hxxp://server1[.]aserdefa[.]ru/deploy[.]xml

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://server1.aserdefa.ru/deploy.xml
Sample260905-d6l6hawcqd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4768	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330530509003323"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe
Token: SeShutdownPrivilege	3572	chrome.exe
Token: SeCreatePagefilePrivilege	3572	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe
3572	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4936	3572	chrome.exe	86
PID 3572 wrote to memory of 2420	3572	chrome.exe	87
PID 3572 wrote to memory of 2420	3572	chrome.exe	87
PID 3572 wrote to memory of 4768	3572	chrome.exe	88
PID 3572 wrote to memory of 1880	3572	chrome.exe	89
PID 3572 wrote to memory of 1880	3572	chrome.exe	89
PID 3572 wrote to memory of 2744	3572	chrome.exe	91
PID 3572 wrote to memory of 4596	3572	chrome.exe	92
PID 3572 wrote to memory of 2744	3572	chrome.exe	91
PID 3572 wrote to memory of 4596	3572	chrome.exe	92
PID 3572 wrote to memory of 4472	3572	chrome.exe	93
PID 3572 wrote to memory of 4472	3572	chrome.exe	93
PID 3572 wrote to memory of 3248	3572	chrome.exe	94
PID 3572 wrote to memory of 3248	3572	chrome.exe	94
PID 3572 wrote to memory of 2328	3572	chrome.exe	95
PID 3572 wrote to memory of 2328	3572	chrome.exe	95
PID 3572 wrote to memory of 1572	3572	chrome.exe	96
PID 3572 wrote to memory of 3528	3572	chrome.exe	99
PID 3572 wrote to memory of 3528	3572	chrome.exe	99
PID 3572 wrote to memory of 3872	3572	chrome.exe	100
PID 3572 wrote to memory of 3872	3572	chrome.exe	100
PID 3572 wrote to memory of 5072	3572	chrome.exe	101
PID 3572 wrote to memory of 5072	3572	chrome.exe	101
PID 3572 wrote to memory of 3520	3572	chrome.exe	105
PID 3572 wrote to memory of 3520	3572	chrome.exe	105
PID 3572 wrote to memory of 3324	3572	chrome.exe	107
PID 3572 wrote to memory of 3324	3572	chrome.exe	107
PID 3572 wrote to memory of 4384	3572	chrome.exe	108
PID 3572 wrote to memory of 4384	3572	chrome.exe	108
PID 3572 wrote to memory of 2336	3572	chrome.exe	111
PID 3572 wrote to memory of 2336	3572	chrome.exe	111
PID 3572 wrote to memory of 1144	3572	chrome.exe	113
PID 3572 wrote to memory of 1980	3572	chrome.exe	114
PID 3572 wrote to memory of 3812	3572	chrome.exe	115
PID 3572 wrote to memory of 2684	3572	chrome.exe	116
PID 3572 wrote to memory of 2684	3572	chrome.exe	116
PID 3572 wrote to memory of 5108	3572	chrome.exe	118
PID 3572 wrote to memory of 5108	3572	chrome.exe	118
PID 3572 wrote to memory of 5028	3572	chrome.exe	119
PID 3572 wrote to memory of 3744	3572	chrome.exe	120
PID 3572 wrote to memory of 3744	3572	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://server1.aserdefa.ru/deploy.xml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd8059c728,0x7ffd8059c734,0x7ffd8059c740
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,14341161165985691825,4929928088509305691,262144 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,8386933842723802164,11600631187878196944,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,391152146578206971,6675711627589064223,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,3154127680850916691,15469834281451336187,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,14548989428920429609,9905414317200003027,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,13069476097718803990,11588629645608920282,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=1700,i,16494676576764879950,5522783102476863854,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3272,i,7314416290920218334,5462367223178131314,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,17852360023871885147,10357710132063847498,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5716,i,14817465992933921376,4638573782470099546,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3468,i,2988906836043353234,11811842558485935857,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,7089088245562257421,12158034558075799323,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3688,i,17300684121446486809,10667797833808949884,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5752,i,