hxxp://010001a018f26b39-5e01dfcd-842a-436b-b757-313f648eaa8d-000000@send[.]mailxxxyo0dacxf[.]fangxiangpantao[.]com[.]cn | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://010001a018f26b39-5e01dfcd-842a-436b-b757-313f648eaa8d-000000@send.mailxxxyo0dacxf.fangxiangpantao.com.cn
Sample260819-lkf2css1fz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
4656	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316057326605860"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1224	4740	chrome.exe	86
PID 4740 wrote to memory of 4632	4740	chrome.exe	87
PID 4740 wrote to memory of 4632	4740	chrome.exe	87
PID 4740 wrote to memory of 4656	4740	chrome.exe	88
PID 4740 wrote to memory of 1536	4740	chrome.exe	89
PID 4740 wrote to memory of 1536	4740	chrome.exe	89
PID 4740 wrote to memory of 1432	4740	chrome.exe	91
PID 4740 wrote to memory of 664	4740	chrome.exe	92
PID 4740 wrote to memory of 1432	4740	chrome.exe	91
PID 4740 wrote to memory of 664	4740	chrome.exe	92
PID 4740 wrote to memory of 1596	4740	chrome.exe	93
PID 4740 wrote to memory of 1596	4740	chrome.exe	93
PID 4740 wrote to memory of 2120	4740	chrome.exe	94
PID 4740 wrote to memory of 2120	4740	chrome.exe	94
PID 4740 wrote to memory of 5032	4740	chrome.exe	95
PID 4740 wrote to memory of 5032	4740	chrome.exe	95
PID 4740 wrote to memory of 2516	4740	chrome.exe	96
PID 4740 wrote to memory of 3960	4740	chrome.exe	99
PID 4740 wrote to memory of 3960	4740	chrome.exe	99
PID 4740 wrote to memory of 4780	4740	chrome.exe	101
PID 4740 wrote to memory of 4780	4740	chrome.exe	101
PID 4740 wrote to memory of 3700	4740	chrome.exe	108
PID 4740 wrote to memory of 3700	4740	chrome.exe	108
PID 4740 wrote to memory of 4004	4740	chrome.exe	114
PID 4740 wrote to memory of 856	4740	chrome.exe	115
PID 4740 wrote to memory of 4288	4740	chrome.exe	116
PID 4740 wrote to memory of 3348	4740	chrome.exe	121
PID 4740 wrote to memory of 3348	4740	chrome.exe	121
PID 4740 wrote to memory of 4800	4740	chrome.exe	123
PID 4740 wrote to memory of 4800	4740	chrome.exe	123
PID 4740 wrote to memory of 4896	4740	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://010001a018f26b39-5e01dfcd-842a-436b-b757-313f648eaa8d-000000@send.mailxxxyo0dacxf.fangxiangpantao.com.cn
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4ed8c728,0x7fff4ed8c734,0x7fff4ed8c740
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,13434188548348241547,3924959820213009940,262144 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,2938728897775797035,16762224142354151418,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,242135357922034356,3537153132549814292,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,11796517801989461431,11306375208189075730,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,12949195123225245224,10515418388695508791,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,1470732239546151082,8117183950491750902,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,6423575981934314802,10823906357602886263,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3180,i,10745738421343338838,12838618616258067467,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,16702067958129199283,11473963515200281988,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4692,i,17102445891416413655,11782159398804545786,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5772,i,845973364760173637,9001975511476850383,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5604,i,14916331371616462052,2859007415207585547,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,17519450545452012783,6719758227366029860,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,16495409177775267289,4856199946865264707,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,6124198367859030897,1028450594218839215,524288 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3896,i,4662297011691177599,17061561736480087992,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5764,i,7793578004794108028,6243715847116259533,2097152 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=988 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5760,i,7638613491663707757,9267243392013393372,262144 --field-trial-handle=2008,i,18226306794991943796,9828506403642142059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 465f77c3c540302b87bd3e1975753d5102c6b3ce860c53eb97a3b1f5b264eec5
MD5 aff94de9579f76bc6458cc4d98cf0ec2
SHA1 858f2808970a1b3484a8b2562459cf92de717bfc
