hxxp://url4381[.]lulacommerce[.]com/ls/click?upn=u001[.]Pj7hHPPGrvMWFwOcQhsW-2BOYBjX6f8myJPBHAZbxzaCRKIiy1r4zuDLsHuF8pATH5k7VLJIeYO8xYB-2FGA-2FqNkDHJQN6b4mY5JhQWHRGvV6WVGuB3fo-2BQhItszLekXoZ8LH0dZn9Kj9r7gRzqYd2q1lrFzM2V80WAw-2B2FzvGxoYecqNKotiNsPrza-2FqoLWC3eGSjId1PZlo4Qr-2FcmeJzn6V-2FR7ClRVNdGR3OFegrp8y0f33p7SYklCTtmYWig6-2B47ml8hB_vOWR761wt7Ng5kkNc0odvhomz7o22xyU-2F9iG-2B-2FLG8xQ0wZbocbihv2NnRc-2FmQR0Ac5nbBNujiTxCDRsT9FSug5hCBqkBW21TmTDS2yxX-2BiSE9tVFnGib-2FuEqUQPcBK-2FXAG8PW39wLpgarLR-2B3aM7Li0G-2BCh4As9kPup-2Ft0mWXKypO1KKhaYoRIqzY-2BuMpmFqBLb1cWCcL06H6Kb2nMeQDA-3D-3D

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url4381.lulacommerce.com/ls/click?upn=u001.Pj7hHPPGrvMWFwOcQhsW-2BOYBjX6f8myJPBHAZbxzaCRKIiy1r4zuDLsHuF8pATH5k7VLJIeYO8xYB-2FGA-2FqNkDHJQN6b4mY5JhQWHRGvV6WVGuB3fo-2BQhItszLekXoZ8LH0dZn9Kj9r7gRzqYd2q1lrFzM2V80WAw-2B2FzvGxoYecqNKotiNsPrza-2FqoLWC3eGSjId1PZlo4Qr-2FcmeJzn6V-2FR7ClRVNdGR3OFegrp8y0f33p7SYklCTtmYWig6-2B47ml8hB_vOWR761wt7Ng5kkNc0odvhomz7o22xyU-2F9iG-2B-2FLG8xQ0wZbocbihv2NnRc-2FmQR0Ac5nbBNujiTxCDRsT9FSug5hCBqkBW21TmTDS2yxX-2BiSE9tVFnGib-2FuEqUQPcBK-2FXAG8PW39wLpgarLR-2B3aM7Li0G-2BCh4As9kPup-2Ft0mWXKypO1KKhaYoRIqzY-2BuMpmFqBLb1cWCcL06H6Kb2nMeQDA-3D-3D
Sample260826-2pexvsvxas

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322579175582690"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4764	4728	chrome.exe	85
PID 4728 wrote to memory of 3104	4728	chrome.exe	86
PID 4728 wrote to memory of 3104	4728	chrome.exe	86
PID 4728 wrote to memory of 4528	4728	chrome.exe	87
PID 4728 wrote to memory of 4908	4728	chrome.exe	88
PID 4728 wrote to memory of 4908	4728	chrome.exe	88
PID 4728 wrote to memory of 2084	4728	chrome.exe	90
PID 4728 wrote to memory of 2084	4728	chrome.exe	90
PID 4728 wrote to memory of 1184	4728	chrome.exe	91
PID 4728 wrote to memory of 1184	4728	chrome.exe	91
PID 4728 wrote to memory of 4436	4728	chrome.exe	92
PID 4728 wrote to memory of 4436	4728	chrome.exe	92
PID 4728 wrote to memory of 2216	4728	chrome.exe	98
PID 4728 wrote to memory of 4812	4728	chrome.exe	106
PID 4728 wrote to memory of 1680	4728	chrome.exe	107
PID 4728 wrote to memory of 3672	4728	chrome.exe	108
PID 4728 wrote to memory of 1984	4728	chrome.exe	109
PID 4728 wrote to memory of 1984	4728	chrome.exe	109
PID 4728 wrote to memory of 2324	4728	chrome.exe	110
PID 4728 wrote to memory of 2324	4728	chrome.exe	110
PID 4728 wrote to memory of 2864	4728	chrome.exe	115
PID 4728 wrote to memory of 3868	4728	chrome.exe	116
PID 4728 wrote to memory of 3868	4728	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url4381.lulacommerce.com/ls/click?upn=u001.Pj7hHPPGrvMWFwOcQhsW-2BOYBjX6f8myJPBHAZbxzaCRKIiy1r4zuDLsHuF8pATH5k7VLJIeYO8xYB-2FGA-2FqNkDHJQN6b4mY5JhQWHRGvV6WVGuB3fo-2BQhItszLekXoZ8LH0dZn9Kj9r7gRzqYd2q1lrFzM2V80WAw-2B2FzvGxoYecqNKotiNsPrza-2FqoLWC3eGSjId1PZlo4Qr-2FcmeJzn6V-2FR7ClRVNdGR3OFegrp8y0f33p7SYklCTtmYWig6-2B47ml8hB_vOWR761wt7Ng5kkNc0odvhomz7o22xyU-2F9iG-2B-2FLG8xQ0wZbocbihv2NnRc-2FmQR0Ac5nbBNujiTxCDRsT9FSug5hCBqkBW21TmTDS2yxX-2BiSE9tVFnGib-2FuEqUQPcBK-2FXAG8PW39wLpgarLR-2B3aM7Li0G-2BCh4As9kPup-2Ft0mWXKypO1KKhaYoRIqzY-2BuMpmFqBLb1cWCcL06H6Kb2nMeQDA-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec4dbc728,0x7ffec4dbc734,0x7ffec4dbc740
