hxxps://www[.]gizmodo[.]com[.]br/baixar/gta-vi

Resubmissions

26/08/2026, 00:32

260826-avzqnsfn8y3

26/08/2026, 00:26

260826-arksca1blb8

26/08/2026, 00:22

260826-an1z6a1bke3

26/08/2026, 00:19

260826-amgj5axwfy3

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.gizmodo.com.br/baixar/gta-vi
Sample260826-arksca1blb

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
147	628	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
628	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321776249023064"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
3192	chrome.exe
3192	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe
Token: SeShutdownPrivilege	840	chrome.exe
Token: SeCreatePagefilePrivilege	840	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe
840	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3864	840	chrome.exe	87
PID 840 wrote to memory of 628	840	chrome.exe	88
PID 840 wrote to memory of 4176	840	chrome.exe	89
PID 840 wrote to memory of 4176	840	chrome.exe	89
PID 840 wrote to memory of 1380	840	chrome.exe	90
PID 840 wrote to memory of 1380	840	chrome.exe	90
PID 840 wrote to memory of 3648	840	chrome.exe	92
PID 840 wrote to memory of 4892	840	chrome.exe	93
PID 840 wrote to memory of 3648	840	chrome.exe	92
PID 840 wrote to memory of 4892	840	chrome.exe	93
PID 840 wrote to memory of 5072	840	chrome.exe	94
PID 840 wrote to memory of 5072	840	chrome.exe	94
PID 840 wrote to memory of 4760	840	chrome.exe	95
PID 840 wrote to memory of 4760	840	chrome.exe	95
PID 840 wrote to memory of 732	840	chrome.exe	96
PID 840 wrote to memory of 732	840	chrome.exe	96
PID 840 wrote to memory of 3472	840	chrome.exe	97
PID 840 wrote to memory of 3472	840	chrome.exe	97
PID 840 wrote to memory of 4348	840	chrome.exe	98
PID 840 wrote to memory of 3352	840	chrome.exe	108
PID 840 wrote to memory of 816	840	chrome.exe	109
PID 840 wrote to memory of 4408	840	chrome.exe	110
PID 840 wrote to memory of 5032	840	chrome.exe	112
PID 840 wrote to memory of 5032	840	chrome.exe	112
PID 840 wrote to memory of 2548	840	chrome.exe	113
PID 840 wrote to memory of 2548	840	chrome.exe	113
PID 840 wrote to memory of 4232	840	chrome.exe	114
PID 840 wrote to memory of 4232	840	chrome.exe	114
PID 840 wrote to memory of 3284	840	chrome.exe	115
PID 840 wrote to memory of 3192	840	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.gizmodo.com.br/baixar/gta-vi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff8ae9c728,0x7fff8ae9c734,0x7fff8ae9c740
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,14884115141390462218,14082597538549559682,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,805711216114887412,13987361733308596971,262144 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,1823092425600269173,5606541561007888604,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,3251052951936223068,10269689541594084901,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,6349521843307015918,15116595478080741283,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,9540009507034440175,11162161749271295560,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,12313048776836494291,13840526879792676408,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4208,i,5657899582119230971,847984133674820143,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5060,i,6618300994006568601,12870673402054940160,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,12866391443454488433,1866949797174408904,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,15673170730577052361,2286229292044271216,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,8263832656048440237,18168850019688195156,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,8302000110928225092,517417192760416807,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5292,i,1696099027516095884,14794651679798593406,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4748,i,13511946950212932466,7678794257519172088,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6060,i,1147269523329180517,14744317223006044479,2097152 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,16505630176887065802,4494166202148458418,524288 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6260,i,2238883599449898298,4706985655362769455,262144 --field-trial-handle=1968,i,10953313403989083001,11821536226319803789,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7440906eaed114c55347d33352f33bb1d1bbfcb5c8d584f12c1bc14e87a27919
