hxxps://github[.]com/user-attachments/files/30876475/ID[.]me_Statement[.]html

Analysis

user interaction
yes
max time kernel
82s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/user-attachments/files/30876475/ID.me_Statement.html
Sample260813-rfv8dabd98

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311037669114235"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe
Token: SeShutdownPrivilege	1592	chrome.exe
Token: SeCreatePagefilePrivilege	1592	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe
1592	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4508	1592	chrome.exe	85
PID 1592 wrote to memory of 1840	1592	chrome.exe	86
PID 1592 wrote to memory of 1840	1592	chrome.exe	86
PID 1592 wrote to memory of 440	1592	chrome.exe	87
PID 1592 wrote to memory of 3816	1592	chrome.exe	88
PID 1592 wrote to memory of 3816	1592	chrome.exe	88
PID 1592 wrote to memory of 3784	1592	chrome.exe	90
PID 1592 wrote to memory of 3784	1592	chrome.exe	90
PID 1592 wrote to memory of 64	1592	chrome.exe	91
PID 1592 wrote to memory of 64	1592	chrome.exe	91
PID 1592 wrote to memory of 1392	1592	chrome.exe	92
PID 1592 wrote to memory of 1392	1592	chrome.exe	92
PID 1592 wrote to memory of 4172	1592	chrome.exe	95
PID 1592 wrote to memory of 1948	1592	chrome.exe	96
PID 1592 wrote to memory of 1408	1592	chrome.exe	108
PID 1592 wrote to memory of 1240	1592	chrome.exe	109
PID 1592 wrote to memory of 2356	1592	chrome.exe	110
PID 1592 wrote to memory of 1752	1592	chrome.exe	116
PID 1592 wrote to memory of 1752	1592	chrome.exe	116
PID 1592 wrote to memory of 2112	1592	chrome.exe	118
PID 1592 wrote to memory of 2112	1592	chrome.exe	118
PID 1592 wrote to memory of 3352	1592	chrome.exe	119
PID 1592 wrote to memory of 3352	1592	chrome.exe	119
PID 1592 wrote to memory of 924	1592	chrome.exe	120
PID 1592 wrote to memory of 924	1592	chrome.exe	120
PID 1592 wrote to memory of 4588	1592	chrome.exe	121
PID 1592 wrote to memory of 4588	1592	chrome.exe	121
PID 1592 wrote to memory of 3124	1592	chrome.exe	122
PID 1592 wrote to memory of 3124	1592	chrome.exe	122
PID 1592 wrote to memory of 4108	1592	chrome.exe	123
PID 1592 wrote to memory of 4108	1592	chrome.exe	123
PID 1592 wrote to memory of 3324	1592	chrome.exe	124
PID 1592 wrote to memory of 3324	1592	chrome.exe	124
PID 1592 wrote to memory of 1404	1592	chrome.exe	125
PID 1592 wrote to memory of 1404	1592	chrome.exe	125
PID 1592 wrote to memory of 1000	1592	chrome.exe	126
PID 1592 wrote to memory of 1000	1592	chrome.exe	126
PID 1592 wrote to memory of 4048	1592	chrome.exe	127
PID 1592 wrote to memory of 4048	1592	chrome.exe	127
PID 1592 wrote to memory of 1688	1592	chrome.exe	128
PID 1592 wrote to memory of 1688	1592	chrome.exe	128
PID 1592 wrote to memory of 1436	1592	chrome.exe	129
PID 1592 wrote to memory of 1436	1592	chrome.exe	129

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/user-attachments/files/30876475/ID.me_Statement.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2f6ac728,0x7ffd2f6ac734,0x7ffd2f6ac740
