hxxps://8b784d54[.]click[.]kit-mail3[.]com/zlu76o0d5oinhkm9omraphw2wzg4wu6hlw78w/7qh7h8h9rn4l5gizh6/aHR0cHM6Ly9wb29kbGVzLmNvb2xwcm9qZWN0LnNob3Av

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://8b784d54.click.kit-mail3.com/zlu76o0d5oinhkm9omraphw2wzg4wu6hlw78w/7qh7h8h9rn4l5gizh6/aHR0cHM6Ly9wb29kbGVzLmNvb2xwcm9qZWN0LnNob3Av
Sample260813-2s8pcazsc1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311351201730566"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3612	2608	chrome.exe	85
PID 2608 wrote to memory of 1352	2608	chrome.exe	86
PID 2608 wrote to memory of 1352	2608	chrome.exe	86
PID 2608 wrote to memory of 3448	2608	chrome.exe	87
PID 2608 wrote to memory of 4356	2608	chrome.exe	88
PID 2608 wrote to memory of 4356	2608	chrome.exe	88
PID 2608 wrote to memory of 968	2608	chrome.exe	90
PID 2608 wrote to memory of 968	2608	chrome.exe	90
PID 2608 wrote to memory of 980	2608	chrome.exe	91
PID 2608 wrote to memory of 980	2608	chrome.exe	91
PID 2608 wrote to memory of 3640	2608	chrome.exe	92
PID 2608 wrote to memory of 3640	2608	chrome.exe	92
PID 2608 wrote to memory of 4940	2608	chrome.exe	93
PID 2608 wrote to memory of 4600	2608	chrome.exe	96
PID 2608 wrote to memory of 4600	2608	chrome.exe	96
PID 2608 wrote to memory of 5032	2608	chrome.exe	97
PID 2608 wrote to memory of 5032	2608	chrome.exe	97
PID 2608 wrote to memory of 4392	2608	chrome.exe	100
PID 2608 wrote to memory of 360	2608	chrome.exe	101
PID 2608 wrote to memory of 3656	2608	chrome.exe	102
PID 2608 wrote to memory of 2132	2608	chrome.exe	110
PID 2608 wrote to memory of 2132	2608	chrome.exe	110
PID 2608 wrote to memory of 2088	2608	chrome.exe	112
PID 2608 wrote to memory of 2088	2608	chrome.exe	112
PID 2608 wrote to memory of 2204	2608	chrome.exe	113
PID 2608 wrote to memory of 2204	2608	chrome.exe	113
PID 2608 wrote to memory of 4340	2608	chrome.exe	114
PID 2608 wrote to memory of 4340	2608	chrome.exe	114
PID 2608 wrote to memory of 4704	2608	chrome.exe	116
PID 2608 wrote to memory of 2400	2608	chrome.exe	118
PID 2608 wrote to memory of 2400	2608	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://8b784d54.click.kit-mail3.com/zlu76o0d5oinhkm9omraphw2wzg4wu6hlw78w/7qh7h8h9rn4l5gizh6/aHR0cHM6Ly9wb29kbGVzLmNvb2xwcm9qZWN0LnNob3Av
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb980fc728,0x7ffb980fc734,0x7ffb980fc740
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,2667392432378029221,16841474881986859509,262144 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,4977442843622357727,3984124549837654561,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12450114802898894492,8005541298514112761,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,3619069852517688871,15749838046742218886,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,12270064109359677911,7116643448592887656,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,8239597408586048087,12988392006555111784,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,5931289310754750056,10958082265329684388,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5476,i,8098643109577731305,8133725651249983958,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3288,i,14937455800021744049,6980992947357569046,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,12770938535648718772,11953420668698870601,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,13652433399328539789,15878962352526807569,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,1475544674014634277,1772664748731436452,524288 