0706b39639c5ba89193e42fa389a7ade7ccf5a4b
MD5 b8187e468395e084ebe8d30896a863d6
SHA1 92d092c6d58643ffb881c7745d65bd0de13ce3eb
SHA512 cc18817266b093a080f358621888a808b5b1e56623c7ecae522edb7f86082f222360fbbd9d6c740404de5c1f7b1e356789d4a4fe3b140e76d7bc57301c227452
SSDEEP 192:FRDZSotc6v7MF+pAPRp2o09HHsb+WNnlBPAieQWVyIsnAUgE:FRDZcWgoUXu1wrPZuE
TLSH
T1A342D66EAD1169BB6CDBD229FD227B53E7F5103121D51E40EAFC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aa3299fbea3ef4575b492ddce3e3f537fd8ac9047a9bd68f97cae2fac4624aed
MD5 e45f9429b0533cfe02112aa2f935fc5c
SHA1 c2f7523c07893236c4b14f16499f7697d795b1c9
SHA512 09e85a7649e197417c0ec90d65fe6ff70810ea480592d469b5b107632d99977e8ac38202ce3d42b68c45b21d28b4f822c4b2e2ab629465094b4a56328a4857a6
SSDEEP 192:FRDZSotc6v7MF+p1PRp1ox1z9HHsb+WNnlBPSieQ6VyIsnAUgE:FRDZcWgojXm1wrPL6E
TLSH
T1A552D56AAD1169BB6DDBD629FD227B93E3F5103121D11E44EAFC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3150587a8bd54707a79f160da5dce3698b4951f2d1f1b674655d1ae3e5e6152b
MD5 b893578ce1c596aa05949af685b6aefd
SHA1 23059f80eb85a02c765d4fdd525606e6c97415e1
SHA512 b9e5849b5fb16243ea620ced34cba8b5a792471d478c4d72c1aa01b019e5f0e55d8fcba6a5b72076bd643816ff68cf1930d87d7f12b5f1feeae5acf3eb7b173e
TLSH
T18CB0124084019101C00702F4118224C871549F24D64A170383E46A7288255618028050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585251.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585251.TMP
Size 96B
SHA256 dff2acaa5a5ea826aa4bc9e0571d5b7093701261d76c7a7ef327bded0d9751bd
MD5 989c9a3f6d1328684fd72ed2531039c2
SHA1 93db1bb176dc9adc9f69806cc6b98e69bd39bb3e
SHA512 2209daebb012b97d9da2aa4451748330e24da1382dabc46fcad144563cb43c32fd2f28adab0542e47ba5b049808dcbd141b8d2e84666ea25761f984d4672ffdf
TLSH
T17CB02200C2022202C00203B03BE082C83230CF20E2232302A2E00AB2FC20220023A820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9259263070eab896ec0b1d10f970fadf27775c98a4c9793ca7bc70b2be06e143
MD5 d1e2055c1b74b4e0748b91c1b3a1f8d4
SHA1 674ab026c97764eb1924215ed991787170c98503
SHA512 cc0fc7dae9f2a241e7f33019848ca526440727b5f0ae65d10ab2109c3315480d98eb4d5fe78f6e23cf5c44f791d545bc5e325fb9a0f8eb8f30dd0f2e6d7b7cf3
SSDEEP 3072:SvGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:S+m7Rkm1tYpBeh2BAoM
TLSH
T15DC312375D74A83759B9BB1EB08E0B1F1EF14AA7D820DE92C8D85A0433F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 760316634129c5a319a07279be47620a5952abe935b1ffc26e5fd987d05dbfd6
MD5 1b977cf8a6ca087daf08648f96acf06c
SHA1 493a1fb7a06f0f8a95b6ea521ba9cac2fcd6ff04
SHA512 7a5718e6f9a0480b86f92772adb488315422f7ab4a05cb203ac20f1e8aaa6dc65a3b2a2304517cbe6382a30f881938ea48f431181ddcea46bfc194400fbbcbf1
SSDEEP 3072:SYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:STm7Rkm1tYpBeh2BAoM
TLSH
T1E1C312375D74A83759B9BB1EB08E0B1F1EF14AA7D820DE92C8D85A0433FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 de86b8879b6e69705abcf9dd879b65a084de9e0d6e6f1a27d24a972a33230a68
MD5 c084da615b31ee0b406a52d4bbc04f32
SHA1 53a496208340605947b049d4c01157db1828991a
SHA512 e0e5f91af3fa429082f44bfc77604ee36f27ab93633ace3f53a0f468e8c88850b3b035b90f43d9e18a410d4c844ada5eb3d5c0ee0450baa0cc3f8009c08fa89e
SSDEEP 3072:/mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Rm7Rkm1tYpBeh2BAoM
TLSH
T131C312275E75E8375879BB4EB08E0B1F1EF14AA6D830DE92C8D86A0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d6760b493578524b33ca95f36550a250617d3abcb660d00a62802a094e0ae4c6
MD5 9f37f50ffb999c5b2ba4a482ae273f53
SHA1 b88946453f8690c5c20b97a8b7213796026b1617
SHA512 93484836e98bdf65121b1495319a25875e42e23713638e8376a504c6b34d58f5bdc174c577b68a96e7936e3e3d43a1a1f6f47ecfdc45c28b97075beca4c74cb4
SSDEEP 3072:XTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Xqm7Rkm1tYpBeh2BAoM
TLSH
T11BC312275D75EC3759B9BB5EB04E0B1F0EF14AA6C820DE92C8D85B0427FA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f1a90081fc0af7cec40875348c69db24a4e3a11b303325df6612b5d83f9c2212
MD5 d3f7e92a3c8f1fb029935e1963d91aff
SHA1 ac4790760a6f7f492f3e1b053616404359ad9044
SHA512 4e39248d73bb35fcd7441a9666f26eb61ac24d2ef881086a14e856367fd036cf70aa5a13c44ec6f9a7390f47f00ddcec5160a47ee896928ab1037b4226c59f60
SSDEEP 3072:STGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Sqm7Rkm1tYpBeh2BAoM
TLSH
T1DEC312275D75EC3759B9BB5EB04E0B1F1EF14AA6C820DE92C8D85B0427FA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download