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,14390324899637428342,8407069557103217248,262144 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,798041219916277807,6888493442897081931,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,16351727606318334375,9375818845237893628,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,7962694094569211731,4394204374115915460,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,2429998292291675701,18085880770356386244,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,17672014819717684220,5116046527888791375,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,783063253352211631,15719875629577874042,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,11848424435374867737,7359069711275366949,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,259181038239721782,13460434413266931963,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,2124015043675763535,1832059653064367809,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,17841134913023139517,11377334284515657295,524288 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5964,i,17432961467756619573,4233822181318120267,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4492,i,7284075804521702133,15316664532380045740,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4456,i,6180998786072719012,106949954320946377,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4808,i,5034709320454307004,15486211158369270211,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4412,i,7117458720421545790,13644752668454106780,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5892,i,15977841759830658550,9578517397907463025,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5900,i,2850091812910198287,3201487430370926113,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4420,i,5903439157686520750,13168711897829952446,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5824,i,12587341794485917442,11786996862925352714,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3124,i,3115859968998090687,7309674123257905487,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5984,i,6346983687739257451,12906838615883802087,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3212,i,15062377394508436856,17206724753988047963,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=1080,i,1639923551967890154,12656244894857462459,2097152 --field-trial-handle=1988,i,18362649593821166928,2019048263914587308,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=736 /prefetch:1
  2⤵
  PID:1436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38a441d8-8852-41ae-9b22-a99eb8fe0b3b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\38a441d8-8852-41ae-9b22-a99eb8fe0b3b.tmp
Size 117KB
SHA256 35a78c2cb8620e010d0ca8bc7e7dc6ec997d86ec8fd1e704585e0f2369f17761
MD5 b00f873ba7ad60a9a658700c8294b850
SHA1 1d99596ec8385101e997a72509ca66f58c329891
SHA512 697e31353d97d94a850983b036e70e9ce9163b2b0804fb2dc35b72efc0ebb05dd4dbd10183d76541513ee7cb74dc79c73d0b6af09558c29e7f0a6a16e0b18542
SSDEEP 1536:1GQLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:AQ1qfd7NtZL8cHQRZEQ6Sps3
TLSH
T165C30237EBC21E379D82DB60B5130FD797F644AA9034D301EEAD3BAB7893551A4424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

653e94a3-3370-45ae-8e03-f49d0eaab399.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\653e94a3-3370-45ae-8e03-f49d0eaab399.tmp
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d5e36a6d8e97ebc58f752ed2bbfaac18e60e40956b566f82f4ba3fa57c9d121d
MD5 e47ac1475cdabb9f5266b7f55e7f2343
SHA1 efe1eecba12b7d7bf62c10941ba42bf7d166fd3c