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,9435556555729025049,7835789178370791579,262144 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3710673095735553002,15984127600272430028,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,1749970910994535848,2570665388381524392,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3028,i,7843520939182424547,14057992593744998313,2097152 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,9721623544250686685,12593628616195681245,2097152 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,1210683784604047497,14656834312797047261,2097152 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,7113291505489732148,15974842674969394813,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,6569571379006484793,8069943404073677746,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,15503125298135170629,11050966721096540620,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,14143313130580459574,2743783161845816013,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5572,i,10700776169967030044,6405988327621719708,2097152 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3348,i,4525363435624387609,8121811827503781373,2097152 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5768,i,4916842803650706428,8680023558592586930,262144 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,11971279860809237202,9688967003376391308,524288 --field-trial-handle=1976,i,17161957516425933582,17953294636289861914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:3868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a2d7825887a4b2a126a6e379e94e4cebf8c6fd0f0da72d763001f62ede0f20f
MD5 32219ca3c656e7840ccb8b5520775793
SHA1 d320bf146d86867d91e0a49804fda340faf73135
SHA512 81e8717ffecb8446dfe9682a94140a861a641cbbd9f927062f83d7714494c7e031b353ec63a833b53af018902fca47e07a7d3ff3deb3e306a7595ac3699f1cf8
TLSH
T1C1E02BAECD61DC371CFD071C9450574AE65413473640888F3B3C84188FB523B439AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 770c56b8453c0c22126e0a04fe02792f92effc31b06645721404bde117dc9d88
MD5 d68ca863fcddb66cfa1f5b390b02b331
SHA1 e0916fdbba359c05c9bd1e90747a6497b19ce329
SHA512 4de20c0c5bb7920968900550ceddc1a1d88a84c309734adfc35c5c087177df629e202b5d559f7701854ac989a1dce6ba7698101950718d6d7ef49a9a6ddcbfcb
TLSH
T139B0125021E21101EF0716300D02244B21BC3E7C50283323C3E01CC550126F14307D63
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b58eabab01f6c3ab352e5ba65757352c3b648b4e646bc17e640531c5e9aed930
MD5 9d99195b360738d09a54c87929ea85ea
SHA1 790047fb961b2e758018654cb8ec393dcd606164
SHA512 bedb744a10b4fdb3bc910097d7b5c2cc3abb9e4785512647986cf1787fcfa63813774a128473f56cc9750fb4b018bd4a08ce340a8154623bfd31914f7f6408f2
TLSH
T19771EEF793E8956D891259F4EB15AE2FCE2D0928432C3C66C8D4AE1B83E2C71E10064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6854f00f76de788555cfda255dbdaff99df8068419fb639c5771c4517ddc58f0
MD5 0d90b957a67fdbbc9557cba1bd82da72
SHA1 086fad29d34d390087a63e6697f69c14a4e8322f
SHA512 452dacc42a40e1eb86a7098346c0c972591058636ff16edcf1050b3da6426c2e2bff691fdcfb268b6ebe54021116e3ac516dc02edd6945c35465f4490a7ae1c5
TLSH
T13461CEF7A3E4996D891259F4DB15AE2FCE6D0929432C3C76C8D4AE5783E2C71E10064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79a37a32e38e88da76fb3791670872bd49d683f3308d2a36e35a02823c8362ec
MD5 bfc652cbb363486d89917b30ccdba4fb
SHA1 8f062ea348e2dff93b411c955b100e4b1a4fe5dd
SHA512 bec117752efe9703c11ad36f8713a0121596abf5f44e0359cfacda004e4f39abbb8dfe9181f36a9371ce58190d343bcd0a7e546b6902011d5a86f7126537b1ae
SSDEEP 192:5RI1p57TvMZavrvFVVQrv71hpAPRp2g92HpIYb+WNnIbQPrdS24J6ddVyIsnAUge:5RmpkCKBhUXDQTLPM24JEe
TLSH
T18342B32EAD10A97B6CDBD22AFD217B57D7F4102521E52E84E6FCC92C14E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aaad60e6bed6a4e4f5c6225a55df67092d18594b9d03ca10e88a6ccda9b5056a
MD5 1a65150f3abf7880b263cabb1602f61c
SHA1 baca57669cfcce38e96b075b568bf02497eba000
SHA512 71906ddf97a4c4beeb9463a5350d558dda979bd4d5ac809a278c6cb0f84b085649a6b81b79fc9b85f31b16f7d5f221b1fdf312627c121840868e82e10c831347
SSDEEP 192:5RI1p57TNMZavrvFVVQrv71hpVPRpkvv92HpIYb+WNnIbQELZ2IdS24J6ZdVyIsv:5RmpiCKBhLXmQTL+2n24JWE