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5756,i,6546250709373727589,5828197726692181848,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5652,i,17575811396582071556,4273581558405245204,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5620,i,8204238758392896446,1369843371709997801,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5260,i,17821560698723598431,4028079272379063381,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,13648239600493142136,18052685979670624697,262144 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5372,i,3990714646037157729,14428213624012266589,2097152 --field-trial-handle=2012,i,7650337016470995706,3440235926887183662,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b8cc531f5c9773ed684505509493dc2eccfaba097bad9cf6be57f133150397fe
MD5 4b0776ed7903b1f91456d1670168d0ee
SHA1 ce394d34840be0bd2a46b0ce4d2a4d42256db42f
SHA512 346bb6e181018aee01ad34157763ee4b0758fc4865846ef04429e03323a4d79ff2e79e1c7e5ea6dea6fbaff7b00f6d3328e532276c62fbc44377cbf025782da4
TLSH
T1FCE02BA5C962BC3728F927586465474AE741135B6641984F3B3D400C4FB477A428685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea94ef959eb3f967181b7e44e9f0a8bd33c98b6661d4c421d3cec64482706be0
MD5 e5967449830ed3e7cc2bf222c1323bb1
SHA1 fb88366256195d3e21fc456cc17cf1d4778c4d88
SHA512 291ede88806116c9c94d8cee84de410d736e769ff49577fedf95692b4e0a7187ac59350aea6abea538261703e2a6aff7269e6e4564b5e5b93962b9e99fb9b579
TLSH
T1E84179F793B4957E8A1196E4AB15AE1FCE6D0525032C3CA689D46E1B83F2872E10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 16dfc2695c5582374e6eeb24925026ba01fa8ed47ee2da0f6dd2bb289184478f
MD5 e16eb564ee9113d326c6f4ca43e00c73
SHA1 840a74c044595e13bb4a18a84307d4838ffc8fd1
SHA512 60d6c46b3aff68ea3747c8ab4a09ea58e8affbe109b262e17335e16a9efdea30ca37d572e1a89a37315840df2facbc0a6a25ea0eba3de7e0076ea3fd669cce36
SSDEEP 192:FRS5ZJFoHEPv7MF+pAPRp2AR9HHsb+WNngw4CXD2Q0BEkwEaLMVyIsnAUgE:FRS5FzHgoUXh1w34i22kaUE
TLSH
T1B142B66AFD11397B6CCBD219FA267B53E7F5102621D02E84EAFC892C05E76CD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 595ac9cad802b76cdd1d5b7f6236540427a21a02221c4f84e9bf522757dc3bf3
MD5 3beb21211bbed2831a60e149dd6ec7d3
SHA1 61238c0a3f2be21d25e6fa48ff58dde87667a6a6
SHA512 921c69051d6269be8226f6f2b702b4e3ffe72d475b7414ce409f2b5f003c3af3c0dae5a28bc0c3459e1f3e9e56a11fc2448acbcc37af77f5f0c11b87ee19f9fb
SSDEEP 192:FRS5ZJFoHE5v7MF+pAPRp2S9HHsb+WNngw4Pb0BEkwEaLQVyIsnAUge:FRS5FzZgoUX91w34PDkawe
TLSH
T19D42A72EEE1529776CCAD219FE267B53E7F5102621D41E84EAFC892C05E76CC2227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 987d60d99618dcef160d4c7ecd5b03d4b10c520de0bfbde61e4a6dcbb90e9620
MD5 e359d13a0eae84a8a34dd68a97363c4e
SHA1 fab9a55c4d747ecebeee9ed2325383aea863da8d
SHA512 40d1bac0b2e649f30c9362827a576e61a1f2751444dae28f5813d65db371ccb28d3948203f76eb5ccdce26045c44b57bb740dd67ada718b0ba83be279cfef765
SSDEEP 192:FRS5ZJFoHEpv7MF+p2PRpAAc9HHsb+WNngw4CXD2I0BEkwEaLOVyIsnAUgE:FRS5FzpgoSXK1w34i2ukaCE
TLSH
T13952C66AFD11397BACCBD229F9167B53E7F5102621902E84EAFC892C09E76CD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 41471cee2c5a0856dcb007e3b022ed540037c9fa9efb86ed6cf3addbd96e0e7d