SHA512 aaeecd5aebcd44511e79b0d97333aa08e253112b2aa2be5ea7f21f74ffa712dd0438ae94024fc6ba8c88437a6c5b3975b8fcca02a7536d2714b273bcf7c7d1b8
TLSH
T174E02B79C962EC2B19F91718A0101742DB5513AB2A40C95F7E3C841C8FB16364585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 123KB
SHA256 1b099f88c06ed0869872561c157f0ec9cbe133a0939d9ece4ee1e1f54bd4683d
MD5 297973a488f688271dd223d542ba2697
SHA1 ed99d812e4c88826335f93acede3fad85c90fb54
SHA512 83c802972d9fee9dd7e3c0de42d8636c504e65ff20e43406bb446cc95a16acaa21789a03f0e2006148abfe47100bbd0c66aa4cf98f11e9b0220f1dcdb5204f46
SSDEEP 3072:caEaIjBfXHk79vCMuMZhQqmiutWxJfU52qiAx+SMfd:caEaIf3kxa5aaVMaHAScd
TLSH
T19DC3120EF3299411C6F0AF104C63D6D627617389FFD548C767993E768AAC9E70C28EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e003a43d0419bd9046e908b54ace45e4d9cc7c8561815d2084ffbb2afc5ecbe8
MD5 a8378dc180f92bb3f91862badf38c4b4
SHA1 ecb313d9d71bc207722f75ef78223de794d356f5
SHA512 615519e6625997a375cd4becec6edacd92985204638ba995f27ad4a04c2196a3b5dcae8bfe78cc61658be1d10cd44d0cd8a6723ab4beb50314a056ac20d5a42c
TLSH
T1CA51BDF793F4967E8A1192F4EB146E1FCE6D0525032C3C6689E4AE1B93E2972D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 48b8cd41b4c300749940b3fc8d52860ff109483017c803d9ddc0be477705509e
MD5 5925e03399d73425f7cea9b9bbc022af
SHA1 332ab2795f1d1018adeda138920fb409cdf1fa20
SHA512 db0c4796d4f7a44ccfb5dbb92bbd121b02c7a093e3b0b4bd2a00631ea5a40720c8dc3f91bd0196e0ac9ad10a4a89cb5645cc11122e999a1d0383bb93c2950935
SSDEEP 192:IRl5Zy1bGv70pkPRp+dfuA9+Hsb+WNnkBPHk62ee2inVyIsnAUgE:IRl56yg0XA8w+PE6a2iBE
TLSH
T10E52B62AAB50697B6CDFD219F9617B53D7F6102124951E84EBFCCA2C06E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8977f7c629dba3e5b422dc15a7161ca658f4e710b6b340f4568f2018654223be
MD5 eeb75cc9bc19c2eecad8b9fe6d34eed5
SHA1 8ed5d81406cfb4060882b25900627e7264f8181b
SHA512 a865e35ac65726340f3d1a228e29780f243d4b413dd2040001ec0fe2adec97f048cbeb0cf924e8bcc1fa15ec2dddde83dce41fa9e8dc73209aa20e765463ffb1
SSDEEP 192:IRl5Zy1bkv70pkPRp+dfUW9+Hsb+WNnkBPHk62ee2inVyIsnAUgE:IRl56Ag0X08w+PE6a2iBE
TLSH
T11D52B62AAA50297B6CDFD219F9617B53D7F6102124951E84EBFCCA2C16E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f7f1b7bc5a78862611679d7b2b340dcd0281944b7839b1c54f3dd91720a72000
MD5 aa3ccda478ae4ba0f908af111f956050
SHA1 aab59652ccbfbb2a70da632d0b87c194cb7d3d6f
SHA512 10d76a9bc0af206f02372ed2a16fb97d921413e50e5785e18db047bd008f1cda9f2ac71348c4d0af904d8e26ad744b5f026380388215c57dabccaed0afecb5d7
SSDEEP 192:IRl5Zy1byv70pAPRp2dj9+Hsb+WNnkBPwk62ee2izVyIsnAUge:IRl56egUX68w+PJ6a2iVe
TLSH
T14742B62EAB54697B6CDFD219FD617B53D7F6102124951E80EAFCCA2C09E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 579bf933f2f3a22e8317c381ea1cded71009c785b242d916ee179eb8dcfafb63
MD5 4c55ddb90427d63d69dec376cf93d6ee
SHA1 3f947a04067f3cd79eff167b4c70973f20a28c7e
SHA512 81b33c3c3a236ec59e43d32276bb40f47f272045e7f930e87b784740196b090efd98d20effd885d61f529c5411dcb4ff496ecb552d1d6c5d099ac3b8a2fdb016
TLSH
T12FB01280C0026151C41206F82542548CB234DF10970B170143F069728C2E1A1C0240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b9d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b9d5.TMP
Size 96B
SHA256 3176b2fa62e3bfd67b6cef496bb26c3dee164f19a7c3b025efc3ac22ce17dd5e
MD5 b445d0adc74b50c55d3a4137c269e400
SHA1 ca2066ca42e42ebf1bf67e8ca78b6f0f788743cd
