hxxps://njdxhu[.]v-kool-tr[.]com/Y3BJSjJHUnByRllweFc2eTJDM3NIbDg5NVdTc2RDTi96NE1LeHlnNklpM0ZhKzJQRWU3NjVsQXFRNmoxNi82SjNXbkhnU1cyN3gxOU83NlhBQ2huNDNTN0UzdHpwNGRpWmVuWDIrWTN0U1k9

Analysis

user interaction
yes
max time kernel
120s
max time network
119s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/09/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://njdxhu.v-kool-tr.com/Y3BJSjJHUnByRllweFc2eTJDM3NIbDg5NVdTc2RDTi96NE1LeHlnNklpM0ZhKzJQRWU3NjVsQXFRNmoxNi82SjNXbkhnU1cyN3gxOU83NlhBQ2huNDNTN0UzdHpwNGRpWmVuWDIrWTN0U1k9
Sample260901-22fd6ayfle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327774854708091"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2044	2908	chrome.exe	83
PID 2908 wrote to memory of 4748	2908	chrome.exe	84
PID 2908 wrote to memory of 4748	2908	chrome.exe	84
PID 2908 wrote to memory of 2076	2908	chrome.exe	85
PID 2908 wrote to memory of 2016	2908	chrome.exe	86
PID 2908 wrote to memory of 2016	2908	chrome.exe	86
PID 2908 wrote to memory of 4668	2908	chrome.exe	88
PID 2908 wrote to memory of 4408	2908	chrome.exe	89
PID 2908 wrote to memory of 4668	2908	chrome.exe	88
PID 2908 wrote to memory of 4408	2908	chrome.exe	89
PID 2908 wrote to memory of 4368	2908	chrome.exe	90
PID 2908 wrote to memory of 4368	2908	chrome.exe	90
PID 2908 wrote to memory of 3124	2908	chrome.exe	91
PID 2908 wrote to memory of 3124	2908	chrome.exe	91
PID 2908 wrote to memory of 996	2908	chrome.exe	92
PID 2908 wrote to memory of 4392	2908	chrome.exe	97
PID 2908 wrote to memory of 4392	2908	chrome.exe	97
PID 2908 wrote to memory of 4556	2908	chrome.exe	102
PID 2908 wrote to memory of 1952	2908	chrome.exe	103
PID 2908 wrote to memory of 4880	2908	chrome.exe	104
PID 2908 wrote to memory of 4920	2908	chrome.exe	105
PID 2908 wrote to memory of 4920	2908	chrome.exe	105
PID 2908 wrote to memory of 2728	2908	chrome.exe	108
PID 2908 wrote to memory of 2728	2908	chrome.exe	108
PID 2908 wrote to memory of 2388	2908	chrome.exe	109
PID 2908 wrote to memory of 2388	2908	chrome.exe	109
PID 2908 wrote to memory of 3212	2908	chrome.exe	110
PID 2908 wrote to memory of 3212	2908	chrome.exe	110
PID 2908 wrote to memory of 4944	2908	chrome.exe	111
PID 2908 wrote to memory of 4944	2908	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://njdxhu.v-kool-tr.com/Y3BJSjJHUnByRllweFc2eTJDM3NIbDg5NVdTc2RDTi96NE1LeHlnNklpM0ZhKzJQRWU3NjVsQXFRNmoxNi82SjNXbkhnU1cyN3gxOU83NlhBQ2huNDNTN0UzdHpwNGRpWmVuWDIrWTN0U1k9
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa7346c728,0x7ffa7346c734,0x7ffa7346c740
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,14769584202314938710,17606357370472172555,262144 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,4859610957780945870,14712318582964147641,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,1963381320962863134,4962866654683986048,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,7141191755919971373,561227508758189631,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,5733695801023398416,12438644685336238821,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,9316738707279148802,13691881021915193935,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3972,i,17631382008125835185,419708906695532879,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,4204206766946969334,18167899149208615750,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,10979079290144150246,9313712088735371197,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,3467111820531399452,5480000821219638870,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=500 