96c2aac5bca6fd7e2a5efa2fc7c2775e5b509c2569adf5a5b0de7966a88526ac

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GTA 6 SITE.txt
Size 255B
Sample260818-zz49dssvht
SHA256 96c2aac5bca6fd7e2a5efa2fc7c2775e5b509c2569adf5a5b0de7966a88526ac
MD5 a21598cfb8eed0f025b9ec4310ba4846
SHA1 b292ca3b46c89e47d45d2504d74f2b61bad1d148
SHA512 3a3f4c738840450617b19fb18689fd3bce051def55607b36d330d67f8c880ddf405ed357ce36fb28c8791fa6b0ee4d6c7ac3688ed7ccb896762ca8aecda1572f
TLSH
T148D05E30442643C4737875B407A8360C850C2CF4DFA8F18F556683A90502832B084CBF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315610423255733"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1524	1584	chrome.exe	100
PID 1584 wrote to memory of 2084	1584	chrome.exe	102
PID 1584 wrote to memory of 4632	1584	chrome.exe	103
PID 1584 wrote to memory of 2084	1584	chrome.exe	102
PID 1584 wrote to memory of 3972	1584	chrome.exe	104
PID 1584 wrote to memory of 3972	1584	chrome.exe	104
PID 1584 wrote to memory of 5076	1584	chrome.exe	105
PID 1584 wrote to memory of 5076	1584	chrome.exe	105
PID 1584 wrote to memory of 1656	1584	chrome.exe	106
PID 1584 wrote to memory of 1656	1584	chrome.exe	106
PID 1584 wrote to memory of 4008	1584	chrome.exe	107
PID 1584 wrote to memory of 4008	1584	chrome.exe	107
PID 1584 wrote to memory of 3672	1584	chrome.exe	108
PID 1584 wrote to memory of 3672	1584	chrome.exe	108
PID 1584 wrote to memory of 1380	1584	chrome.exe	109
PID 1584 wrote to memory of 1380	1584	chrome.exe	109
PID 1584 wrote to memory of 2696	1584	chrome.exe	110
PID 1584 wrote to memory of 1060	1584	chrome.exe	115
PID 1584 wrote to memory of 1060	1584	chrome.exe	115
PID 1584 wrote to memory of 1960	1584	chrome.exe	116
PID 1584 wrote to memory of 1960	1584	chrome.exe	116
PID 1584 wrote to memory of 5028	1584	chrome.exe	117
PID 1584 wrote to memory of 1864	1584	chrome.exe	118
PID 1584 wrote to memory of 3456	1584	chrome.exe	119
PID 1584 wrote to memory of 1540	1584	chrome.exe	121
PID 1584 wrote to memory of 1540	1584	chrome.exe	121
PID 1584 wrote to memory of 3492	1584	chrome.exe	122
PID 1584 wrote to memory of 3492	1584	chrome.exe	122
PID 1584 wrote to memory of 3512	1584	chrome.exe	123
PID 1584 wrote to memory of 3512	1584	chrome.exe	123
PID 1584 wrote to memory of 4524	1584	chrome.exe	128
PID 1584 wrote to memory of 4524	1584	chrome.exe	128
PID 1584 wrote to memory of 3680	1584	chrome.exe	130

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\GTA 6 SITE.txt"
1⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffec86bc728,0x7ffec86bc734,0x7ffec86bc740
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,8166752433447690957,16418226830956526364,262144 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,18367100623712083746,5665347155519655303,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,10459882708773272495,10741185150519540167,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,2403187935421413544,17035650672041563497,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15075268386464368191,1162482085714332117,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,17049326119723531528,16458099497444816737,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,1946737757650711348,5165936216419415662,