SHA512 6677b6c24401e69c666537e336541a8fd32f5ba82cfcb49c65fa1cce0ba8f1bc6eaf3c192d74666ff8ebedab83261fcf79c6aadbe54b051d0add670b52a7eff7
TLSH
T103B00255C5026266C04203B1A99796E872E0DF26D703521696E05A7ADD39B605925960
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 38c6f3841dc78e59a93292dba26ca59fe3491c44905cadf560cedf3ffac8b351
MD5 c77fc139b2411921d767277e34acb6ce
SHA1 3ea58ae295f3b2312ce564644bef36cdea76bf49
SHA512 35310e00630947f5f3e557c6d08ec2a4ffc2b673442b9b1683ab7b38dc045d55932c9b0ffa0f44fcda7edadd21034a91395ba83436378f758b8f59a045b86ad2
SSDEEP 1536:GpLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:G1qfd7NtZL8cHQRZEQ6Sps3
TLSH
T100C30237EBC61F339E83CB64B9530FD797B644A99034D301AAAD37AB688359164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 53dd33321363fa394194f2744f1ca658878c07034d644d55bd42c58603197602
MD5 18ad6693c108b28c4b5582cfc965b3d7
SHA1 e96595f111ca8d83ad3fd2b1dabb66d7aa04459a
SHA512 db86198087607c3c1bf796d22d73eda7a42de2a6317c844318b107b345d29437ac126d0415bcfbfd9528901976c61d6a3b6be9936ef481e7f16da9e30420bc54
SSDEEP 1536:1pLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:D1qfd7NtZL8cHQRZEQ6Sps3
TLSH
T129C30237EBC61F339E83CB74B9530FD797B644A99034D301ABAD37AB688359164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 795365dc3394381a01995532052248e2760cc66178a5235855f04527ac2e2574
MD5 6db5edd0e396691f2140955e87f83485
SHA1 6249d74a48370c6ed108906a126e7cb216d00c93
SHA512 c4ea0adbde2a1608b68f6c5f38568a99bd890d7b70706d7ed635b524c3379d23e14fcd5c47cd70701f1d9176f224bbb7151b87c8136501b349e00124f5a3d635
SSDEEP 3072:IsTgUIamql6DNk8Cckqfd7NtZL8cHQRZEQ6Sps3:zbIamqMNk/ckqZ/ZLW3Ex3
TLSH
T126F31233FB452E32CD869B7474230ED663F604E9D034C605ABEE66AF79838D1E48295C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c9c70ec50cbd6b12c56aa4b040035382886717a9a2c6da8dea0a769ebde4ebff
MD5 1b5c2d669bfe439f0af164eb323df4d8
SHA1 c73489511bdc652cdf7ea9d52921e9753a2f7801
SHA512 99671dc241b41cd26fa249fe74839659abb7f08f211050e8bab33adce14b02ea73bcd53aa6257342b814fa41325af6a485f5848539fae639b2b611d5e08f315b
SSDEEP 1536:biLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:eqfd7NtZL8cHQRZEQ6Sps3
TLSH
T139C30237EBC21F379D92CB64B9130FD6A7B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a1c92a86a70975c5f6d587bab4a1025759f0004fba675d198d9b5da3f19cba93
MD5 4c55c9d4bc13f31f914e363e523c64d9
SHA1 902ce146d1c9a4d0a5e58756611232fada18393b
SHA512 92345b54af1b328eba6dd6584863366260e6ad97f31b365c87bde1a321e5cb95be0f8bdb501df560d87504467369967ccc0537f87ec967d212a4ee4b7bfa699d
SSDEEP 1536:1vZNyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:lZTqfd7NtZL8cHQRZEQ6Sps3
TLSH
T172C30237EBC21E339DD3DB60B5130ED797F644AA9034D301EEAD36AB7893591A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ID.me_Statement.html

Path C:\Users\Admin\Downloads\ID.me_Statement.html
Size 153KB
SHA256 5be6541da432d419ebdf26c62070d3dca7518dec59fbe351dbd5db59b674c794
MD5 82c4286038fe71dc570c3731eeed8659
SHA1 e15c675999dd64a35e27562e18c8af040442de1c
SHA512 e2c44c846522cbc2a8aae9e2bcdb81852ca82c443825717df33d0d148352092e4db5b876f178c421a4f0ef24d6783ef47669fd02cb2ad71fb88b2c7206d995a2
SSDEEP 3072:1xp0UFypUIJpk+GOyHpsZspNPtc8jd8J7uPILZNJ7KvaJr:1xBypTTkQmbVc0+JQILx7f
TLSH
T1C1E3F13A50C1BD561B768A90DF107A14CDF90C8FBA86D8D0B79C42939FF6604EE93D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download