MD5 5b36ac86cc0301f5b9eb30d8c1e2ecef
SHA1 334a8b0a821fff6c61f23d98faf903ed26480eac
SHA512 11e0779be96559228cd749183fa91d7fc2d8c95babd954670adbacc6acbdf4ffa4557022a39e3dead02d4b1cfcbc2d2fb4ed29b5ab1de28c069e8c6db64b05e2
TLSH
T16FE02BA5C861EC2718F90759E0101782DB5913AB2A408D5B7B3CC11D8FB16364585D6C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 e392a48939f0306ea2999aee8b7c8262dfe772f5088c5df477af0f5b48a78ab9
MD5 c7b0b0860ad5d77a2418c5f6e0731ad7
SHA1 63d350bec7277bd52b31acf288e48448fab3bebc
SHA512 19d45caa288fc6fd2724e9fa5cb1ab855c569138788915fed46de6539217a131e40ad06e882a5f47f065f7ce726919baf50603cd174df6c7308151e5d6b5ac16
TLSH
T14BF0DF33018C83D2DBE01C305FF40D243F32090100738E2647EF367296637A01C00849
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 b1b33c55f42f3d70a654e33f9028be66ec217fb49e494e112d9d1cc4cd299c40
MD5 66301c76dd7df9225b903ee8f9be5e30
SHA1 ba8d9c37fd321be752e36f4c2ffe832f0fb2c5b9
SHA512 d405078cf7b1237d7cb35f612d4d2934486932d6a01ba2d89c9a565ab5542228464f3c601cda095c702aaa217b5491d951d5e4aed7c4addf82988a3b93c1e6d7
TLSH
T1FE11477311CF03E2FF925D752FF509207F32090528736E19028BB6A2624AEB11DC5BC9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 fba501388de8b6f963e47d4125adb0cb2aea1c0d5a6b9c0a842efd23142139e1
MD5 6ea9af00e85271081346346d9f14f654
SHA1 d2577c3243f9b13c78c964c3464d48396e692303
SHA512 8f3638008371b4ebc5b9a078caf581cc6930ef3b5db315a3905766ce9ce2f62638628df84a1c223dd86454fdf5154778178ec96e23722456236d9b884de5ecb8
SSDEEP 384:DLKxmteyqTlHLS6aIji6Il4Nf+lHa6fuGcgLC+a2Euyc208FhDHNKqaef5oP7mz0:aMy9W6Rc
TLSH
T1B742AEF7C3E4D62D891165F1AB252E1FCE691924832C3C27C5D4EF5B93E28B1E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b6e096970d69393af1ea594bad1da06129b317a8b48d634d49db636607233c8f
MD5 c8eba1978ad4993c85baf69241e42d73
SHA1 4f5f6486c3927b976486a1cc5c95cd047c2b25b3
SHA512 f9c8a48bd2e4794288eedba072f145c695d8f119f8defed4b847cd14424b21e88b331b5bd867adcc09cfaea9225d04ed1a67c0ce580cb7ec35b0a53c35c5904a
SSDEEP 192:iR6cBzp+9bdxv70pHPRpDdAlNVls9+Hsb+WNyn49K557YO+t+Yn2W4Wkw1wVyIs0:iR6mzp2hglXD8ww5ORp27Wuvaw
TLSH
T10662E86BA9502A7BADDBC219F921B717D7F5202265D01E84E7FC8E2C08E76CC3227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5957aa4eb1546b6ce85f72864984dae830f5301e1a8310372eeec2bfd8dbfc89
MD5 62bbc3a1e12a955d02619fcd5180a70c
SHA1 58d38cc39285cdb6d008be18b8291da3b510460b
SHA512 432c5c659fbe0323fd8088ea7f90c1b6e19f2558ffc3efbc7c98e833dcabaf577180835b32ad59c94d68edee0c063b2198fdce79e77404fd9a53fda5884d0dec
SSDEEP 192:iR6cBzp/9bd+v70pHPRpDdAlNVls9+Hsb+WNyn49K55lBe+t+Yn2k4Wkw1wVyIs0:iR6mzpD6glXD8ww5thp2tWuvaw
TLSH
T12F62E96BA9102A7B9CDBC219F961B717D7F6202265D01E84E7FC8E2C18E76CD3227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3bfd96296bec47d83679527dc69817d2b8679fe63d4a5bf536c8359749a14c64
MD5 45bacb5325ec2e0e54799fa12bff6f75
SHA1 9b9f73dd2d75827109c6497ee6f70a438732a3f2
SHA512 1111acbfc2247da3625d35b54290b82d8a62ea9bb50c244f104687819a967a9ae393cdfb0ee5c55acb77259d962cb33ecc63614ad846b4746729b33b6b8ecd81
SSDEEP 192:iR6cBz5+9bdxv70pAPRp2dAlNVls9+Hsb+WNyn49Kp+t+Yn204Wkw1eVyIsnAUg/:iR6mz52hgUX08ww2p29WAvaw
TLSH
T1C752D86BA9502A7BADDBC219F921B717D7F5202265D01E84E7FC8E2C08E76CC3227457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c127ac1cc5c90ff021a0fc31caf37fab3ace1dd4fd462b7d5bc9c1927e4b5c07
MD5 08e9d86457c6f3dfa9e70c9eeed1c9b2
SHA1 0398caf1b20e1d95a3d3a3bebf8cbe858a43ae40
SHA512 51e05003487a14cf4d56388f911ae44d0a0577c34df668f0b3b4026f593b54ca0c990a3f7ec46feaeb5e96f2cae2a52a7a1866979a8db28e2cded239051a0bda