MD5 231513fdbdc53d976575e3b0943c96c3
SHA1 f7edfe882a1ea4f3150e2132030820e22f1e6f6e
SHA512 6bb71a4632bbd547375c09dd3eb80b9c6f2b10104a2cfa009c7fcac19f6bc74ef0e2b380ec6fef4a275dbe7508164258d6a3de80c7bb68c5ebd6231c399cf0e6
SSDEEP 192:FRS5SMJFoHEpv7MF+p2PRpAAi9HHsb+WNngw4CXD2I0BEkwEaLOVyIsnAUgE:FRS5LzpgoSXk1w34i2ukaCE
TLSH
T11C52C66AFD10397B6CCBD229FA167B53E7F5102621902E84EAFC892C09E76CD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fdaee3dc8d638ac767cb82ebeffc157fba81ad357dc3890ff2e56c892a0fa479
MD5 75b364e6c37920e9c1f507dd6f330267
SHA1 6a2a3af03607b422aca770c74711da392b9a631e
SHA512 c06261c54e43f5ed6ab9d79bd3f00eda39c69a8c7fdf6fa58ae8c3f5c464d01d53c442060dbe57295cbde01946f5899631e6a4eb116cc2b4a80acc5ccbd4dd40
TLSH
T15AB0120080415181C0C202B02142659871545F10D64E370183E46962C8251728017052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58943c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58943c.TMP
Size 96B
SHA256 a577768a7c89a3ab7a706ff7c41916717a721db302dc376a21b2a6bcef5a341c
MD5 3bbccb1daebb5d3073b930eaa6c07891
SHA1 9386ec28df1831348f77de1ea0f3052927193afe
SHA512 362d2161a0e186e118632ac36005f94cee2e7d550cd89fee88fb11d45ad00234d4ee27e691f34924c8afd0827ba538b5389202c1f4ccaf8491931d01df0f14d7
TLSH
T16BB02208C0032203C8C303B020CCC8EC3020CF3CC203220282E00AABCCA02F30228020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d5dceec6d4433707e1ff13814f0e94c615352054c62e8327f5ceff292c91e356
MD5 bb6fe8374903b7f94e1d38deb368e7f2
SHA1 df6b8682ef504d0c3b5acb3a7ec80d0972665bb5
SHA512 25a70f534a90b945612b0ded2a9f4e4aca7b3000a76cbb22d5caaec85fcd4fa6a226014c7a4ec47c4fc3ccb9269ffb4922d575dd2b8a00b9d211ef3e9ae763c1
SSDEEP 3072:4kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:4Hm7Rkm1tYpBeh2BAoM
TLSH
T141C312375D75A8375DB9BB0EB08E0A1F1EF14AA7D830DA92C8D85B0427F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5a7f1dfc0ef8f8fca8cb912aa4e2b6837b99c9cbc58899313bd4641c368277b8
MD5 087c7cea1857879dcfc416c05319b48a
SHA1 66d8719f3505a99054759f97885303a1e8239fc9
SHA512 04dfb3894caab1889df9e554b872773c2e604af74b6288f78ec36024994c4676f69ba00b4da25d219673ca1a6c5d3f890d0a401becb4f03abf85890ff058389d
SSDEEP 3072:R3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:R2m7Rkm1tYpBeh2BAoM
TLSH
T113C312375D75A83759A9BB1EB04E0B1F1EF14AA7C830DA92C8D85B0427EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5cf9487b00f00e3f93179d1578d5f027460e53d7fa37c535f38a6d4a3638cb42
MD5 9c45d7dd327819f887366c12c5332c12
SHA1 84216202798f9c38af25486ecbc069f625f9dba0
SHA512 3208eea3aded62e349b0d568f2fd4ec8e316914483a7d6af17753840652116f25e4592318d263fcdec9fbf939d8a53d362f5e56a45477d1dae0205cfde54952e
SSDEEP 3072:/gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Lm7Rkm1tYpBeh2BAoM
TLSH
T177C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 00985a68773be9b83fd0b66fb488f5c629f1894ce8df7e6bd453c383a34da582
MD5 441e3edb007e64b21c6c8bc65cb37ee9
SHA1 d344eb659010cc13dd6068a672fd6e4ea5f7f41d
SHA512 15da78b839fd00f71ad20972d152d49471d6bab19308628c6b91626203ffb62ee9d8b122ea60097d6903adae3f2ae75ed7fba0814e92d0292392b5152b3c9395
SSDEEP 3072:43Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:42m7Rkm1tYpBeh2BAoM
TLSH
T125C312375D75A83759A9BB1EB04E0B1F1EF149A7C830DA92C8D85B0427FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download