hxxp://I[.]projectthing[.]tk

Resubmissions

05/09/2026, 02:50

260905-dbvt6astgv3

05/09/2026, 02:48

260905-daxblabe623

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
76s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://I.projectthing.tk
Sample260905-daxblabe62

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4164	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330501441871708"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5100	1144	chrome.exe	84
PID 1144 wrote to memory of 3396	1144	chrome.exe	85
PID 1144 wrote to memory of 3396	1144	chrome.exe	85
PID 1144 wrote to memory of 4164	1144	chrome.exe	86
PID 1144 wrote to memory of 3728	1144	chrome.exe	87
PID 1144 wrote to memory of 3728	1144	chrome.exe	87
PID 1144 wrote to memory of 4756	1144	chrome.exe	89
PID 1144 wrote to memory of 5080	1144	chrome.exe	90
PID 1144 wrote to memory of 4756	1144	chrome.exe	89
PID 1144 wrote to memory of 5080	1144	chrome.exe	90
PID 1144 wrote to memory of 832	1144	chrome.exe	91
PID 1144 wrote to memory of 832	1144	chrome.exe	91
PID 1144 wrote to memory of 4336	1144	chrome.exe	92
PID 1144 wrote to memory of 4336	1144	chrome.exe	92
PID 1144 wrote to memory of 2248	1144	chrome.exe	93
PID 1144 wrote to memory of 2248	1144	chrome.exe	93
PID 1144 wrote to memory of 2104	1144	chrome.exe	94
PID 1144 wrote to memory of 2476	1144	chrome.exe	104
PID 1144 wrote to memory of 2476	1144	chrome.exe	104
PID 1144 wrote to memory of 3248	1144	chrome.exe	111
PID 1144 wrote to memory of 3248	1144	chrome.exe	111
PID 1144 wrote to memory of 3392	1144	chrome.exe	112
PID 1144 wrote to memory of 3392	1144	chrome.exe	112
PID 1144 wrote to memory of 3104	1144	chrome.exe	113
PID 1144 wrote to memory of 3104	1144	chrome.exe	113
PID 1144 wrote to memory of 4168	1144	chrome.exe	115
PID 1144 wrote to memory of 4168	1144	chrome.exe	115
PID 1144 wrote to memory of 2736	1144	chrome.exe	116
PID 1144 wrote to memory of 2736	1144	chrome.exe	116
PID 1144 wrote to memory of 4100	1144	chrome.exe	117
PID 1144 wrote to memory of 4100	1144	chrome.exe	117
PID 1144 wrote to memory of 5088	1144	chrome.exe	119
PID 1144 wrote to memory of 412	1144	chrome.exe	120
PID 1144 wrote to memory of 376	1144	chrome.exe	121
PID 1144 wrote to memory of 5004	1144	chrome.exe	122
PID 1144 wrote to memory of 5004	1144	chrome.exe	122
PID 1144 wrote to memory of 2676	1144	chrome.exe	125
PID 1144 wrote to memory of 2676	1144	chrome.exe	125
PID 1144 wrote to memory of 2736	1144	chrome.exe	126
PID 1144 wrote to memory of 2736	1144	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://I.projectthing.tk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff871f3c728,0x7ff871f3c734,0x7ff871f3c740
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,6170984525847886946,10058194044099678866,262144 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,5561935196990978745,2177643194961409702,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,17987801838075992643,12109600751791814433,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,14490766360177486061,5129260319955576898,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,11201453077631681313,11225052158552156772,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,17690356895936745642,16256592576174799672,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,13140307289064098735,16502480744896657196,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3156,i,15502492931124907458,7206924142486661070,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,10665669720813202284,14000090736400774024,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4600,i,16510580240171175277,8141923348544254642,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5756,i,9023013431607402053,5819790804910301134,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4764,i,12339152821014508897,2901495000910638366,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,14629211974270661857,7773187867322333033,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4884,i,11489529291585043714,14663899753977997261,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3152,i,3604627162508609770,970432354533089336,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3388,i,10885170420320756424,12486897951590781136,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,12395886721977421868,10178895589582607056,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,13535530496142275700,16955217305649162320,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,16020833762989522676,16840546121163837264,524288 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5988,i,13066105860920736439,9382502327046990774,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4784,i,10809059446664333251,3237773392697392790,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5468,i,13912871790044711279,9259200649418907482,2097152 --field-trial-handle=2012,i,5780822151571758131,8221462448864809300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c188c25d3f5d165d82bbf53b2ef327ae3e31ced7fb7f7d7047e9ee659eedd530
MD5 312bbcef9e893b956158f4cf6499f0b0
SHA1 01d6a0894cb85779caf4b910a1f615d4c468fdb1
SHA512 836878aa4aca48c5e315092f6dfd57a068ce72ac644a5897b727f48853ba955efc7382d7f4385af8311ec995449f236002d7d7bcb4b936fa239adb5ae3b65e63
TLSH
T1D3E02BA9CC61BC2718FE071990151685F751235B2E81554F7A3D510CCFB0A2741C6C7D
MD5 SHA1 SHA512 TLSH

