hxxps://brattleborodevelopment[.]us13[.]list-manage[.]com/subscribe/confirm?u=24908e89d2558e99e0beef2fe&id=b3f2a7a941&e=a16e7f4947

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://brattleborodevelopment.us13.list-manage.com/subscribe/confirm?u=24908e89d2558e99e0beef2fe&id=b3f2a7a941&e=a16e7f4947
Sample260826-17zvbaxcra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322563040157113"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 5088	3352	chrome.exe	85
PID 3352 wrote to memory of 4700	3352	chrome.exe	86
PID 3352 wrote to memory of 4700	3352	chrome.exe	86
PID 3352 wrote to memory of 4324	3352	chrome.exe	87
PID 3352 wrote to memory of 2888	3352	chrome.exe	88
PID 3352 wrote to memory of 2888	3352	chrome.exe	88
PID 3352 wrote to memory of 1108	3352	chrome.exe	89
PID 3352 wrote to memory of 2936	3352	chrome.exe	90
PID 3352 wrote to memory of 1108	3352	chrome.exe	89
PID 3352 wrote to memory of 2936	3352	chrome.exe	90
PID 3352 wrote to memory of 4584	3352	chrome.exe	91
PID 3352 wrote to memory of 4584	3352	chrome.exe	91
PID 3352 wrote to memory of 1008	3352	chrome.exe	94
PID 3352 wrote to memory of 1008	3352	chrome.exe	94
PID 3352 wrote to memory of 1840	3352	chrome.exe	95
PID 3352 wrote to memory of 1232	3352	chrome.exe	101
PID 3352 wrote to memory of 1232	3352	chrome.exe	101
PID 3352 wrote to memory of 2136	3352	chrome.exe	105
PID 3352 wrote to memory of 2136	3352	chrome.exe	105
PID 3352 wrote to memory of 8	3352	chrome.exe	107
PID 3352 wrote to memory of 1840	3352	chrome.exe	108
PID 3352 wrote to memory of 2884	3352	chrome.exe	109
PID 3352 wrote to memory of 1288	3352	chrome.exe	110
PID 3352 wrote to memory of 1288	3352	chrome.exe	110
PID 3352 wrote to memory of 2364	3352	chrome.exe	111
PID 3352 wrote to memory of 2364	3352	chrome.exe	111
PID 3352 wrote to memory of 4820	3352	chrome.exe	112
PID 3352 wrote to memory of 4820	3352	chrome.exe	112
PID 3352 wrote to memory of 1108	3352	chrome.exe	113
PID 3352 wrote to memory of 1108	3352	chrome.exe	113
PID 3352 wrote to memory of 4228	3352	chrome.exe	115
PID 3352 wrote to memory of 4228	3352	chrome.exe	115
PID 3352 wrote to memory of 3916	3352	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://brattleborodevelopment.us13.list-manage.com/subscribe/confirm?u=24908e89d2558e99e0beef2fe&id=b3f2a7a941&e=a16e7f4947
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7618c728,0x7ffd7618c734,0x7ffd7618c740
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,12366467486158281660,16047377435923750932,262144 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,16353628913416961618,4480210333174402786,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14499936518811525844,4032366402768665611,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,351491701401767917,6958686337030693164,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,4569087559540629360,5513856515533217219,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,15825331852015258826,17971360421341481390,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,6937480295634140829,2625463272359617475,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,2101157193344500095,6037687480769093975,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5544,i,4088016890244507625,16560568175498771953,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3864,i,1108046866159140579,10179454728433191137,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,1087725100225537468,4913990508758240445,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,12071920648211767818,7874200516189929585,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3164,i,16575296431819161410,7997690022458912439,524288 