hxxps://russellcourthhotel[.]ie

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://russellcourthhotel.ie
Sample260818-tkglwsdn3s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315429486813648"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
816	chrome.exe
816	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe
Token: SeShutdownPrivilege	3284	chrome.exe
Token: SeCreatePagefilePrivilege	3284	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe
3284	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1888	3284	chrome.exe	86
PID 3284 wrote to memory of 2476	3284	chrome.exe	87
PID 3284 wrote to memory of 2476	3284	chrome.exe	87
PID 3284 wrote to memory of 2932	3284	chrome.exe	88
PID 3284 wrote to memory of 1188	3284	chrome.exe	89
PID 3284 wrote to memory of 1188	3284	chrome.exe	89
PID 3284 wrote to memory of 2032	3284	chrome.exe	91
PID 3284 wrote to memory of 2688	3284	chrome.exe	92
PID 3284 wrote to memory of 2032	3284	chrome.exe	91
PID 3284 wrote to memory of 2688	3284	chrome.exe	92
PID 3284 wrote to memory of 4252	3284	chrome.exe	93
PID 3284 wrote to memory of 4252	3284	chrome.exe	93
PID 3284 wrote to memory of 2980	3284	chrome.exe	94
PID 3284 wrote to memory of 2980	3284	chrome.exe	94
PID 3284 wrote to memory of 4212	3284	chrome.exe	95
PID 3284 wrote to memory of 4212	3284	chrome.exe	95
PID 3284 wrote to memory of 1452	3284	chrome.exe	97
PID 3284 wrote to memory of 4832	3284	chrome.exe	102
PID 3284 wrote to memory of 4832	3284	chrome.exe	102
PID 3284 wrote to memory of 976	3284	chrome.exe	103
PID 3284 wrote to memory of 976	3284	chrome.exe	103
PID 3284 wrote to memory of 2796	3284	chrome.exe	104
PID 3284 wrote to memory of 2796	3284	chrome.exe	104
PID 3284 wrote to memory of 3684	3284	chrome.exe	105
PID 3284 wrote to memory of 3684	3284	chrome.exe	105
PID 3284 wrote to memory of 4732	3284	chrome.exe	106
PID 3284 wrote to memory of 4732	3284	chrome.exe	106
PID 3284 wrote to memory of 3444	3284	chrome.exe	108
PID 3284 wrote to memory of 3444	3284	chrome.exe	108
PID 3284 wrote to memory of 648	3284	chrome.exe	109
PID 3284 wrote to memory of 648	3284	chrome.exe	109
PID 3284 wrote to memory of 4940	3284	chrome.exe	113
PID 3284 wrote to memory of 4940	3284	chrome.exe	113
PID 3284 wrote to memory of 4464	3284	chrome.exe	118
PID 3284 wrote to memory of 4224	3284	chrome.exe	119
PID 3284 wrote to memory of 3684	3284	chrome.exe	120
PID 3284 wrote to memory of 5100	3284	chrome.exe	121
PID 3284 wrote to memory of 5100	3284	chrome.exe	121
PID 3284 wrote to memory of 4208	3284	chrome.exe	123
PID 3284 wrote to memory of 4208	3284	chrome.exe	123
PID 3284 wrote to memory of 816	3284	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://russellcourthhotel.ie
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7e0ac728,0x7fff7e0ac734,0x7fff7e0ac740
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,248524832799386826,14343558486055901299,262144 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,14016998734526379258,14782708262399488455,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,15251478350678752333,2418628202938033439,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,6373341966823534288,10195739182807181276,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,15075234397385221778,2162984610701323966,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3236,i,3384795058278436292,5682464202120745599,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,3453486206117793176,12824860256230068