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5472,i,3362757946833208572,18391865101538525070,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,2052427008884720896,7492817241058604226,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5988,i,760812508156271166,1860559901424260049,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5248,i,9164680218876259409,3674631383990500468,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,5470340776575659268,6115922317088974771,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,18319565589244810022,17019174580794236118,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,1584793519743296038,12494356445375585679,524288 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3396,i,15401611519558760190,13176221798121763816,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3300,i,6836002361547841273,1495801662374010750,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3440,i,15918606646022381750,4338295779480524141,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3352,i,6652573242782420005,5436036346527621308,2097152 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3452,i,13721772671867437805,8200690371519491532,262144 --field-trial-handle=2084,i,14303101191526309950,1079240247357403126,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 41a7c507d6c4d5d87cf8214925cc37fd343a08175bd9ec002af2017909520077
MD5 39ddf8be2d72ea6636a3486b812e9d56
SHA1 bb45ee88d6bd1b1972aad82cdd29b1c85cb143b6
SHA512 b1601eb9e69f35e55b7e079027b40a69bcdb95810c441f0c49f633c9ea6f57ba987a24f84ae21043436a3daa347020a3427baca6a230ecc3716b049174825905
TLSH
T1FCE061A9C871EC7728FD1719A0501782D754239B2A40C94F7F3DC00C8FB56378685C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 8c68bea511a45a10453cb255c10d96c2dadc083f1917000c7b1258eea241ecfc
MD5 3cc3a8f01b70835328e2815949d9cbf2
SHA1 e95754c5698de6fdd24c93539e11424a80078023
SHA512 50ac4bba63b451395c29fbd6b41e8ddb8b8e052770bb94b1a27263de2ef543a8d92e6c92bb17fed495efa454fdd95c105afd81cd13af1d38dc76540d1f72e35f
TLSH
T1CBB0220082802A83CF020B308FE0C8C03030AC0C030F0203CBC00FF080203BAA280020
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 eee6a99d785707fb3cb05f71cb839f5e5058f8ebf0a96603f943037e2c4591aa
MD5 d0d999a8cc246991c35558953dd9355a
SHA1 b1b2f9b0b2c9877c293051f56017137757c1a696
SHA512 76aaf22505e36dd629a9be81a7fc4045b237a0f2be42aa1e56f6641824023cc2c6d1c6ad06cec805c69721549c6b7fbdc1edc3e991990a145057c674aff9c9c4
TLSH
T1A181ADF783E48A7DC92152F4AE256E1FCE2D0924432C3C6A88D4BE1B57E2971E25174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 69c24cc03e81a6f7c3f4ce26e06f22ef0e5f4f0f21936622b398499e854ebed5
MD5 2976e3e252fa05ec6d2f665bdf4d36fe
SHA1 61fb97b2f64aa24b543229b0c0c8f00c35ee128e
SHA512 0b4c39f87dd28c1b4c708dcace31adb27403af4d5ed11fb8e218ca167285b41822ac1b26d9abdfa8c6cb91d10bd1bdf020221aa1cd710e3204545947ad20892e
SSDEEP 192:kRL3n8PSYv70p9PRpIdx6T9+HTcb+WNnlS/v0QdCey6eQgt9VyIsnAUgWaJ:kRL3PEgHXd8kgkTebqn
TLSH
T1B552C72ABA106A7B6CDFD215F9A17B53D7F1202161912F44EAFC8A2C15DB6CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6f7b03770aaebe4d1da16d38a0c3103c4a9d583242b17e230636c8ebf8e0bffd
MD5 4f3fe04157946263423ced8e05b8fc29
SHA1 4b18522467c4bfd948cdb771efbd5fc333123377