TLSH
T16B52B42BAD50697B6CDBD22AFD117B5BD7F4102121E11E84E6FCC92C14E76CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b16a5256c0e8ba5c7db69d70024cff34654b5b36403421ba7ff8ee72c329d7b6
MD5 3c62b48d21b647c1623bb612d68d9455
SHA1 92b47af260912a10a8984455529a5547c24af1a6
SHA512 e92a733163053eb99cb223708d3db172e91d3ef79dc04babba025e30cf9851f63cbf0a48c1affad752c53b402d49f9298ef03e47c36b4a1983293a01b34e44ea
TLSH
T1FBB0120185019542C04202B02282148C7164DF14EB0B170243E06E33CD251A18425151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587e14.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587e14.TMP
Size 96B
SHA256 d283d01b811f11701eb4e84b0acf51c8f0d2e3f044852c28effd9738e40d8ac1
MD5 22af93090aa91d1023d69f032084ef89
SHA1 2168a372d1e636a24f564cf615e27dd2b4c27fc3
SHA512 e9302218185e83d918a70dda8bad954449e7d9b5a457652cdffc687a3d920c91148cbaec9ea54be6e7127eed6b3a0c46f4dceebc102dc1a3a7131ca174818bd2
TLSH
T13BB02200C2022202C003C3B0208080C830B0EF2EC383030382E00A22CC28BB20022020
MD5 SHA1 SHA512 TLSH

Submit Download

d6ef747b-2c48-4a07-95fc-eb4eb23a6fda.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6ef747b-2c48-4a07-95fc-eb4eb23a6fda.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 075e4d624d9f2a0d3c115feef18cc1ace95bf9a4bebe4f14dbb26eaf3838d538
MD5 22770729d3a4488dc6f6f6faad688fe0
SHA1 95c876a36d32a34bb2433aefb5c6c03c7292ed66
SHA512 211a4894b5e0dd978e3cfa764559a1b00d10ede5a8aae3d377abbe595e9ac94fc943ec2cb69681b10311d59af004e5d7c40eb02700042f99e65287ea144380ad
SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:mm7Rkm1tYpBeh2BAo3
TLSH
T147C3123B5D75AD375DB9BB0EB08E0B1F1EF14AA6C9209E92C8D85B0427E97CC1A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 bca30505b01deaf752f8ac8878acbb21166293f99071c61665f48f107140921c
MD5 730e18046faf7c19f82307ff6e38ede1
SHA1 a10f29bc77f3d06aee9358033c98444339369add
SHA512 007bcff2f16d5a818de00aaf3dad9929239fcb6a2a01c899a7af51264f3a0d9d6e6879db2db9dd8b1601ef0f62f1f8bbf1d4ef15af2ee57e520104e879e1accc
SSDEEP 3072:SfQrXiE9uXOuFDqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:SfAXXSpm7Rkm1tYpBeh2BAo3
TLSH
T161F3127B9CA6BD3B58B5F70A748D0F1F1FF20AB7C5249E45C8C84B0027BAAD95945834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 72e0d2a601f207af37aaef4cd454b30f09f7ff2400a1f1e4fa169276f42b0120
MD5 6cd231d589317eaf7f78ef4e0955ad64
SHA1 5cf21cd18d416de9899b968dedc3bbcf6dc6d170
SHA512 f5fd1893a6bfff10197ec554be50f9fc87ae04418f9616e1d5848ff9e188c6f1146ca3335935c948c7607b23ca9b7a1a2945f1fccb8e399a21fb9ecf57a1216c
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:6m7Rkm1tYpBeh2BAo3
TLSH
T159C312275E75E9375D79BB0EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ba3508c722b8acb8e4d26f4e88171b5efb57e0141856a38146014cb4fd0f556f
MD5 9f75a79242325b3b855dc7442d543546
SHA1 bc5c0e2eeef2ad7641589e8d7646a62dceb856f1
SHA512 9b9562a68efac38408060953b0c39c62fdb97f5b2663ab8e8919d165c2a2839cf46e36bf2218327e307394dc3c488a4d1482d1b747d507f83c391a0fc6866eb3
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:gm7Rkm1tYpBeh2BAo3
TLSH
T144C3122B5DB5AD375DB9BB1EB04E0B1F1DF14AA6C820DE92C8D45B0823EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e69f7660a6bfc89dd8e472cf483b62b97d5e695163a94f06634516c36c3f7aaa
MD5 89054d63a9613ccac924447d301de2b4
SHA1 3575e7a3064c5353e0cb1fc7342c7c63c36ae9f1
SHA512 75272aa2b86392981daa78670c5b692787ae5cc305d51cfe21fb60c733d28d703087909a89b6803a1f69e55b776f0f1ad0491aba2781746b96afcec8fab668d9
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Fm7Rkm1tYpBeh2BAo3
TLSH
T1C6C3122B5DB5AD375DB9BB1EB04E0B1F1DF14AA6C820DE92C8D45B0823EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download