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4436,i,11629357868465247769,5744735879475133832,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3804,i,8189344103990614679,5466381287887615806,524288 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5616,i,6463570943043303528,7762861703605264960,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5340,i,12603725411906673698,15157215562915287713,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4400,i,2953389842974230100,6754892710985884144,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5588,i,6304301371392880175,8571458783685601260,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4444,i,8687130815322179244,5245339960889037992,2097152 --field-trial-handle=1972,i,3138977129034496733,4046821027359501235,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=844 /prefetch:1
  2⤵
  PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 08a0f558e0c508d325551fd87dd349e1210e6bc26542ca808a3d366067b75047
MD5 9e47315678c46dceba6bec7b03fb369a
SHA1 6b999fd50425883735b8b202a15fc959a6da1b3b
SHA512 4405ecc367ff961cd576ab74bd648ce919523504d2a0438c7e849286471784a2c267e121e1e430296bed5358345d75af1d5a8afb9c5ca186e5bdbf804d69b573
TLSH
T133E022AAC826EC3798FC072EA0484B86E754231A2B80994B7A3C910C8FF173A459681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6fdef27a437b23f31e617e7205bb3f3b5557f0b63ca743aacc43b9840b7050a1
MD5 56307110e81490054062a08ddba988a1
SHA1 8b8f0a54437dafbf7adab59aea761adecc966922
SHA512 b5bc9e092e3b593d460e541c92228d826f7c3d8dc79d152dc6a5e5c1b772fca0568ce8bf272aace950f8cbcc335e87d56e5aa052acc8db3502da3821f26395d4
TLSH
T1FC417DF793B4957E861196E4EB156E1FCE690524031C3CA6C9E46E1B53F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 192481d8bc9a035026409bf6aa5b8e6fddfbf722f99f805e231d894ad100f32f
MD5 5a2eee00d98519e40724e9c7b84d408b
SHA1 11e43daca2652894c58483501a38278b4da5e3ea
SHA512 02fa5e494b3dc2b732ebe143cc0a136c5674003e559bcce2b5825b7771997515a8004d5712b6558f8911112c86709d267ce564ae9beb710f888201643dd329e3
SSDEEP 192:ERLK/GcpebWv7PpAPRp2PU9YHsb+WNnbxLPIRNEkw4aMrVyIsnAUge:ERLK+cWijUXvWwdLPIwYaKe
TLSH
T1F942B76EF918683B5DCBD269FA527B57D7F6102221942D84E6FC8B2C14EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f7d3137eb9e41536bcf861a88a1a2e66b6a0b62a908609bb8bf952f93c3b4dcd
MD5 1dba301402742a733334e7e339c057f7
SHA1 ceeac9ffdad2e09462ddd8c82f1cf3b4bd149db9
SHA512 c3199b7b83ebce43a54073c5e3bec02db2dc6e2397f7bd2ef7135edfd913dcc8a90c778763440d646eb4cbc7b0c21e1df6e22707dddb66d9176f5848f2296237
SSDEEP 192:ERLKIDeI/v7PpSPRpIPA9YHsb+WNnbxLPIDNEkw4aMVVyIsnAUgE:ERLKSXjGXNWwdLPIOYaqE
TLSH
T1CB52D72EB918693B9DC7D269F9527B57D7F5203221902E84F6FC8B2C15EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bbbc06d55894dad0991ed83dcc24c0f5bb0d24447b7e9fb7606d6f2f786c2d58
MD5 f00d4bdaeec74e8df73e8b4a8b6c59fe
SHA1 320169fa54d8d2f2d5c3a7175a60614d8f422e0e
SHA512 178e7bc8ae331cad29edd9a06586815358394c1cb06894d568893ca291cdc5241bc4a34e8d39920464f4bc4096f3a55b1ad226bb73e4a3938afc83fff0b9c8b8
SSDEEP 192:ERLKIDeIpv7PpAPRp2PW9YHsb+WNnbxLPIhNEkw4aM/VyIsnAUgE:ERLKSpjUX9WwdLPIgYaWE
TLSH
T17342D72EB918693B5DC7D269F9527B57D7F6102221902EC4F6FC8B2C15EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 252f4bf966685f2c22b561205dcc7b4fa9789e53664279550080513d1f5afaea