SSDEEP 192:iR65+9bdVv70pAPRp2dA2Nj9+Hsb+WNy79Kp+t+Yn204Wkw1eVyIsnAUgvaw:iR652lgUXe8wf2p29WAvaw
TLSH
T19E52E86BA9102A7BACDAC219F921B717D7F6102225D11E84E7FC8E2C19E76CC3227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 21b6af3309913f4a3028b47421694332981cd76d024a76f56cd829cc3a8a9a97
MD5 ea9dcc3126f1cfed52043c8f88c7a8e6
SHA1 f69f507e5c254004f4b45b6368b2dcab050ed4ff
SHA512 7e3ed764d8413948a3acf7ab5736cbcf0ccd62847ac6d95d42c8bead970114059923a87a529fe0927fac2c8455494634f00bd8fd202e46871710fb112f762af7
SSDEEP 192:iR65+9bfXv70pAPRp2dTF9+Hsb+WNy74nO+t2X4Wkw1eVyIsnAUg5aw:iR65E/gUXu8wTR2oWI5aw
TLSH
T1AF52C72EAA502A7B9CDEC219FD617717D7F6202525D11E84E7FC8A2C18E76CC3227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 03a25c0a9e8753c2a91b5bf10fa83da2e71bf32e42945995ffe1ab785a7e8fcb
MD5 7d8e79607377cd47a60267d0ef2216f1
SHA1 225e3968d71ca9b4f2af583012af333a769e4063
SHA512 2bdbc61d0173b5ed482ce2ffafa15f23716552e734a4cca7d84d5b404fc1801a60472f3d6878580829ab9ebbfedac7d97da053fd00ae88da9066278a45b5daf2
TLSH
T168B0121280059501C08302B022871CCCB16C5F109B0A170143E06D63C8255728434190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf9f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cf9f.TMP
Size 96B
SHA256 4d3aef99ef47e90df49bb682c7ce5025d9918cfd129a33f37cabef49d21400ad
MD5 fc5e569e6522b0a69caa56888efc9aaf
SHA1 f4e5ced917fe6b14d5037f62ea59f093584c1731
SHA512 5af54d3b484be155fabfe95245470347ba7e12b0687a8ef227f8f8462b5918c853b80a4f660c1193a180204f9a17616ac816b0cb08246ff253b38aa532c7e2ce
TLSH
T19BB02222C3032202C00203B02280A0C830B0CF2ACA23020382E00E3AEC322B008AA020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 ed27f340b551ac1279a7d7001c3915b75cef42a9e870e275fa68eac6d189e68f
MD5 588b74f27442d5b1d2066c75cccd18c6
SHA1 aa0285909a82fb6591c1d93149ed07287dc904ee
SHA512 6aefdeb0641ec0fd1cb0e1f0fa4520b741fc8440f8179f26ea17d1f59d486c86b21d0b348442cf36e87a8f2373548490595c7b209f1a6fb234917d0acb78904c
TLSH
T103B012E096C33D00E80D03714BC2810C31208C110514490751F516D0B4058C04259F20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9fc1c10807a7e4a149d252e8b68555dd1b841a4bcacab875ce0887cfcee773aa
MD5 f7d56ed11435e6fa292dc4aa30bdbbe6
SHA1 9947553992e2e4618bee3e69609b1a24436a85f5
SHA512 7a4f363a95e514f917cc3fdb83b92e9e2c5aeac7edda451500d5ac6591868afefbd38145095291987679420a5b9fe71602f7d11ba988bf33876a9f57cf377e20
TLSH
T100A0026A05C57102D6001774AFC2025C67204D1063524E55D0D905D4AC5C5824746E18
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c27c484755df5d8e6c3f4588c30ae0f09d0d5b05bed7e90635889ac68689c513
MD5 77361eae288f4a14ebff2a234873c60d
SHA1 7ad5ef733ff6660ae31aeec7088f75adcc0c30d6
SHA512 9a5d6a040a43cd148d08915fb754fcf79b854c7330d860bf6f53a8cc4711ccf0c9c1b2c6d910589690918bd9bcdfd630809f47981ae99dfa80b36b052152e9f4
SSDEEP 1536:OS1yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:37qfd7NtZL8cHQRZEQ6Sps3
TLSH
T19AC30237ABC21F339E83CB74B9530ED7A7B644A99034D301ABAD37EB6C83595644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 64691a5c63c0cbb21c5d7bd62aaed309a85167e9c39e8fe7fabed18019c63d29
MD5 4b30acdb5348dd4d19d07d9c11315efc
SHA1 cf0b90a01ee74860519178c16567bcb47e11f8c7
SHA512 1d3489d99b2c9530ac3f3d4dc63c0e43aeb7f144280a62fd9b6bac016212887d9be5bec1b49d9a9ded219b5e33216bae03be49ac6183ec2cf1b378dd9f09ac96
SSDEEP 1536:b9LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Hqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1F2C30237ABC21F339D92CF64B9530FD657B644A99030D301AAAD37FB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 e4d795321cb31c0492e27a2945be9c01aa176b970c1f951ef5ba9d565f7d0a70
MD5 52dac56b9ddf92190f8419bd302f5b90
SHA1 e24289ff84643d06cc141fcccaca7c1b9ee7fe46
SHA512 c3021b281694d1244839e27c0b8c98c57195edcfeecfe2c0b36d77662b1c490bbb812d7d1a683d0409d2d1ec73a904927ef43e45d9d787ec23c1694837de7d96
SSDEEP 3072:WsTgUIamql6DNk8CiGUqfd7NtZL8cHQRZEQ6Sps3:NbIamqMNk/iGUqZ/ZLW3Ex3
TLSH
T1FEF31233FB452E32CEC69B7474230ED662F604A5D030C605ABEE67AF79838D1E49295D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download