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4268,i,5703626162571194786,10735253248599656362,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4736,i,15247076486931361507,13291723771829607777,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5492,i,14725136974551588191,5554512187831041035,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5528,i,8081158843765587196,7745384495011950787,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6192,i,13100285370642897504,14308316143778954783,2097152 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3320,i,1227450342503189496,2406047590483770379,262144 --field-trial-handle=2004,i,18239287099286924623,12697107150684314476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 02077fe77992cfa433f69049281a7c3c0767e6d95a5b74f2da76df02022aabeb
MD5 bbccac17c3e571921dabcdcd05cf373b
SHA1 1cea6d4a62c90cb4520a4dae5197ab5d59b26cf4
SHA512 a7ff3309ac5730b4a90ca748bdaf2064f0d799e2cfbbc470b7cb7a38c6e3a833b332f7b94bd946aa69f63f7625f2f5600c45c4fad11c19834d55127e55ab89f8
TLSH
T153E02BB9CA21AE2B18FD072964580747E654231B2B41456F7F3D86098FB9636159AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4bd095dab41f7d1a4e782288c0bffac46fd92799ba06d08069a6888882a45d6a
MD5 f4a7cdc526093def84247f5126c888d9
SHA1 074e1bd1a436c35d2e0abd8bb15f9bbd79d3599c
SHA512 1194fd5e8fc70d37dfcffd81f5f03fd826eab114df516cf509dc6167d66217b0ee0c0ad46b5799ae125b026d07b008e57a6d78387213e00e4d12232d20966e3b
TLSH
T1CA212E019B5E0050C37C8E7010E7C3247F3FD756EF037D6B298694B134A435E56134AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fc42e14134f6452d5b0eaccdbfa31ac60d5acde516497320384d48639ddfb553
MD5 f4081e1b85999079909d6431c0add431
SHA1 00948f0375d327d13090c053ed720093f14686b5
SHA512 ef8c1e268e26ae115fe12b53cfcb44ddba97433ac2554000f90624bcb8063a517c2097b54f7986ea11e0044e1d1a241846eca171e9b1db8ec3d19f90de3d5381
TLSH
T1C5717EFB83F8896E891192F5E7156E1FCE6A0514432C7966C8D46E5B93F2871D10068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b6f8d372c52fcffa5d8c2c16c356f204c7dfdbdeee685ed66065b7df4a56151d
MD5 141639994a97304b2a740fa3b3a936cd
SHA1 d81cead5e03a02559cad85a97064f766eb5385a0
SHA512 6285b1cce0f2694e17a22f70778f3ba71b97cdd8830d426fd607f877e8ef25163555275147a97ca361bf2c7583a319a183a43f87067f6e66e21edc4ef50286b2
SSDEEP 192:wRyKvWw3aVPv72ympAPRp2eg95Hb7b+WNneWcNtbehRe1JT2CQVyIsnAUge:wRyKewOHQUXg7N/sekJT2CUe
TLSH
T16E42D82EAE10697B9CDBD229FD217757D7F5106625D01E80EAFC8A2C14E76CC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c30a7a95958c2a2409f83f5463a23ab16bf58b66967d1ac203efb8a4c1611e3b
MD5 0adcefb989542f4639fa11e7d07b5961
SHA1 354429976b8741ccc501b182959f8b92d2d4cc53
SHA512 62492b055adb6a090bd9751164e4daf2929d579695084c93a94ae827f2a6e0e4669622743051362d9d5ee68354bdad27dcf1587f86c7dee5226b8dc3cae84e78
SSDEEP 192:wRyKvWw3aVBv72ympAPRp2eg95Hsb+WNneWcNeU2cRe1JT2CQVyIsnAUge:wRyKewORQUXg7w/A2HJT2CUe
TLSH
T14342E92EAE10697B9CDBD229FD217757D7F5106635D01E80EAFC8A2C14E76CC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 70186deff99314e01bb73bd1f4f0441842eea41961054d1c02d0e798a2222822
MD5 822ab1e0fc378f1479c88256ce9988af
SHA1 dcb86403b1accdbdf77463288f92a3986bc4e45c
SHA512 3fc57d1b119f05de0b4293fe7a9a2e7aee339931e8656e2b5e6bc79bc3cb0c10aeaec60439c311a2d17ee0e4dc2b6c4a1bcf8b1d6719550a6ea0a1d559df42da
SSDEEP 192:wRyKvWw3aV1v72ympAPRp26ag95Hbnb+WNneWcNtbeiRe1JT2CwVyIsnAUgE:wRyKewOFQUXz7x/seZJT2C0E
TLSH
