hxxps://ara[.]xhname[.]com/videos/silver-stepdaddy-boxer-vs-gouine-wrestler-singlet-wrestling-challenge-xhvmZfq?_gl=1%2A1vd8ku4%2A_ga%2Aa19tUkxPUUQ1TTdGcV9qN2NJZTdFNi1EMjdlN1ZIaERSQ1J5azNtbnNVWWZhR2JPTFVWTDM3YTJFRW9rY19USA[.][.]%2A_ga_M59JX8S6QE%2AMTc4NjY1OTkyNC42LjEuMTc4NjY1OTkyNC4wLjAuMA[.][.]

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ara.xhname.com/videos/silver-stepdaddy-boxer-vs-gouine-wrestler-singlet-wrestling-challenge-xhvmZfq?_gl=1%2A1vd8ku4%2A_ga%2Aa19tUkxPUUQ1TTdGcV9qN2NJZTdFNi1EMjdlN1ZIaERSQ1J5azNtbnNVWWZhR2JPTFVWTDM3YTJFRW9rY19USA..%2A_ga_M59JX8S6QE%2AMTc4NjY1OTkyNC42LjEuMTc4NjY1OTkyNC4wLjAuMA..
Sample260831-e3y7bsvclf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326241454361809"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1420	544	chrome.exe	87
PID 544 wrote to memory of 4288	544	chrome.exe	90
PID 544 wrote to memory of 4288	544	chrome.exe	90
PID 544 wrote to memory of 4888	544	chrome.exe	91
PID 2180 wrote to memory of 1220	2180	chrome.exe	92
PID 544 wrote to memory of 2272	544	chrome.exe	94
PID 544 wrote to memory of 4920	544	chrome.exe	95
PID 544 wrote to memory of 2272	544	chrome.exe	94
PID 544 wrote to memory of 4920	544	chrome.exe	95
PID 544 wrote to memory of 3764	544	chrome.exe	93
PID 544 wrote to memory of 3764	544	chrome.exe	93
PID 544 wrote to memory of 3768	544	chrome.exe	97
PID 544 wrote to memory of 3768	544	chrome.exe	97
PID 544 wrote to memory of 224	544	chrome.exe	98
PID 544 wrote to memory of 224	544	chrome.exe	98
PID 544 wrote to memory of 3592	544	chrome.exe	99
PID 544 wrote to memory of 1748	544	chrome.exe	109
PID 544 wrote to memory of 3804	544	chrome.exe	110
PID 544 wrote to memory of 4652	544	chrome.exe	111
PID 544 wrote to memory of 4132	544	chrome.exe	113
PID 544 wrote to memory of 1712	544	chrome.exe	114
PID 544 wrote to memory of 1712	544	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ara.xhname.com/videos/silver-stepdaddy-boxer-vs-gouine-wrestler-singlet-wrestling-challenge-xhvmZfq?_gl=1%2A1vd8ku4%2A_ga%2Aa19tUkxPUUQ1TTdGcV9qN2NJZTdFNi1EMjdlN1ZIaERSQ1J5azNtbnNVWWZhR2JPTFVWTDM3YTJFRW9rY19USA..%2A_ga_M59JX8S6QE%2AMTc4NjY1OTkyNC42LjEuMTc4NjY1OTkyNC4wLjAuMA..