970,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3284,i,17770408268126826947,2163264738975263497,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,5040781893796183408,5740982877874606192,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3728,i,11942637316230709697,1544967955622343950,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4684,i,14540598775169958578,7206042890521042167,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5656,i,4546840765801727106,14824732864041518976,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4684,i,8693402079843858886,341621227865815465,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3360,i,17382769770897274931,216481501169031937,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3524,i,6727158207294903357,3207090651701393702,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5568,i,8725986266806394134,3886675429217391907,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,13761177267602847486,2779687780467608663,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,17899625389037533633,8346390882921276933,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,2484457492234852626,12617619221644737338,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3284,i,4571588240081571569,16134047236115313246,524288 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5764,i,2709367591666618918,11228569491396678038,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5772,i,10102860145929500055,1191901850951170020,2097152 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=732 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5864,i,15443916745076791145,5046362659902914316,262144 --field-trial-handle=1996,i,5909271295843870100,432023751904392589,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7bb093d493aeda8a19c47d0221b2446b3ccb826879cbe4fca53fa2e8c5968a4f
MD5 5dc09ac10c76a640c3f2fb9c04f6c389
SHA1 33d47a4fef1e37b6d82af9b0518ad54a92fd9780
SHA512 13213292ba77121843c46d51cafb4da01c8e39168e1a837e84a82fafafeb36903cf57616d808ab97f139fe5f1f4d9291e1b41973c41dca5960b4a95ad2e152cb
TLSH
T184E02B99C861FC2B4CFD4B1D50544646EB25135717A5845B3B3C82098FB27A7058696C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72ec498695b70064c22138b995afed762472fdbf032e746f412c3bf2d2d574b8
MD5 c8c86d466ddb25fc4006cb73dd3a1ca5
SHA1 f563b87aaf779b8d4aa46907e94b9ff62d95a91b
SHA512 9a6ea60208eef66acb734b2a71c3abc7bc477112cc64a912b01110f0ce152dfb400519c19ef6adacda0d4d8e9c843ef43e5152e94159982c951a74261667ec40
TLSH
T1F3418AF793B4997E8A1192E4EB156F1FCE690625031C3CA689D4AE1B83F2872D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4536a11808ace834160e29fc9fee49df4ecb8199c9eff7b6c009f0cf636dbd87
MD5 e6e81c612a28f09236bc3e3658af0fe9
SHA1 0b69fa9ef5337585113ad64dda3acc8552906b5b
SHA512 f7e686de50706e531c890749dc3d6896ecd35fff82e89f34a44d267a796a05a260d64291dd6ed9614b74290df8d2ef4010857144f3dbc026019dd1e7a003d1dc
SSDEEP 192:IRjqnBb8OGRv7ApAPRp2+p9qHsb+WNnzkHjn2ydRZwuVyIsnAUge:IRjqBeBkUX9kwg72+Re
TLSH
T19742B72EEE10793B9CDBD229FA257723E7F5103525952E84E6FC892C14E76CC211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9eed8dc600f0fa7d95a0f86060cad6c64418e42ea5efb2c5e0af8a896fc70db6
MD5 de9ea4280ec9ef7bf56f92befd2c199a
SHA1 e9d7cbfa650fefcf98721eb14b9929a466b6a2d8
SHA512 b99e81fbf316b2796e21f260a3a5ef5e802b3d254ab97f4ed04cb1f3e1576403a47b31017f819e197b37ac240a803d5c7322305051834dc2c17ceb8e099dc9a9
SSDEEP 192:IRjqnBb8OWQv7ApAPRp2+p9qHsb+WNnzkHjn2ydRZwuVyIsnAUge:IRjqBeMkUX9kwg72+Re