T1A352E93EAA102D7B9CDBD229F9217757E7F5106625D01E80EAFC8A2C15E76CC321B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ddbdac39b7af2edb33ea64060a5455d10a08b7432036809d7e14bdf8ed88155f
MD5 2f650e09afed90dc627cb38c000f9c3e
SHA1 c1aa8b5bb4868aacb93506e2866670ab650244f5
SHA512 c5e07b522b673a4ccf78ed7690bdb0c51afc81cf87314d491f124a985238531de2fa98eb772212c294a8498ff83922ebfb092cd70594f41ab6656f627f57bccd
SSDEEP 192:wRyKvWw3aVyv72ympAPRp26Dg95HbHb+WNneWcNtbeiRe1JT2CwVyIsnAUgE:wRyKewOeQUXk7x/seZJT2C0E
TLSH
T1C152EA2EA9102D7B9CDBD229FD217757E7F5106625D01E80EAFC8A2C15E76CC321B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0abf8e7407f5007b7b96e8e0d656ca45232d8848fb39c168953a47821a0580c1
MD5 c4a8f6caee77484ba99699f79fc259cf
SHA1 f895dce74155a97cdbc479cf23d2d66ab2b6b809
SHA512 a8588edee78e498c5ac2bc328fb93331abdcac79f72f93b162882df4202b11440441a07bcd408e125f1a3ce20ed6a941ecf06cf08eb651aceb8460c18d2ef3bb
TLSH
T141B0128084416111E04302B0159754C871285F209B0A170543E06922D835962D024090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5865aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5865aa.TMP
Size 96B
SHA256 904b9b8582e026a411308244752a274a41354200178e1e9f130c6e79d3a4fb90
MD5 6fe3bfbadc13bf35c6057800ae3b1ed8
SHA1 5f6ee02f7d0d14f6f23c0e49f7a04437bc8d4d8b
SHA512 a930c7cd3a76555301ebdc7f6f6351665de8b510ea0712e39a6bf9becafeb40a63b304bcee98c57f14622b34699cc00c0a715dc25c731cd1d283aa39bc61cd06
TLSH
T1A3B0026AC1466222C4C303B026D697DCB2E4EF67CA03121292E01A77EC356B29975770
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 58651d207f6cf50469b77ba2a8f1bf743b5974b676ee42462a90a0e82c83b458
MD5 17ccd1e2e62f9db456343aae1847f8a9
SHA1 ad1a042975cfdc1a76dfb5418077520ad6d8d83c
SHA512 fea9d552f6fe39e2a5b87ed85221b3cff23e8b339a09efeb668193e7f941368d48580d7eeb56240828fabd65c31dfc716f0fe22bcf39183fb72265e37da548f0
SSDEEP 1536:7/9yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:7jqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15CC302379FC61E339DD2DB70B9130E9B93F604A99034D305EA6D6BAB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 54da958d5013c8bdd8c23a0d063acbb4f1f597af8c3c97eaf57d36b1efef3f26
MD5 10ef818997f64757fb55ea37c1be4e15
SHA1 bfe752a11e9d751795dda27751aa888a8238e0ec
SHA512 fc1d38f206b076e008f686a2bf3b8651597448b8d54fd7a2e34f5ea2da748ea80b343dce3a0bf427f1767fab86ff2779de2f06abe2133647fd6d56163d5fc350
SSDEEP 1536:TKQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:7qfd7NtZL8cHQRZEQ6Spsk
TLSH
T149C30237DBC21F339E96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d1cc589607c29f812f0af33bc819dbc40d797002ef654205263245689da3f2d0
MD5 851379b0d96020bedaad4a5457f50750
SHA1 70b66f9f9956fc81ac00ced8d6d34cc8ebe73f19
SHA512 6733c98e831a48b8529b9c7556a35deac1688954a4b054d72edd8d55a43ff1fc583bca6671ffc2e0b74a3ac09a147d1feb0c9deb785ce17efda6e7b4e9d34adc
SSDEEP 1536:7DxMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:x2qfd7NtZL8cHQRZEQ6Spsk
TLSH
T19FC30237ABC61F339ED2CB70B9130ED797B544A59034D301AA6D2BFB6C83895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2270ecb73d720f47e9f3557ae9bf89a16f97a10811bdb6cf5f7b57688064b5ce
MD5 25fd5ac8c6dcd0723bb84dbe7b2e8a8f
SHA1 33176176e4dd69819f796eacbae4369c5c3f3d42
SHA512 9bbe9fab786a8a1109ac1cc3084e99fca72c7cd6319d96b70f547551b49829f3ef994bcc0ef70c0c3a7dbd0d9da3cde686731569ba47b780c5beac0b5ac87c6e
SSDEEP 1536:WDxMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:82qfd7NtZL8cHQRZEQ6Spsk
TLSH
T167C30237ABC61F339ED2CB70B9130EDB97B544A59034D301AA6D3BFB6C83895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download