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ff9b2fbc728,0x7ff9b2fbc734,0x7ff9b2fbc740
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,3986625445126159538,7467824160824290347,262144 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3742674163466283538,901375615438314662,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15075714528280427038,10424824992778356667,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,16954755843523522331,6876813549798006060,2097152 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,6556378271061565068,12671230484450743728,2097152 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3900,i,1487580053590368988,11977816498525130389,2097152 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,12182230269104213157,14426696874330116232,2097152 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,5924403312095893928,9280531375637805454,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,11330353431072506800,17354247301759373892,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,4119882245327908589,1828170849871483694,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,2496878727198793614,16241583206724749988,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6004,i,11984521160854062917,12892458342493910503,262144 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,5262280184292051195,15240342596351598222,524288 --field-trial-handle=1984,i,16301370092749910,17166686061720431586,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9b2fbc728,0x7ff9b2fbc734,0x7ff9b2fbc740
  2⤵
  PID:1220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 510c0b2f21d0afc3e68454ec59b60e9e390a59f4a2d3f8d6a8c95f7c6adf04fb
MD5 5516b06155ea21297fc923dbbff6da0b
SHA1 913fbe61ff499eb62d7ba1b76b1afb16eaf5a237
SHA512 4a5017c6905cbb441eef24847501010ae9a8a7c4df627c5c31cc586df642009bd9fc76ffd3f0d215a445ef6d50be813e75707e32edf4531a716b90ccf4aa5026
TLSH
T1C8E02BAAD971BC2759F9476C50440747E74013573B40C94F363C810ACFB5A3A018981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a97e9308d540ba82401155ea6cd514c30d33feed4dcf760c0858f421b55aeb66
MD5 92dbfa114041fde056065eb114570b3f
SHA1 5da04c1f5f3b4bec10bb35645b345bef26e8c909
SHA512 77fb8f807034b7327405fb1e17a1d65931defd8e34f87a9eec2e80c6bd438e1d7b456968c43ec310fcb6548b9a539784de9198309fa5bb13ce9836afebfb53ef
TLSH
T1F741780480CCB695CB9FAC76B6DD28A7BAB77CA063074E14C0D660B141EEB6C114431B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b58a33f078678b74b3fb539f543d6563d2d11d8d8e683d3920e4fef3f938434b
MD5 aca575c4e00bf8f54896759d81260194
SHA1 5b1a5cf500e7ce311226331cb4604d1d505e7691
SHA512 d163e2d07d217b4763c9d095c4c5efe0db034a3d46e0a5ed41f6483e0d991e0c0a3c95f206804b3d4c839deeff2812ceef6adbde7be1c08c37ab26fdb3b8256f
SSDEEP 96:D2nhPaIaflExGln51nwqlSj4lX6VpbSeyblyYu1i6dojhq:D2nhPaIaflExGln51nwqlSj4lX6VpbSq
TLSH
T12BB18CF783F48A6D8A1156F8EA15AE2FCE680524531C387588D0BE1B93F2673E11179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 82f9870674466be7edfd353ee5cab9859c34f09a30c88ed239e681f7c43823af
MD5 1bd1a0fd6e5b2556a45afcabd0d7e638
SHA1 ebb597867479b34d1879c980f204f2b8cf31e98f
