hxxps://jaltreet[.]com/on/index[.]html?data=onkar[.]chaudhari@relbio[.]com

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jaltreet.com/on/[email protected]
Sample260819-plbd2stfng

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316159166365184"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
2508	chrome.exe
2508	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1960	1908	chrome.exe	85
PID 1908 wrote to memory of 2072	1908	chrome.exe	86
PID 1908 wrote to memory of 2072	1908	chrome.exe	86
PID 1908 wrote to memory of 3888	1908	chrome.exe	87
PID 1908 wrote to memory of 4856	1908	chrome.exe	88
PID 1908 wrote to memory of 4856	1908	chrome.exe	88
PID 1908 wrote to memory of 548	1908	chrome.exe	89
PID 1908 wrote to memory of 548	1908	chrome.exe	89
PID 1908 wrote to memory of 4412	1908	chrome.exe	90
PID 1908 wrote to memory of 4412	1908	chrome.exe	90
PID 1908 wrote to memory of 2376	1908	chrome.exe	91
PID 1908 wrote to memory of 2376	1908	chrome.exe	91
PID 1908 wrote to memory of 4192	1908	chrome.exe	98
PID 1908 wrote to memory of 2716	1908	chrome.exe	103
PID 1908 wrote to memory of 2716	1908	chrome.exe	103
PID 1908 wrote to memory of 2712	1908	chrome.exe	104
PID 1908 wrote to memory of 2712	1908	chrome.exe	104
PID 1908 wrote to memory of 4300	1908	chrome.exe	109
PID 1908 wrote to memory of 4300	1908	chrome.exe	109
PID 1908 wrote to memory of 2380	1908	chrome.exe	112
PID 1908 wrote to memory of 4552	1908	chrome.exe	113
PID 1908 wrote to memory of 1056	1908	chrome.exe	114
PID 1908 wrote to memory of 1388	1908	chrome.exe	115
PID 1908 wrote to memory of 1388	1908	chrome.exe	115
PID 1908 wrote to memory of 3488	1908	chrome.exe	116
PID 1908 wrote to memory of 3488	1908	chrome.exe	116
PID 1908 wrote to memory of 4412	1908	chrome.exe	121
PID 1908 wrote to memory of 4412	1908	chrome.exe	121
PID 1908 wrote to memory of 3048	1908	chrome.exe	122
PID 1908 wrote to memory of 3048	1908	chrome.exe	122
PID 1908 wrote to memory of 2184	1908	chrome.exe	123
PID 1908 wrote to memory of 2184	1908	chrome.exe	123
PID 1908 wrote to memory of 4904	1908	chrome.exe	124
PID 1908 wrote to memory of 4904	1908	chrome.exe	124
PID 1908 wrote to memory of 4008	1908	chrome.exe	126
PID 1908 wrote to memory of 4008	1908	chrome.exe	126
PID 1908 wrote to memory of 4448	1908	chrome.exe	130
PID 1908 wrote to memory of 4448	1908	chrome.exe	130
PID 1908 wrote to memory of 4188	1908	chrome.exe	131
PID 1908 wrote to memory of 4188	1908	chrome.exe	131
PID 1908 wrote to memory of 2508	1908	chrome.exe	133