SHA512 41bed7f77238ef02d20dd48f4a37d926fffb1604afb3ccf5c1b6fa4fdea59c507e83b15dbfd25bbd5ad1cee969269f1126cfe87947685a620210a5dadd564bad
TLSH
T129E02BAACC66EC374DFD47AD90544746EB6213572760895F3B3C81088FB167B128695C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efe735df1500e383ec3dd661342ab66946627a8efffa078c6b1f6f66d026cdba
MD5 6a8499bf18221feb0a4533817b2c20c4
SHA1 426e7cd044371c4bb04eebca1d1442fbcc6404f9
SHA512 fc2e2b8e64f0f7247f08d5e2672e3d4cdf3ccfc5d4f68c11383f201a95035a923ee0b9ed30725f877eb3427b3f14f7a7bf2e6b15cbf44e6f2a74780abd7ce69d
TLSH
T1D0417DF793B4957E8A1192E4EA156E1FCE790624131C3CA689D46E2B47F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49d784147047fbbb74d3525243c1dda3681caba3798689fdcc139432ee40ac57
MD5 a171ee4223d569dd0f14684d3d78ffc7
SHA1 823067f8af1967a36a8a10840fb94c6401852f4f
SHA512 202a978d071146406ef08bfd2d21f64fc6283651a9cd9e236b2ff05c91c436cbe3b7ba0d10663241d66038561121762dccf0baa97e5c154e0c438e83b36e4588
SSDEEP 192:IR8+UZEzx8OhQYv7ApAPRp2eI9qHJXNb+WNnrmPmk79PWFVyIsnAUgE:IR8+5vQEkUXMkJ7qPv796E
TLSH
T1CE42C72DED50297FADCBD265FA257B23E7F5203520942E84DAFC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 acb2b04658c43e37cf9564803e5f61395da11dcf75fbe8f7afaa0fc8bab3286d
MD5 de767a84323c159adb94ce880526fd61
SHA1 e2e461b8693686ca8b43f5bdcfdc53c4caf2f2ab
SHA512 a9d7d2037ecdb8c7a409776edd52241ef1b1bacbfa2a6263e2e38b749e497b43dd9ff0e5b84751cb883f0cd30f22c0ccb991149775450779178a1ee735fe613d
SSDEEP 192:IR8+UZEzx8OhQev7ApAPRp2eI9qHJXNb+WNnrmPAk79PW/VyIsnAUge:IR8+5vQakUXMkJ7qPZ79Me
TLSH
T1A342C62DEE10293FADCBD225FA257B23E7F5203520942E84DAFC892C15E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ead21822b63b83525e58880205559fb5f9e5c36e7f7b122093cf2de07607f3e7
MD5 95eeb239b917493a617cc332503a64e1
SHA1 4a513c62fb43171b248df44adc773576d6b164b0
SHA512 a5ec3d1eef2147ec3f2f2ba07c2dd5e356fc61d46c4065d8201711e223fac02626a7e0a249aa56d81d582e6a02617aa0cd954df64adac7c7e475da9fd7f184d4
TLSH
T1F6B01200C005A201C04202B41182148871145F12D60A170143E0AA72D82A16180280F1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591321.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591321.TMP
Size 96B
SHA256 b681229f640f92a57de1689a7e6956837b4cf3d7d8bcfc471d670d3f24587f04
MD5 5139298d3fa94c6489b2f868336fd230
SHA1 205ee18b0038b817dcbed8cf0f65507a8ab0b359
SHA512 0c8f25ef6f3b1fb7447ab767e2ed9c56ea68f7138d83e682869212fc6e35114ca1875adb4661006833c0634a8690c2bd7c39d96e1155df9efd58c1d69d02e236
TLSH
T1FAB00265C1136316C45603F825D6D9E87160EF2DCA03122292E01B7BDCA9AB14526260
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 000f705edd0868413c0296495aa6d701b3a53fb69d7b9b314ecc7f73bbdf451e
MD5 26801a09baadcbca99906315b1aa0203
SHA1 3b1a5c1c0fadcfe6254a6b3dd9b29afc7e457f31
SHA512 23faa04664859e0be8cb639824353ab296cd3db0a730f0fcbb293f401934978a702cb62ec0fd7717c06ec1fdc6b6f032b4d1d53016024dc42a8433b67e077ece
SSDEEP 3072:KRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Lm7Rkm1tYpBeh2BAog
TLSH
T125C3123B5DA4E8375DB5BB5EA08E0B1F1EF149A7C920DE92C8D85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e71316578062bcdb53984cef5f1c124b560d5abc7e64730efbb99b5b8d083697
MD5 59fb5620ba49c59b09f14dacb0abc3f8
SHA1 1a9590c11b3017e8f780420acdf585dd6cd952f1
SHA512 47a5c4265a18d3e6156a61db6d8883fa0753dbea8aa071c46e455eadfea752a978285863c7c1b2ef9d7dbbe9267a63d539191e7940afed05e0dffdfa33742a99
SSDEEP 3072:ZRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Sm7Rkm1tYpBeh2BAog
TLSH
T1E6C3123B5DA4A8375DB5BB5EB08E0B1F1EF149A7C920DE92C8D85B0423E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 55b2f564a8827473265dd9eba86254c0267dd4ced1b3ef6fee5d41bcf14aaa70
MD5 0d0a104fff34bd52a8c95edd1e658ea1
SHA1 068acbc30eb7f7915d714c60396aeee7fce93c6a
SHA512 90d12697f09984a1bcdd5fe3e7ed93b55d98f34192797cc627cfdf51d9418f9ae12caf0b04c6f6a789feb02ec23d2635c76f9ff4e5ea87b104d63c020ae3c0da
SSDEEP 3072:Zj5CR3ZESnlMGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Z5CR3ZEcm7Rkm1tYpBeh2BAog
TLSH
T148F3123F5CA9AD374D95B79FA1CE0B1E2AF20567D834DA42C8E86D0832FA78D1641934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5873df234dc10455d2bb351522ae680fb327858280bb8113e4465ada70ad93b5
MD5 f6630b227f5f66207ddd5435c43336c0
SHA1 7c19aeed5f77509711afb78de2876726f53f9072
SHA512 cad25883bec0d5ea270d88800d2885ac0b5607406c062b8eef12e99f7d05642afb748b77185216b1b1f529dd48006ffc830fa9dbc9bec4bbc45533daecb27d5e
SSDEEP 3072:AKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:em7Rkm1tYpBeh2BAog
TLSH
T155C3023B5D75EC3B9DB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download