SHA512 34c97838fbd111b66dc964d9c5bc678704e47178858e6b71853059b3619f1bb6df34e39d75c5143475ec0ae8511f611c483706bd6cb0a71835ba59e93310e713
SSDEEP 192:0R6GtKOv78hvPRpHzamh9DHsb+WNnDIPlC28k6ffrawlIVyIsnAUgE:0R6Gsq41Xj5wsg2V6raHE
TLSH
T18052B72AAD10393B6DDBC329F9597B63D7F6102165E11E84EAFC8A2C15E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca8469835b44b899208f6e05e263087bdc8785079e8d61fc593b0c6c8e4e3f55
MD5 34a71e31e567f253a08aed9576458110
SHA1 48f828c574e3229b10edc77208499289e858083e
SHA512 dc2a1b7387f3a57a62486ecdc47ad69184b53b468f0fe296223e86919cb8bbc39a6eb625454061b25a94d7a9d73e6aebbc386214da1f784b97580eb6d12899ce
SSDEEP 192:hR6GxKEv78pAPRp2Omh9DHsb+WNnDIPlC2Kk6ffrawl3VyIsnAUge:hR6Gog4UXS5wsg2j6rage
TLSH
T16D42B72EAD10793B6DDBC229F9697713D7F6102165D02E84EAFC8A2C15E79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 378057d643334ca487440031c989fe9ed23f13e16fa07053c5e38dfb3d62fe79
MD5 24cf5918caf95bf5a68a62b956b42d75
SHA1 65d61f5f1c8afb68cb547fdf83246a957ca107a8
SHA512 57698cab745eefdbdd4ff794b7edbaf15f757c043d7879b22eb1d567e34790a3dd5aad722fe8a3e41469d466a14316d327bb18d22659269628fe955d4fb9c10e
SSDEEP 192:0R6GxKev78hAPRp2zamh9DHsb+WNnDIPlC2yk6ffrawlOVyIsnAUgE:0R6Goa48Xu5wsg276razE
TLSH
T13742A62EAD10393B6DD7C229F95A7763D7F6102165D11E84EAFC8A2C15E7ACC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a45cdf885cfba466ac4b3c79d76feabd7e1be343\8dc936f1-50f2-4791-96ad-57d8f8b33afa\index-dir\the-real-index
Size 120B
SHA256 32c684029e57a270ecbabf2625cbaca9cb02ef4b67765ce68377fc023cfdb60f
MD5 65e56b4f388bd7afc291cc8fa3dc2a93
SHA1 babce42bad86004d8c02455657a2622c234d90a8
SHA512 e78dd9a8c1c0316033686ff249ca865e586a2abbc234fb7851c4f3d225c717658440f1fcff08eb99edb792999aeed386b6fd7e7e028edbc28ca823d50a171d55
TLSH
T1FEB0121980519B43D308077319778AD43732CC70318C431723FC82386CA3184FB91004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a6d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a45cdf885cfba466ac4b3c79d76feabd7e1be343\8dc936f1-50f2-4791-96ad-57d8f8b33afa\index-dir\the-real-index~RFe586a6d.TMP
Size 48B
SHA256 7a8ed6874bd45920c181ae77dcca3736b42f2b276a57fbcbd16b944cbf90f4ca
MD5 1a90d8bc44984823705049d5ccc96bed
SHA1 8924826f1f52ab3d7920ab2e0d7c0813d50c172f
SHA512 fdfa02904b901e83a18aee0ac1ad7a456e41f5becf525eb2195be8aba30646e2b5e926ad73b636a5d223152c1919ef397f32d7d48703872cca8807f8f069a3cf
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a45cdf885cfba466ac4b3c79d76feabd7e1be343\index.txt
Size 172B
SHA256 bce3fbbfce759b9843462675b3e4bc1d84ffeb4a37edcb61b1574e82503916d4
MD5 5c2ff3e9e8cc93e54642f0df59631add
SHA1 9dde5a5476f559cecfea0514ce06be7b5378bc0b
SHA512 85bb4e84e5fa2d7e448967ed355618219ad9461ae81211a8544a87612ce91d076b769233d1572a25a68f9519ddab5a6c26dd44af42c6e4290f97ef4875d92f8b
TLSH
T163C0126B182565589A2183E038216979C9386494FAD18E1FDC0045C6AA64D62090AD9D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586a9c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a45cdf885cfba466ac4b3c79d76feabd7e1be343\index.txt~RFe586a9c.TMP
Size 177B
SHA256 3a1288773d2834fa8d225f3cbbaafa7f9e902b28358453cb60cc17794d0a46f3
MD5 bd63dbd535d1f8cf8813d74133369412
SHA1 7e8353d3192241345540158cb2b9850da270918c
