hxxp://rpcs3[.]net

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
67s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://rpcs3.net
Sample260828-s8dpgade85

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	7	https://rpcs3.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a324749d7b653e9d	7

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324056600202738"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe
Token: SeShutdownPrivilege	3836	chrome.exe
Token: SeCreatePagefilePrivilege	3836	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe
3836	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1968	3836	chrome.exe	85
PID 3836 wrote to memory of 4072	3836	chrome.exe	86
PID 3836 wrote to memory of 4072	3836	chrome.exe	86
PID 3836 wrote to memory of 1724	3836	chrome.exe	87
PID 3836 wrote to memory of 1820	3836	chrome.exe	88
PID 3836 wrote to memory of 1820	3836	chrome.exe	88
PID 3836 wrote to memory of 1028	3836	chrome.exe	90
PID 3836 wrote to memory of 1436	3836	chrome.exe	91
PID 3836 wrote to memory of 1028	3836	chrome.exe	90
PID 3836 wrote to memory of 1436	3836	chrome.exe	91
PID 3836 wrote to memory of 1772	3836	chrome.exe	92
PID 3836 wrote to memory of 1772	3836	chrome.exe	92
PID 3836 wrote to memory of 3248	3836	chrome.exe	94
PID 3836 wrote to memory of 3248	3836	chrome.exe	94
PID 3836 wrote to memory of 2384	3836	chrome.exe	95
PID 3836 wrote to memory of 2384	3836	chrome.exe	95
PID 3836 wrote to memory of 4788	3836	chrome.exe	96
PID 3836 wrote to memory of 4788	3836	chrome.exe	96
PID 3836 wrote to memory of 3988	3836	chrome.exe	97
PID 3836 wrote to memory of 2028	3836	chrome.exe	100
PID 3836 wrote to memory of 2028	3836	chrome.exe	100
PID 3836 wrote to memory of 3268	3836	chrome.exe	104
PID 3836 wrote to memory of 3268	3836	chrome.exe	104
PID 3836 wrote to memory of 1036	3836	chrome.exe	105
PID 3836 wrote to memory of 1036	3836	chrome.exe	105
PID 3836 wrote to memory of 2824	3836	chrome.exe	106
PID 3836 wrote to memory of 2824	3836	chrome.exe	106
PID 3836 wrote to memory of 4432	3836	chrome.exe	107
PID 3836 wrote to memory of 4432	3836	chrome.exe	107
PID 3836 wrote to memory of 5020	3836	chrome.exe	109
PID 3836 wrote to memory of 5020	3836	chrome.exe	109
PID 3836 wrote to memory of 680	3836	chrome.exe	113
PID 3836 wrote to memory of 1708	3836	chrome.exe	114
PID 3836 wrote to memory of 3992	3836	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rpcs3.net
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcbbbbc728,0x7ffcbbbbc734,0x7ffcbbbbc740
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17738510286607176642,8434355314019400856,262144 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,12554951972359538681,932221936123276436,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,4897749479192782294,2578175098607762362,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,11257129501339304792,16996696428156306573,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,16768387205937457594,208286542308880930,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,8752064610199520437,4218059121892924263,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,3065047123151621672,8014956638491736024,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,1793717627865717221,704585658516993643,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4824,i,9641672084839149274,12614939296573429647,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,895549649944897962,18429471317308628790,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6132,i,6801609535492220274,7718228875326539869,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4972,i,6610976703075477848,2807721048880158511,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6292,i,16299561300035290682,12755581639658868747,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6460,i,3277076975449973664,16918211113490287647,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6600,i,17566750802622714605,9563229777216258618,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4960,i,2129842929047169063,10436593330923703048,2097152 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,11835545218131084557,10111721056867827902,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,18132103382377740676,5228499377364486353,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,4399497972951254751,11570707296979175830,524288 --field-trial-handle=2004,i,4770456613398555503,2125704174533263089,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:3992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d4a5b04d5dfe949fc4d36d6faebd577c1949b1dacaf0d4e1dac04753b4b58af2
MD5 08bfcf5cd2d32996a82d6ffb3b9119f2
SHA1 e723f62320304b9410bc99f46322e55e30794148