TLSH
T15E42B62EEE10793B9CDBD229FA257B23E7F5103525952E84E6FC892C14E76CC211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e9763610cae99696c9ea8b055068be2a93081f71bba85c3151c647ef142fbf29
MD5 22b7ffc28ef8f8d0b1a5acced2420247
SHA1 2668c008339874864403430a66d74b452fad29fd
SHA512 ba8ef938fe0c09239a5af2843df0aa6183f80b3ce31cdce00a23b9fb99742f9cc5865beb9cb10f00eceb4184afd80d786f2b27c720b328265d9cab4baa3d71d7
SSDEEP 192:IRjqnBb8OWLv7ApAPRp2+p9qHsb+WNnzkHjn2rdRZwkVyIsnAUgE:IRjqBezkUX9kwg72RvE
TLSH
T11742A72EED10793BACDBD229FA257B23E7F5103525952E84D6FC891C14E76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d12b8e3f8fe2a23f63e2f13aa9d9169618ccc0c7ac4563d48a8a7378cde06711
MD5 6ac468d7c3e61d14d8d5c42921a8104c
SHA1 778a582d7cc02e8e3a2aa5620acacd72619374b9
SHA512 c17c566edcaab890bcaa0ecde34130f957d0e2607af4b686d2a7e1046fcc74b13ab548066349937da7b220be79b38bd43fa871e10a5930c69197397bde2cfabe
TLSH
T14FB012408401D741C18602B0118318C871147F18DB0A174143E07922CC65371C119050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc56.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bc56.TMP
Size 96B
SHA256 037d4a9c71780f6f31c2ece379da4bae562e4dfc2c0a7a328cb9915fe5549790
MD5 d4a4ea730f0e1501eaca2f8649fc06c4
SHA1 8d9e9cbc20182079a8facf64c3b3a47b16385f8e
SHA512 1689f2ceea9c112ec4dd37714e4b3d88d85586440ae94f22d15d1e85b4582acb5731a8e1e78caf1c24e238191430fa682f883364f26a32791205eb326c32e803
TLSH
T161B02203C002A302C00203B0A28CA0E8B2A0EF20C203020BA2E00A32CC28F300030020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 780242d844b4de28fa727d06ee6c205af8f5b9ce0ba39eb4068784e83b824784
MD5 763a0484813df7d7382929c47ee1b6f1
SHA1 61ed144859020bb27086e93a9ec52ec73b8b24c6
SHA512 a3326b4fd1f725bf89d3bc193f2f937fc7a5e1f8862e998dbc70a6bb359ac9d20880038651a0649d9f682f7d13229a46a783be98839a31b051b41b9808beb5f4
SSDEEP 3072:2c4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Zzm7Rkm1tYpBeh2BAog
TLSH
T1DAC3023B5D75A83B59B9BB0FB04E0A1F2EF249A7C920DE52C8D85A0423F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ccde7a503eb68c8317b9d717357899854923da00afbada2d61a916e61a2b9e44
MD5 19d969cda6c9cdb045ad4b9397901442
SHA1 f2fe9ed3222896dd25b89036cdf4595fadb7029f
SHA512 148cd5368aecf1af3b3f1f20289352b6e47e94cdca853bc594633f2f910fb3eb26f51a15e4ffd0c97231386c8fe4cbb185787922d91c80eba11f502e9e0faaae
SSDEEP 3072:AzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Vm7Rkm1tYpBeh2BAog
TLSH
T115C3023B5D75EC3B5CB5A74EB48E0B1E2EF249A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 953dbd5ca710b4ef130e74d884ccf1769637e1a2d146bc99525afea287a5e47f
MD5 7859f18132ba8cb2af29d3a8e1854e38
SHA1 a2a6a247c3ef69863565639b20ece28e85b93b7e
SHA512 27a6043abfd6b810a5fd5958d95a3c0e90a41214ba94c0ad63316c8da895790cb14e4aa7112bda5a36503f1f80490dbab9636f8690f7a28b6dd42da2180188e5
SSDEEP 3072:nc2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:cBm7Rkm1tYpBeh2BAog
TLSH
T1BFC3123B5DA5E8375DB5B71EB04E0A1F1EF249A7C920DE92C8D85B0423E97CD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 42340cd383355a1727ed0d22f33e4eb6c2a98b3aa57fbb6c042ee14de8574949
MD5 dfbe26d5b8c51c32a90654dd4c2ee3e0
SHA1 9cf7c7d472ce7010e6b2563560f4bc02bb6103f0
SHA512 c67133a80b33986228c6fd5366c5c7849eedee37027723818402120a97503e2f01b57be4be0f3f622df72ef0613459e121b8075c88e0fb9e8adf4669f14757df
SSDEEP 3072:2c2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:ZBm7Rkm1tYpBeh2BAog
TLSH
T117C3123B5DA5E8375DB5B71EB04E0A1F1EF249A7C920DE92C8D85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download