SHA512 2e1e9aeb24b4c9b322f8c9ba066120d6afd9af250b09b52b8685e689aa787dd0f99093a0362f3c4980c0861e1af82f7c721797374c01454a3d6df76d2d740a04
TLSH
T1EBC0126B182525549A6143E0382165B9CC386C94FEC14E1FDC0465C67A34D22090AD9D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1190424256d3454528ffdc6d1e6cc3146d93035566db6626eb073d9656f6001c
MD5 108d78384793f304616e699b6b4837a8
SHA1 441c3050c31e9bdff456f7adcd43c350c1409ce4
SHA512 4868ff3c351ea97201c23902216075cc42e9119b345b4a619300451d2a2cb51deea8427b77ae0e24f5581304ffe6a7a6579a9d88cec638239712d4902e397d28
TLSH
T1AFB01254C0C62551C80041B03548904472608E318504130783D0B9D5CCD71D48220190
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 da88eccf187111ac8197dd7fac9dc73a4892bd2cf1d1ebd45227467774a83275
MD5 0348f468725fa21f8b0ae7b4dfa567bc
SHA1 26a2ae96d88c453241a069380ec00512d41194fa
SHA512 0de11eb74228a4902f9e5622c13bb91c24f04928ac65a3ddf82bcefd40d3885e64fd986c88a662deb25fa3bd13211052b63a47403d95ad94beea32d299e9793e
SSDEEP 3072:PYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:PTm7Rkm1tYpBeh2BAoO
TLSH
T191C3123BAD65F9375DB9BB1AB04E0B1F1DF149A6C920DE52C8D85B0433EA7CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fe3208dd2e5aff89f3313b5351b67a3e1270e534eb62dfef8bccd247d5bd1d0f
MD5 0c87f7f799f13360656de8cd83a65446
SHA1 e4871dda473d88a6d6e28e41d50858ea589897b2
SHA512 9226a2f11d29cb0aa5800af720b7115d348066ae4f4dec498a6c45f587fa56c20c782a13ded51b657035ab123b5fcc4629f5f70f358fc054aca6eec5b2fff1b3
SSDEEP 3072:G+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:GZm7Rkm1tYpBeh2BAoO
TLSH
T1E9C3023B9D65A8375DB9BB1AF04E0B1F1DF249A7C920DE46C8D85B0433EA6CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 172KB
SHA256 285060c44111c4604f1511bb98524566c19ff3a3156e131224d076b9da07a2a7
MD5 141fbfbafa677b68ee3f99f52c944fa0
SHA1 acaf0cf60a2bdda2bc83200bf0fc2c7e3bfd050e
SHA512 bf34d24f8e8bd98b161587310b3720f8c71658873771099eb39788f4db54133c04f476db41d3eb1e85443a344e888cb0dcdc60afd1ace71d68f96869f6da84bb
SSDEEP 3072:GKP8/0KgCHqiZLNCYkpTq/29Xw+ZQT96Gm7D5Lk17ox1tIpud63U8BehbCBi9fTv:9KgCHqiZLEYWZZQT9dm7Rkm1tYpBeh2S
TLSH
T10004127F9C26E5BB5891AB49B08D063E0CF259D7D830CD5ACEDC6A0432ED3DD2605938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f506b29000acaf64a2eb3784c28e67cbfdaaf9a1a1ee4f24f13839e2ee3d5bc6
MD5 2fc0ec619edc06922e17620ccfa7fec4
SHA1 296b65c78bd4fd6af06b9d53aa036bf8faa2c92f
SHA512 2e4765035ddc532d67f2b22291c11e2214ba7d38fb764f910557a0c92c4bce72f337a741bcdf1ac6222732b5bef5257325e28b376eb47c17f0740686b6528789
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Vm7Rkm1tYpBeh2BAoO
TLSH
T1B0C3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cc633cff645403c94881b85e7ae6fbe27b8d193e767cddbce19f937611f54083
MD5 209e85fb5dc8fec3d6d32592376603f3
SHA1 7e73c1707b3cb4056db469842add188996edcf6d
SHA512 14297818d157f43314e035c5e1ce7d58177552a93ef80f2cdb74ea6ca5efb3658b793106370ab4ba67ac309dce501f49f32e361da0f05e085318b5153f427aad
SSDEEP 3072:OYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:OTm7Rkm1tYpBeh2BAoO
TLSH
T1B5C3123BAD65F9375DB9BB1AB04E0B1F1DF149A6C920DE52C8D85B0433EA7CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download