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jaltreet.com/on/[email protected]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93b33c728,0x7ff93b33c734,0x7ff93b33c740
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,10986315636359319821,293307139513783616,262144 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,16125667472776488367,409588438679341018,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,9901889428153006441,6536623200961553952,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,10884963913190733022,11599783763686786138,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,15943017331969651915,9113932655816376425,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,13017108753260193351,6511347667463546536,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,7341255136889237413,6924183140011834491,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5512,i,7728798583358095722,764169897969602966,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3916,i,13756910003192306167,2081773760614228225,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,10512967757964106475,9789810598087738921,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,15518344816373668263,395467552045781699,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,17808161658170227189,12593263483333237887,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,5845207360197418277,8813877147884206699,524288 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4388,i,10471903253230040189,17844251543645449998,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5432,i,17547710870112306679,9071046461150271419,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3472,i,1395804145892560687,6548363657279461142,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5436,i,7476620628741675562,11609340568036745407,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4496,i,5747741034487116075,7626186891211843200,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3448,i,5444464415225618108,8849619935587248207,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4488,i,7202215837212456678,9872314632535389754,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5496,i,3042053596509786541,5200480363054939920,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4428,i,3905089422802736140,15395820161903782174,2097152 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3432,i,15685651909722650527,16430845747622020422,262144 --field-trial-handle=1948,i,6962712867365577501,10961558098394523099,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9b61df33-ab27-4257-8097-ebae0fcc06b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9b61df33-ab27-4257-8097-ebae0fcc06b1.tmp
Size 115KB
SHA256 c0c664e1bfb19230ac708bbc9f08aabda7e3f878d53ba9a1b762375554946f35
MD5 3923710847e60ddb887a7984d706b724
SHA1 d8a14cdd8ceeeacc97a77bec1eebc74c83fcd654
SHA512 6abe85ef83f402a2f5ff3dd78453c017519bdc63e3573dabd71da73d695ee12c9b36356df4fc014a6fde098fc9ae5c9fab7de8f7538618e6f2338d30811e68ee
SSDEEP 3072:/eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/5m7Rkm1tYpBeh2BAoM
TLSH
T1EBC312275E75E8375878BB4EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf1290be4f91059d3ce4f271604eb47a596c46383884ff5e888494c2ec183f1b
MD5 3eb80fef70c2e3427c7f8dcd5057283a
SHA1 a8be88ebbf4e6d95d2b46a08cbd2b356dbb3bfe9
SHA512 4a70349ef3752fa8edbf229c3a5642f7fe8498f001113b3d3614043c38657db773e965eaf853759c8ffe166ffabb94e4a9c0181f0e5f854fa173a887ad768a28
TLSH
T1E7E02BA5C962FC3718F81718A865870EE75213A726409D8F3B3D400C8FB477A418685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c1d92f657c3d0b1252d4ae71fb5283502efec05c774727ffa5e3ca775616a3fe
MD5 e3cb724da435c11258899fc64070f573
SHA1 a1385ee483125a373f8a0da48fd73f1ca703303c
SHA512 0a840f482a627a7ec93c6c501f293524ebb5859e14389599d4dbc526048f015850096db7728a64b91214ac1ed85920ac2060067f513f67b8acc62e70094fa971
TLSH
T1DD416CF797B4997E861192F4EA156E1FCE790924032C3CA689D46E1B43F29B2D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 975eb9b04a1966651e05f7abd74d0e4a6acec08990ddb6e850acec779459ac6d
MD5 5f8a7513f4a03b2ba03ebca46c55e353
SHA1 699598cdfb8df6cf06b71c963a6a7fe2b01e0547
SHA512 1d82f422497952e2c2766a89194e464f7ed2ebc614407448624c9bc58dad7c85bd2cc69a0947b1f5a9965082da96216c300d51115f6bfa7be45b4d84b1db0d47
SSDEEP 192:FRDlUH+Uluv7MF+pmPRpjew9HHsb+WNnUZP2zkmL2WFmVyIsnAUgE:FRDlChKgo+X/1wiP2wmL2WcE
TLSH
T11552A36EBD106D7B6CCAD229FD627B57D7F5203121902E84EAFD8A2C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d072e7fbaecafad519198c1a765c4d2aa42a4c2c89ef827acca3df083153efc5
MD5 c0ae4ef24e70002cb92a9c8f2608d996
SHA1 9e50280447e3d5de514e5c1b7a5e9d5daf65b214
SHA512 9c9614fceedb92d56dd843b264f5134bf4e234c0e3ff393b755c1f67b33b3168265b6e27280a2624a645b79dc0ed6485242fed368dd2f183dc894a9cad642907
SSDEEP 192:FRDlUH+Ucuv7MF+pAPRp2S9HHsb+WNnUZPakmL2WFQVyIsnAUge:FRDlCAKgoUX91wiPzmL2Wie
TLSH
T13542B22EAE106C7B6CCBD229FD627B57D7F5103121952E84EAFD892C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 47cc12ac5f6fb18dd93614b893cc5b1de025ef90f27e7cd7d9353695afb414d1
MD5 2e6fffd710d2c72a26462f429f5a5b82
SHA1 66d763607ec4749b781beec7f2351ab8c2ca3f30
SHA512 81405310d1bc4c62c78121f9c3fda81c45bbe0aeae31ad8980485a27f4afac242a895c29143f4f3cdeefbbbed2cd8f9465d552b0555a5851ab0faad2178cda60
TLSH
T1CAB01210C0015601C4420EF411821488B5649F10D70E570153E06962D8255F28015051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b793.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b793.TMP
Size 96B
SHA256 de180a222539d60c9f06476fb8a58499dbef25dc605b8dd5d4cb54648724f6ab
MD5 33e3c64fede05e6dc66c560c9f67e0a5
SHA1 7d95f50e07b2210bee5bf2c4a2f6c8f44ad94288
SHA512 eeb1ce33a649d9b12721b2c5e07d23139c7b1dc80087e87685e35c32d6c697cce6a92fc2774d50ae6b684cd4524da55d4bf6ca5a56644c22cf60c5bd5187ba15
TLSH
T1EDB00256D1026312C05203F0A5A695DDB1B0DF2AC603369793E01EE7ED76671A9396B4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 13a551fa6cfc26143ab46b989daba6c79d561733efdd87b74752877dacc20cce
MD5 2ac85680159f7ab2d8aaa9df18b8695e
SHA1 9778b9c2b7ebc1efd382861232194d1de565ccd7
SHA512 dbbb9039adf9da93af6e1f99a1af3753bdb7e50bd85a881d8aa0fcab2a443fcdba08b55618746717cdfd7cd3743ab0761d8711eb5507bff98dc78849a8dea03b
SSDEEP 3072:AEEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Acm7Rkm1tYpBeh2BAoM
TLSH
T115C302376D75A83759B9BB4EB08E0A1F1EF14AA7D830DE92C8D85A0433F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b579f1f7e4378369369457b8d35e4cb3a75f194bec589a3c43f6323a8bcfe59f
MD5 728da902e8b5c989f4123e5311c2d6c7
SHA1 4814a5ffc3958aa2464693a7e6bdcf8110f089b6
SHA512 e504427f776be070c755aacdaa9b5d1a8d308e81d024fc24a8bd3314b62f7fcf6650e7cd811fc86c1ee92cf3713afaefa5c5f6dce6ca291e90d7d4969c5e238f
SSDEEP 3072:pBGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:pQm7Rkm1tYpBeh2BAoM
TLSH
T186C312276D75EC3758B9B75EB08E0B1F0EF149B6D820DA92C8D85B0423FA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5013f29e81900006968d14022e7878bb58f83c71a440b494f571c2c6a0fef42f
MD5 02bda3370f571ea46f2af38295ca2fa8
SHA1 9e6b484182c08fe7a0bb0bf19aed480ee6b5a412
SHA512 c499a6f1f0d0cb1d6ae0eb34c13663b6c5681a3a8913b310861bdfcbcf3c53277ee2dace947c1830ee66eb236c79241a9a8e4a4e384116a65f898f4be1437340
SSDEEP 3072:ABGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:AQm7Rkm1tYpBeh2BAoM
TLSH
T1EEC312276D75EC3758A9B75EB08E0B1F1EF149B6D820DA92C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download