SHA512 6f45fb75a04bdb15dbc80fc8a9f96c785457a60a7e9a336639e08f8040d4b659051a4ee38af47e206e9c54c769538c3fa70e10a6aaed48218b5f46e50d02d7a0
SSDEEP 192:kRL3n8PSP0v70pAPRp2dxe9+HTcb+WNnlSZf82L6eQgtFVyIsnAUgraJ:kRL3PPwgUX38kgO20ke
TLSH
T18C52C62ABA106A7B6CDFD219F9A17B53D7F2102264D11E44EAFC8A2C15DB6CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 de09d16c1290ddae0ea09c8614079b9c10ba65788c341d5f200ddc876e349d93
MD5 0125922b094bccc3abbd9bd4c4cfa70c
SHA1 0ee7d545be92917cadb0567b439df8f4f1197045
SHA512 b6df8414202a2782d9208e30e4c7c8048469156866916ea81db8285ba8c02f9a90c6b1f2c1cec5b68f1575d89097e725e639e57ffb5f5457069ebd1c587b8685
SSDEEP 192:kRL3n8PSCv70p9PRpIdPi6T9+HTcb+WNnlS/v0QdCey6eQgt9VyIsnAUgWaJ:kRL3POgHXE8kgkTebqn
TLSH
T19852D72ABA106A7B6CDFD215F9A17B27D7F1202164D11F44EAFC8A2C19DB6CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eb95f9a9c006d4291af734f048d8f6280c52b702609a44d28bed922dc2540460
MD5 3e043050f5461f2b725d8fed9d78b041
SHA1 48729743af38674b4a6ffbb924471771ba7ebbfe
SHA512 dbd834cce32cf3fc7021252b09b2fbfaeb2a51f2743254ee5faba52b3ff1fba6f3e134a265706d5a0a95636941615292fd3292c20656f81ef361837434235c8c
SSDEEP 192:bRL3n8PUMv70pAPRp2dj9+HTcb+WNn0j0B6eQgtFVyIsnAUgtaJ:bRL3dYgUX68k40Ok8
TLSH
T14242B62EBA106A7B6CDFD219FDA17B53D7F6102161D11E44EAFC8A2C19E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 54bd218b4c36d9a00bc4e24ba5858f99fdee38cb798e141e6db8c0643145d5b4
MD5 984ac8bea392d28f265f7a12df704dfa
SHA1 3d503321888f62a098e40f0f2bfe90b0191d04b1
SHA512 e64288e0f5ebf13bf9313c6c4040428752c3f2267973e1c6338f12620bf70594289aba0318f32be50e24d228d427d741f5ea7e41e37939ecb19158e157b134ba
SSDEEP 192:kRL3n8PSHv70p9PRpIdPi6T9+HTcb+WNnlS/v0QdCey6eQgt9VyIsnAUgWaJ:kRL3PPgHXE8kgkTebqn
TLSH
T14752D72ABA106A7B6CDFD215F9A17B27D7F1102164D11F44EAFC8A2C15DB6CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e5938dc692d34d45fe7d125b434339210aba039ca66cbcec2790d1957e220928
MD5 af609f6c94cb690bb192d98883e3f8bd
SHA1 c0f3338d4b550fc13527816ed20b611077433019
SHA512 f0ef47a1b6f902a566f2256610ee275900ed1e46c0d7c97016de91229069bf7763f082fe40e0035197d028f959aa612d5cad7489a54c8341aa8a274035cf7ad4
TLSH
T1BCB0128080019182C01202F922435488721CAF15960B170157F069268C252908014051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c89.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589c89.TMP
Size 96B
SHA256 4a7fc9402716bce65273b9850bf94ca1f7ed514484ad9f01187d76d4ae58d642
MD5 ac8ef66716589d409764c39d44609ab4
SHA1 b761cf2b7be42cba1e39bffdad38eb35b6578e05
SHA512 ce15bf3aa14d2bb6a91af01426657e720b9589a60e0141f22a8ad12c6544bcfa9512756d741ae208491adb94381911636cf732e8539c3ec2d8721fb22a4335b7
TLSH
T1EEB02200C803B322C00283B028E0ECEC3020CF28CB032302C2E00A22CC382302238A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 00ed4b7fae19800b2739a051bfaa7e79c3e2b1ba899d55692f470d09f4f8cd60
MD5 269ddeb09964869026c9abb2ebfa5fe3
SHA1 58175d8ac65f60c35de2560e1f5c106aaa805904
SHA512 baf03e45a66437107ff930bf0f2054eba9a843fe983bd839e4d6ab8bcf7d06defb47d128cc8bd794a33876965a65a5483cb58f5a817cd0dbc24fa9a279df0a85
SSDEEP 3072:ezfioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:ifiwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T1A0341277CD811F369C879E98B6531E96CAE049AB9430C30656FE3BD72806BD0A513CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 a8928b94dacb9a24fcbc44096f6cb5cabbeabacf60d787e64318d8860be93ddd