Submit Download

0e308bb3-cd97-41e5-a139-67fed1c647cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0e308bb3-cd97-41e5-a139-67fed1c647cd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d77d66400aec4bc9e321b22c2c5145e116efb798c70cbaeb6e6223c81c062943
MD5 96e40df56cf2745b5db229945e61c550
SHA1 6b2cf67a5e2d5372d274c8892d7b3c223c12dc88
SHA512 c142e4435b589570418ca6df816e3aabe15fe298b5bd16956b3489fb583b90cb4ed77107603656e3178c7e91528f1d6d282f4939b4c514c11efa1ec73dd23132
TLSH
T1BE518DF7D7E489AE891156F4AB217E1FCD2D0A14021D3C66C8E4EE5B53F2872D24139E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 076da0a4d0e7d06c958d79e9d9d6404d3402017f33499d69a0ce497a0a68ed13
MD5 fc0c3364ffab09c54a1ff9c96ed6eb85
SHA1 ea31cc043d0c3d4bb058759500cde7a9f055e3bb
SHA512 374876afedfddbd835097a0ef5fc2b807fa03a95c131cc4926bb76cb624dec420bc9243c804e9af313923fc27967d2f34fa0a6e705563fea4a2560e0ca99f652
SSDEEP 384:hRGKS8rZiRrY/XouK6onv2btF2k+YEafE:CKS8rZXdK6ZbtF2Mc
TLSH
T14962D82EF954693B6CCAC62AF9217B97D7F5102221801E84E6FCC92C19D79CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d232c5aaa94a2e461d1281184ad717154385833a0e552aa05222a5b93dab67da
MD5 b51aa0a5c19b37e395c52f7d0ec3e6a5
SHA1 3b88072c275ce12a0f2443ee8edceda864965749
SHA512 975c82a885d740ae3d46449e20d47c9ea7e139517f3bfe10a4951c575a8463379b813ecb3b5965f2ef0f8daf8adab81a1f4cf4eb0568575901de048b79edb212
SSDEEP 192:KRGKS8hRdvbiK/Tv7spAPRp22OF9wH9Ub+WNnbHbi32vG2k+T0kwkasVyIsnAUge:KRGKS8rZiK/rYUX/mK67Q2+2k+YEaIe
TLSH
T13242C62EF954783B6CCBC21AFA217B57D7F5002221941E94EAFCC96C19D79CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b52710603a5781a770a9bbf10c89e67bdce27b73778471df162f9612b40bfe90
MD5 444131f018aca510fdcbdaa05a8f129d
SHA1 108b2a94fa3072eb71f1e9a5dea46d769217dec9
SHA512 7a426748b770e4be3c2cc63e5884919e462273b154a358f313d4d7240ef6b3506dcbe0f54dca0d780e69d37c3e1deba57429044961aa26c266d4f39d69f3b252
SSDEEP 384:hRGKS8rZiorYUX/uK6onv2byY2k+YEajE:CKS8rZSJK6ZbyY2MA
TLSH
T1DE52C82EF954693B6CCAC21AFA217B97D7F5102221841E84E6FCC96C19D79CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ac1a9bd8dc6fb8d2165526da5b3cebf511dad9a271b3f66d941a82400fed4f8b
MD5 1f10f1e46718a6c32932f0918bff8081
SHA1 a72a4bc5fa63b721e013d9688c375dd2a9027ab9
SHA512 120bf61d74c8e833937f1a1f3b12a8b6639b27ddef72469e2792d97cdc6e9f3c8c1ea769e9bd3380ea7278358b8f8d334aae5ab86bcf254bd98b59ed7bfc1115
SSDEEP 192:/RGKS8hRdvbioTv7spAPRp22O19wH9sb+WNn/Igi32wG2k+T0kwkasVyIsnAUge:/RGKS8rZiorYUX/uK6gh272k+YEaIe
TLSH
T10E42C63EF954683B6CCBC22AFA217B57D7F5102221841E94EAFCC96C19D79CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 33b3d7b009db2b4e8c8c538a27daf8c9ad6eed4897ae3e407af6d50a4e9055ad
MD5 c657f8a91f36fe4ec6db5a2c14ffd5d1
SHA1 492134fa001c2cb86c8af3f146ece029f1988ae4
SHA512 8f41b8cef2dc00a3c95eff848dfe2b0eca49b9e68ea18a4dede6372202e976ae253ac4f69db741c890584fb0d098fa4a46c836c138282bece054757b26f7845e
TLSH
T151B0124180116101D04207F4224214C8B114AF10D70F170243E0F9629C2BA718418050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ada0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ada0.TMP
Size 96B
SHA256 c4b9e0b088a8cd9c7094d981cc7b4fbe7f94b994256b435ad0c1534a5ff38475
MD5 82605aede0a09bc611c0ee447f1c7d69
SHA1 fb026da243802760a1bd8601c15ba48517ba773b