15791696827732319040,14587382565697161603,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5700,i,8348246995573328785,5067594667102842970,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3408,i,16604448653288561064,4800337433566977704,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,15623639733996650675,2090647545195008748,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,8728881170871229471,2206234324718812878,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9992622973641313436,6033953288251651378,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6100,i,11592242319800427099,4162023091488185857,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6084,i,13623215094517532455,754719258503785613,2097152 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4724,i,12193654239430231458,7294473075747853536,262144 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,12287652137625556314,14432872469802223640,524288 --field-trial-handle=1992,i,12887459470204390260,5257422629834486295,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6eefdd0f63fb27802ec111950f2041f9e5ed94ec2af6a77d1178a1493926cbd4
MD5 20215815e1027f62b4f4a6ca0f95bc2b
SHA1 1b4067e5e2bc60141f2c04b3e3d2dbb5d4d5eecb
SHA512 9906de942e401e29848510a2533e35e0d0089c86911b0e19a5eecaaa53f1fb73f31a3e2350842c621a875cc8d0eedc88cecd0a90d2a77933e34c3ff5576ce015
TLSH
T1F9E022BAC921AD3B18FD076C245C0746F754231B2B51896F3A3C960A8FB8A370986C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02af6c72301a9551dc6f773478767dc7d6542ddd7da48d02a7ff3970b1bcd735
MD5 26172f6d2e4f42f9e525f006d8fa39ff
SHA1 7d15633b4e77019b54dceddecdba5e22a3f31699
SHA512 53d580c10fca74d12266323d6971bf60175a6b48a20f708483620f7a2d34b4b4d7943fa8b4be671571d8a1db0e3669fa551711bda919c7ff769985153f1722b7
TLSH
T13C41B1F797B4957D8A1196F4EB156F1FCE690524032C3CA688D4AE2B53F3872D14078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95cc58794cc7128867702cdb4dd7da8eda0c07ae8051cc5f58a619fb10b2df36
MD5 f59ea057f8c16e716ee3b5159d1ec744
SHA1 70d00ca99b9795bd00f45cd7d79ab73b19db5fb2
SHA512 98a7931f627b25f4218747a971ce9bba70cb3fd24ac62df81b6a8720c0417b54b0695a808424b7158ad8e243be6a25e952bbe96b8a10f05679d81a37216de670
TLSH
T17341BDF793B4957E860092E4EB256F1FCE690624031C3CA688D4AE2B93F2972D10179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 44138cd3001c409f94757742ab2836ca25e4fbab3a2a641ca9c291a487acb9ae
MD5 261fba275067a502a4b3a4149dd0fed2
SHA1 89b433a851c5153a1b93d5604212c795d355c3a8
SHA512 c8522cd303b0a63d73fe42cf0e804d26e72232cac8dd943cba6fbc5eb29a0ca7eaf6a4955190d2859d74da0770a70934b0a688ff8dc1004ea895780a960ce11e
SSDEEP 192:wRCs54Zv2MkfoUoTv72ympBPRphar895H6Q7b+WNn6YPROsBKkwBVyIsnAUgE:wRCsiZ0oTQfXb7NpPUsBKHE
TLSH
T1CF52E82FA910657B9CDBD229F9267F63E7F5103225902E88E6FC8A2C09E75DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 32a03791b2c0dfe29557840907e814d43f2bebcb0744e327220b834c77f99027
MD5 9c2cccc26e3d781c2311aef6200e91db
SHA1 6845c96f50f713884115f5ed3b14198cc5c9bdad
SHA512 98ce18de5257f97dfe56d78820c83dc673c753c96821dcf84b5cbd792486281867a4619a62cdb3013de7010f43bcc491a45986f3422b0d6b449199b9691217fa
SSDEEP 192:wRCsh4Zv2Mk9UoRTv72ympAPRp2aG95H6ob+WNn6YPSOsBKkwjVyIsnAUge:wRCsqZm9QUXg7ppPlsBKle
TLSH
T1DB42C72FAA20657B9CDBD229FD263B53D7F5103625902E84EAFC8A2C05E75DC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 30700c90080c84f14f47535483e7d134823a60373fad6c391b5312270322b9ba
MD5 253a7c2d4911218a6fdb6a02731c441d
SHA1 5bf3e1c8849052b62c96154daa1d50a57aa73890
SHA512 244af77976e5d58f17bf17b6276d4a30093547fc791594fa4552886200df6e0eccad1740ec8c0ee83c2168fd77155c6646f933c59eb5fdb96fb256e7aaab5caa
SSDEEP 192:wRCsh4Zv2Mkf9UZTv72ympAPRp2ar895H6ob+WNn6YP3OsBKkwHVyIsnAUgE:wRCsqZ090QUXy7hpP+sBKBE
TLSH
T17952C82FBA10657B9CDBD229F9263B53E7F5103625902E84E6FC8A2C05E75DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7cba7bae159cb1da26062a3d72d13c827accc806855b0d63c20dbafb76365381
MD5 b124daeba9c9613374828e8548b412b6
SHA1 0cfd2b7c9304b5f469e4fb6c8e9ab9d1aa455f41
SHA512 43b3330bfa1ce6959bcd07d3f5e32cec10293f67812ee18b320f3d956311b627437a564915574d11522618531f27dc995cfac5f4526750d3af26a33f0eb9addc
SSDEEP 192:wRCsh4Zv2Mkf9UCTv72ympAPRp2ar895H6wb+WNn6YPSOsBKkwjVyIsnAUge:wRCsqZ09BQUXy7RpPlsBKle