MD5 31159413b8ded13eaebaa25a5468dac2
SHA1 d3ffaf89fbfbdf9c0022b020cccc23cad492de2e
SHA512 fd99cc1a11cafbf0ed4caf27bf59b1df98be5b30b47ff7cb0c17ed8d86cfebeec319e3313b4aed25b9f5587377d8e6c65b07a72bba0201b8f07e05b2262d304b
SSDEEP 192:ERLK/GcpeIpv7PpAPRp2PW9YHsb+WNnbxLPIRNEkw4aMrVyIsnAUge:ERLK+c3pjUX9WwdLPIwYaKe
TLSH
T1A242C72EBA18653B5DCBD229FA537B57D7F6102225942D80F6FC8B2C14EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e7395617ffd0091042fabdf794c215a91aa94cfadb0864a61f41d01eb8bbc5d9
MD5 29f18da48fcac5042242940938afdd11
SHA1 8c1b6e09019119d44f2d569f3ff97062f3301bd8
SHA512 049194cdeaedd8f45ab72041fbad3433fc6275c32020e810bae5298741d1d753a7eeec93a66d915871b4e420e91cac9be5f7abfde21c1b768d1fdfc98483612c
TLSH
T1BDB0128180C1A142D41606F41142149C72149F20960A170143E0A92288395608118061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5885a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5885a6.TMP
Size 96B
SHA256 88223fc9ef341d14b20b0319b91c011fb9cafc6ec70503782210bec95b212cc2
MD5 bc5ef05b1a26a751b02a6d52830bd553
SHA1 affca59b2b88f1699ef4527e3894b479dec51258
SHA512 bbc9a1428ea2a2b4821099bb9eaf252aaf0196b7c71a2da810a6967e685e852190940f966b58c06ac4ace99fb5121cd21305fc7e7d6cbe4458102dbf2d268cab
TLSH
T172B0220CC0022302C00203B028A082CC3030CF2CC203023B83E08F22CC28AA000AC230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1df5866434973ee39824bcc8343ec2767a51a5d2bad621c7352dd3a303ab96ed
MD5 99d405f498df4e0647ad1be6388fa1c0
SHA1 765464d39ad126c478665523393c350cb499bea9
SHA512 621e6b29f62acedac2d79826cb6a5b62d876f3f363de70d38fc741f0f99a9a1a7815caf8f8a85f8eb88094ae3b742f49d9302d55114141aa0b46e3b87cdbb140
SSDEEP 3072:tDzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:tDKm7Rkm1tYpBeh2BAoa
TLSH
T15AC3123B9D75AC375DB4BB4EB04E0E1F1DF149A6D924EE92C8D85E0423E6BCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a999076eabe36f051b271bbb25eff0ee3700fcdd4acbedc69e915988f2fc4f1e
MD5 3ac9a408e5066a47ab5997d454871234
SHA1 aff357f8322c7c9e54ba815c798d625acd84a58c
SHA512 24c6ea90ec58e90cded976b1cb2c92889bd1d2df207372872237d6520f615c7f71ffb9663dfc87d8bc801caf0ff36acbf9f91d2b7e8db7395269477027e2bed7
SSDEEP 3072:24Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2zm7Rkm1tYpBeh2BAoa
TLSH
T177C3123B5D75E8375978AB4EB08E0B1F1EF149A6D930DE92C8D85B0437EA7CC0A08934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5d8ff8ba6ee4f2d38831befa8842319a951c28b345bfa6bc430bc173072a011f
MD5 a528fb13eb7d759c58fc3e09caee4a7d
SHA1 7afa56b090353fb33b72426522956689e630d28a
SHA512 37876ee6f269c579d32fad6ee1f180ea20c1b97dc70c075cbb45751831b1d9bc35de5d251bf3f979d5e8f09327f7a9c0dc520d45eeb3ebab865bcee9af0c82cf
SSDEEP 3072:tZTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:tZqm7Rkm1tYpBeh2BAoa
TLSH
T138C312375D74A8375DB9BB5EB08E0E1F1EF149A6DD20DE52C8D85B0423EABCC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7c6cf4c49a576bcc189e416aca5871bc73467aae333224682dea6a91cfea67f9
MD5 3b12b65c981ca5d7916e4ad8075f6061
SHA1 5a32e5d80c5c4a86a23f47d7844864eb5c937743
SHA512 78385c049a4ccf2488c73fafb3bba53c8ef5d3ee85f6f457e2261d6354133b1918ea2229933b1cc2ef75fea188dcfddb034cf45566fadc83e8da8aa6b8e46ece
SSDEEP 3072:0ZTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:0Zqm7Rkm1tYpBeh2BAoa
TLSH
T173C312375D74A8375DB5BB5EB08E0E1F1EF149A6DD20DE52C8D85B0423EABCC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download