SHA512 39b8f6013ee10fc72d0aeb0ae51c481e14a784dc735bfa1a71f740b57115e5e74a6b5b1b3a2ac67050f8b3799c48033572c378ccf4b8637c3c0193e9c051cd95
TLSH
T1DCE02BA9C862EC2718FD0B19E4501786DB59135F2A40898B7B3DC11C8FB16364585D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 79ce923359f69bb9a09e82f9ba2351f755a47b7bc14533f0ce31a5d254348824
MD5 f0a8558592f53ef7d44964cf532eef82
SHA1 968becb00501b9f6a41f5d7b4e9226e43be6bcf8
SHA512 5ac2e432e9363e056a9be70f6ac35857b96f5cc5b907bf0b40d2804ea75ba9f2d9db057d17d2f551845c814c3c164add9dd6bdbfd184997364069aef4f3673ff
TLSH
T1701147438DE9752AEBF0697B44DF9ECC243D51D120820E6ECCF5D1B909573E90410553
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e78a738c25a53f8dba6ee8e14d67cb3440d3ce5da2e0677dca7cc0ddd8d49e74
MD5 eb2ab7b2a5ff38919fbbce8b1730632a
SHA1 50eb8425acf799aff20ad83c0b1366717e587781
SHA512 96d0942c69251c946d881be09ab026cc8281e6297bf5d2e962b1b16d2d65b3020c0a41956e0b2edd416e31de5500e8bca079065bada2e3220540d2ef5351a13e
SSDEEP 192:IRpBsg2Jov70pAPRp2d5mqB9+Hsb+WNnTM24OY7rgPAbqVyIsnAUgE:IRpBM0gUXG8wIsY7MPvE
TLSH
T1DB52C52AAA402A3B9DDFD269FD227B13D7F6112525D01E84E6FCCA1C16E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fb94e748dd090a8deec3793eff838106e87683024f580fe4182c256aff4f2750
MD5 b45ab59ecf7096096158fd6ec2d06b2d
SHA1 20b38eaed05ed28e88d7a40e550f9056c4b0ea95
SHA512 c167677dfe8da26bf6bb82cbc631f29499837664552ec05b4c71a99afa2a2f4cc5f308a3ea94773c9e2d086431b39c71f04e6ec5c8552ad5950f7f889bf6e28f
SSDEEP 192:IRpBsg2JFv70pAPRp2d5mqB9+Hsb+WNnTM2rp2JXgPAbNVyIsnAUge:IRpBM1gUXG8wIo2JwPee
TLSH
T14642E52AAA402A3B9DDFD269FD227B13D7F6112525D01E84E6FCCA2C15E75CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1ccc347b287c5b035dec4ab6604b68ac33d876853507a25f4ca37f6baaf6cf8e
MD5 b41c9fa5bd78b40f6daa459a74ab3586
SHA1 d3d9e7edbf5cf19e943fbaa4ad5497770126aa57
SHA512 4d56ac734af143f5e4e58005cd07ccb67595b157ecf22f381a5bb128c9baf1cc048e50e1a5739d30d7afc2b3518b0b13042aff3db353d42fc6ba704c11d745f7
SSDEEP 192:IRpBsg2JLv70pAPRp2d5mqB9+Hsb+WNnTM217ePXgPAbNVyIsnAUge:IRpBMzgUXG8wI8ePwPee
TLSH
T1BE42D52AAA402A3B9DDFC269FD227B17D7F6112525D11E84E6FCCA2C15E76CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d35666ddaf6316b853422719ef5fca696e995465321950bd91071bf66505be8c
MD5 9ee4393bb89f7ff968906135774c1fe7
SHA1 43f8b795411cc49808ca3dfa01e4e6d19241c705
SHA512 1568c2f7fc50eceda93dc90de59919f29a4fd0b57b55ddfade397787b763be2670de72b2e29a699ffb73723d37e5780649f1d40b25211bff906483fa77cbb958
TLSH
T19EB01200C041A101D05602B0225214DC7115AF31964A170753E4693AC8261A18529060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a5d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586a5d.TMP
Size 96B
SHA256 43eef32cb1776f840f459347a538b530f8b32e57e92a20f68fbf35c3fe9277b1
MD5 481acbf466a479a5f8f770646e5464eb
SHA1 20f63629908c74a9b8b1e49560ce4de69489bad8
SHA512 821527093dc15d3840425388dd482e6010076fb934d5e7fcf3b1b42124a3226ccc48457e402ad1672cf352828e76cec9aa53f036d7ed86457a3fb1da196f729d
TLSH
T1E4B00265C1026352D14307F066A69ADC7171DF26CA07125692F01A6EEC65E798535168
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6beca29a1f68d60f1d5d044b0a35b33a67d385ec3a93592d896772760e28c035
MD5 fae4cbf6005472d7fa012345997d876e
SHA1 57f7bed8bf75c32db36a16d6ac45813ff83926fe
SHA512 39d1a75d283847c2d5ff9fe350ea9b9caf5a5c9d4d8b86a3f82ae4bf67d266334b25c5d93ed728feef13ccdef42a484ba9b527808ea4c66008a13fd74901fc5e
SSDEEP 1536:b4LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:0qfd7NtZL8cHQRZEQ6Sps3
TLSH
T17BC30237ABC21F339D92CF64B9130FDA97B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2d74e7df0a4309e455221f8a0f71f29a9ccf38d07384366c8809b53dd466b55e
MD5 18570c0492f465491e7342fbe8fc2c8e
SHA1 fa503c770d25b2526202238b00efff5e54dbc6b3
SHA512 de73f8d11589ab620566bba767fa3296eafbcf30ba2895dc6153497c7baff8906f7273db37615aa5193e240553d6519e6b5b53e14baf97e5999cbe0037860e2a
SSDEEP 1536:9Vk7yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:HYqfd7NtZL8cHQRZEQ6Sps3
TLSH
T13AC30237ABC21E339E93CB74B9130FD797B644A99034D301AAAD37EB6883595684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc61d2b9-1b8f-4985-adb8-4fc55f6381f7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc61d2b9-1b8f-4985-adb8-4fc55f6381f7.tmp
Size 116KB
SHA256 1c0c7ffdac65ad0590afd5856f64683ce453783b9a414dae80ffa7796636465d
MD5 20a262f74e6f28e16525267e66ca4d6b
SHA1 fdcb3fa36ba6dcea3315239377be83808a5b96c3
SHA512 0dd498668f6964a6d32121dfd4f1738b209123aaa7be7f4a5a1a216091328ad752d30f122b018dc2777d9adb8238329f9f89a39eed2022f0976df86c4670c37c
SSDEEP 1536:gVk7yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:AYqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1D8C30237ABC21F339E93CB74B9130FD797B644A99034D301AAAD37EB6883595684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download