TLSH
T1B642C82FAA20657B5CDBD229FD263B53D7F5103625901E84E6FC8A2C09E75DC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 36ee310d1adce146f3f257dc9e8796dab3eaab08a640ffe28f634a603d942cb0
MD5 9f028ce7e9daf2c297b4f1d2124031df
SHA1 290cb95f53c1a3d80c0a509e8981d011b2b8f129
SHA512 f0dadcacaa12a16f5f52bc0b1c76293b5611203728bd6b7880edc762db02570d4b59f25e52ea0e5afc05393356f14cfe73f39ca54780548d26d799b0802161f6
SSDEEP 192:wRCsh4Zv2MkfoUoTv72ympBPRphar895H6Qb+WNn6YPROsBKkwBVyIsnAUgE:wRCsqZ0oTQfXb7RpPUsBKHE
TLSH
T1B352D82FA920257B9CDBD229F9267B63D7F5103625902E84E6FC8A2C09E75DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 3b4fd5c4e7153d09f6ad3b295a9bb0a32bb27eedc9a3d6e9d9b2c9dfe2f326e2
MD5 d2647cdde1f1a70f961f694ee4c6b732
SHA1 870154b254762d1e58b2df11d80096f0f481f44a
SHA512 21f1f91e0ddb5c1d2494ac913a19dcbeab3b8f3c580ca208feb4cc0ead90b6c9188afdba9597c7f4082e00733e24ca3c059213b5cfc39baf3f47295ebbcff390
TLSH
T1BDB01210C0015103C06203F01242188871545F50DA0F170143F0A963C8351618014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588dc4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588dc4.TMP
Size 96B
SHA256 7fc382efd143a782c8cd2590b97d6a8892efc237098255f9211f034c43d88f7b
MD5 cc5c96a319edb6b877dd376319f1437b
SHA1 4954136dcae0e1b1e1af7aafddcab615658f3f26
SHA512 79c2e06c259307f4651aed2725a21ad33bf7b4a2a841ec1cdcef0a536cb4156f78de1a79ba21a676dc6c5b6d70484e9d58b337138eeae6a3e700c2ced70f257e
TLSH
T1E0B00269C2427263C9B247B226D5A5FDB170DF35C6031213B3E07B6ADDE57714525260
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 f6fdec604f3bc84a0e58fe044207c4e4045b3429e34276670b21b254424e4ce7
MD5 c4c545f574f40896d36d8ace321a63c3
SHA1 a43495ed81f6b9b7456300d116a8ee20991d762a
SHA512 007faa224278e6f848b274ae6c1fd153341b4a0866c129189e360bec818063ba512be925f601d0fdd0ddfb538bc6f9a5cb2cc9490611c5a9e73a46ec573d9b59
SSDEEP 1536:d0yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Uqfd7NtZL8cHQRZEQ6Spsk
TLSH
T110C30237DBC61E339DD2DB70B9130E9A93B644A99034D305EA7D3BAB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 54ea0c883c0c55fbf7307582e2a99a86269f77a12212f8f51aa81aaa93300fbb
MD5 70789b4846fad6361f2bedd83ad371ce
SHA1 cad95160eb64ed4e376f4376fdf9b88e2ccddddb
SHA512 08a14f521ca5c571e273bcaaf74df39992a7fffea1b65ab09d808f2805cdad17141199f937bbd23c943478343755705404f35a36f178922f902ca1b513c94e1f
SSDEEP 1536:kExpyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:Fnqfd7NtZL8cHQRZEQ6Spsk
TLSH
T12CC30237ABC61E335ED2CB70B9230ED797B544A9D034D305AA7D27FB6C8349564428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b25cc0eff9ad16199f36b623adafc1cedeb41edd2382c949dfe340d3475bb77c
MD5 0c16fb6ea2d3ccbd88bf17b1999e2b31
SHA1 f0dc6aea00a61288281d8038a2a5d4334ec37850
SHA512 03a8f64a45785a8b9222e4965868b9585b72e31dcb0be5b9e748fdca6c99fa536088e25dbffab9a93a63ecd306af8419538ee418183e68f5dea8671549892106
SSDEEP 1536:TkQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:tqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B1C30237DBC21F339E92CB60B9530FD697B644A99034D301AA7D77BF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4938a036888ee8dd5e18a6decc689dd2c11022f7091c9a6b43e30c91f276397a
MD5 32d1e8906420e04038cbe1253cc4e94f
SHA1 9ae343967b5b24fc01c715848f4017eb5a192e3a
SHA512 010fe5995852ae11a31cc3d36703271bfc643655b0aedf65db0b96cd140cfbb0c44d04e2e3cbe9e7de0eb20e6126783eb6ba6f4d55b7cc167f9ea323f34761a3
SSDEEP 1536:VExpyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:Inqfd7NtZL8cHQRZEQ6Spsk
TLSH
T13BC30237ABC61E339ED2CB70B9230ED797B544A9D034D305AA7D27FB6C8349564428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 c7a7df4fd7aa140985f3b7e21d51971f88524fc1bc487117b2fbcdc8c6cc95aa
MD5 628ad711e9ba56e9e4a2becbd022e04a
SHA1 77853285a061642df256b36d1f2b892c597596d3
SHA512 59154aae9a3fe12dbf3a8b7b2d2c6dee1a9b8805ec7be0a28cb2d741bee19d401894e04fe5cbceeb06b87b5b51c81f805ca6337de4cf99e61c97d469e251c84a
SSDEEP 1536:VThWY0fNneizvpMs4qK5ARUHS2zyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSU8:ofdzyHAw9qfd7NtZL8cHQRZEQ6Spsk
TLSH
T12DF312379B4B1E339E82DF7475631D96A77A06AAC430C301EE7D7AFB38935A1604249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download