MD5 9a66f80698098592ea4c886b2d40e9e7
SHA1 41054a997bdc7b492869ec19145bc8892800ad2a
SHA512 b519d7fca3187e196d5309a3d40b2d852a03668d48cd366f04de712f1c505a6173ed6af13a9e4f48e88f825cc7019c214f05b5eebd37e51d45d9748a474fbbcc
SSDEEP 3072:B6ioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:B6iwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T131341277CD811F3698D79E88B6531E96CAE189AB9430C30556FE3BD72806AD0E503CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2024939e802e5222faadadb3f8f49fc5a82cd506c68cef27b08a2f4c2bba6cc5
MD5 b0ae0e4c287db3efdb76b8fb7a491279
SHA1 4ab4579f7dc7d91fa32c0574e0c9ae1be9db880b
SHA512 e9d2357db8b9cc13b261732ea70dc0de82e31a59dd48f38857c702c29745c742de3ef06b4262b0395bf0b9361e388088ed4fef67f4834a7db0d5962821846082
SSDEEP 1536:boLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Eqfd7NtZL8cHQRZEQ6Sps3
TLSH
T10AC30237ABC21F339E92CF64B9530FD657B644A99030D301AEAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 e1135b21fe43c8be0b9dc73604801bb2a8a5187f7438354661bed54514cffea1
MD5 d5acced48848be3486d57e2cfe81f29d
SHA1 88d9eda370597fdaa10347925e7908bfb5ded8b9
SHA512 aec64116026693daea3ee6475c3e905bd7ebbf78680830c3e817113a8a5abf6c911d86fb17cb05e0bf2616dea1ff98bce37f41853efc31202163b239f48a8858
SSDEEP 3072:PsioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:EiwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T1E3341377CE815F369CC79E98B6631D96C2B149AA9034C30657FE3BD73902BD0A5138AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 f7940d7a38d86a308755808aecef9597d1cd3a6f393008eac1cd707f4f8381b0
MD5 d1f31b3b3016d54a9e1e0a7929a9edcc
SHA1 e3043f6906921654eb50bbce8bba9599580d3f4b
SHA512 9e8d6acb706c2a138b8c3e63f33fde6e158e3185743fde65e9a60f809b9049a539a748a81741ea4d7ee269ded2e09264beb3e3965c8fc872d5a6eee28f966292
SSDEEP 3072:46ioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:46iwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T1CA341277CD811F3698D79E88B6531E96CAE189AB9430D30556FE3BD72806AD0E503CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 1f2f0441aebc1ee32b47901ada9ca82c0bd6a2bee5ae2221e429d1539109cb97
MD5 04e4adfb1837bfffd66cd327112106b2
SHA1 bb2740d9933c6db78c324588870cce13b0425b4b
SHA512 658e3c5f6615e31728043e06e25f892451e545f51dab711c37c2e598fcb75d82c10d4c175e75574c260070026e07c84ca8858ccd345cefc0ac0502a06d1c9cad
SSDEEP 3072:AsioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:PiwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T110341377CE815F369CC79E98B6631D96C2B149AA9034C30657FE3BD73902BD0A5138AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 13b345ee49e5e7d6a4fb974389b7a8d7a1c66b263243a4d22c0e7ce0047410ba
MD5 58875b38c983547945f988c521bf5154
SHA1 6e394f1c71a029aea81b8f93647e5f3613690ac4
SHA512 7c78a48900b373ae4c4953bb1e1fb6d8dffaa814fc8772bfe6df8cdb037521a355ea9fab00f16978ab637dd9c1cea1da6d257bf9c6ed1dda7bdd4a557231f0a3
SSDEEP 3072:osioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g3qfd7NtZL8cHQRZEQ6Sps2:niwfOqi+91Nd3it2OqZ/ZLW3Ex2
TLSH
T13F341377CE815F369CC79E98B6631D96C2B149AA9034C30657FE3BD73902BD0A5138AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download