SHA512 957184804e90426eba58f4a48b8791f9eab73f43c9722403a02f7a4dec19eaf83da7b0be840c21e4d3535b2aad12ed0641f143256e2a4c898d1909f08c645d36
TLSH
T1A4B022B0C002B202C00203B0B888C0E830A0CF30C3230222C2E00EAAEC3EA300020E20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 2a15718814a4f5eed3aaa3a8e905c3cf9700efd449e5b56fe0f8614650bf09b1
MD5 233e3aeb92424361b6c3cbc461317b9a
SHA1 4971d70bda343b35e6a5f22359b8edb51230296d
SHA512 5fd96ce44d9c15777d09b5737802deb61f37a3abedaf4ca5fcc58a9d75afa4f09f51fd1916f1dc5fa39aac29aae30570472e1c701d8d07d3f633493d13325709
SSDEEP 3072:PynaVyxAjV841tj4pELGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:PynaVSb41IESm7Rkm1tYpBeh2BAoK
TLSH
T11DF313375D64FD3B58A8BB6AB5860A1E1AB28973C520CD43C8DC4F0C76F96C81B46DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 7d13954772da699079444bb37519b0ec13b463bfb0a8048e030aa3f2235d8efd
MD5 56a0d52db96ed89e5ebb695bb0993c37
SHA1 5ba8e3666b3b7c7f9c57ced783b58e08f0f478b6
SHA512 72ba5dbf011fbdece00954fc3890a70bba679d588487f01036d45393d15c3db675aee92276693e2e1d1e723a7efc4250fc64ec53696e6cfa4d3d38057825cea2
SSDEEP 3072:WGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:hm7Rkm1tYpBeh2BAoK
TLSH
T1E1C3023B5D75AC775DB5BB0EB08E0A1F1EF149A7D920DD52C8D89A0837E96C81A04E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7a6c40720690c98b3288c93a00671e01a9f1e87ade40b758ae0671956ab5428b
MD5 130cc80fe93ce86da5d0a97a7d344522
SHA1 6c6d7cc306933cbbb87457d18eada6b1184ada5b
SHA512 fd01362f3d105cda577040a8a0ff4a5b722afe75037dfba1805853da3ba01c84489bc655292936ef330c4eecc3d563a14ad7c7bbdb7e26de3beb60c9619ab064
SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Nm7Rkm1tYpBeh2BAoK
TLSH
T192C3123B5D65E8375DB5BB4EB08E0A1F1EF249A7D920DE92C8D85B0427E97CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 74c72b8eec4ad8863864237c585305985e940c052d27fb9b6c5bd1748fbf5db4
MD5 b298a474ba32177c979141a20c650e22
SHA1 d47ed5f84f753eb9c054c9b61943792e72888e31
SHA512 c39a290c9c720a2d23f2610104f51b1bca792077277b1567b6c5347a0bfbca7d6a3be6b8705672063c6b4417446e4422a7986975d9361f2c680aad305509e63e
SSDEEP 3072:+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Zm7Rkm1tYpBeh2BAoK
TLSH
T18BC3123B5D75E97B9979A70EB08E0B1F1EF149A2D920DE92C8D85A0437EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d9b4185c9b39892239cc46c7f6efc6c812d41937f8fdddbcebb3c859d64de9b0
MD5 920e942471098f82d5092191f9b8a92e
SHA1 7c443f4b6fbe4973684398b7f1c349b9338f6254
SHA512 c02a6854bbf8a0aa12a4ffa1e754e18ecca3d9ea97fa4a8713a9c3420d06ff6e287fb2b75432e14083613aeb3ce4077b2844232e7247d362cc87104eab65bace
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:zm7Rkm1tYpBeh2BAoK
TLSH
T1F8C3123B5D65A83759B5BB4EB08E0A1F1EF149A7C920DD52C8D85B0827EA7CD0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 78d15bbf9426789230c4b59dd25d12051bd1e48c4cf1f4685475483249bb7fa0
MD5 1eff7adc2dec0a248f363f8407386f18
SHA1 2f93c3e524c0f2290eae3e85f0f0b004950e1a78
SHA512 7e9872f5577e316538eaae2fb9e98793b6b01642ffee28a814c92ae35530c1a01a0a61e74ce1cf5efaab8b8ba1dcb9096893103088f6202896658b3b416aa1ba
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Rm7Rkm1tYpBeh2BAoK
TLSH
T12BC3123B5D65E83759B5BB4EB08E0A1F1EF149A7D920DE92C8D85B0427E97CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download