hxxp://url1981[.]onecom[.]co[.]uk/ls/click?upn=u001[.]RkwHz-2BdfmQ9xu75UudJVCxZkTXE9R98EanngftcAOi4458cyruqMucWJNUfPmGG6oW21a-2FTg00QZTWpXLyTP8ao-2FkXuejzfd4Nx2-2BYRSfA2G2vcFrG5807auyckegLR4vFyWaV8WfV-2Bz38z3zzurpDZC6oD3BlXguoUgsLvZBeMo1htpsQ3m5clOhMhR1mf2-2B31Nq8Dbp1CRkfnoQl-2B-2FvQmdQSoPn1b422Sae-2FZmZaFm4I7iJjYFMo6nUwKVQP0h0zrVnCfFSF6GfptJ8zCkjxk0dGZjqJqwQuJ31GUGwcMeChfVKCJ0AXY-2FeQZ-2Fbu5qyeCNmBSxWCMC5vu66-2FoWOuDRHZhOawCuARI7VxdwTjqdusAm1WMDGadtO9WUcUM4AYHwSNECZRT2rPEhxyqJnqjHfDx5jWjfcV4Znxt6PZ0rN8ilxefE-2Bb-2B-2B6uo6ymc5Xe3IhtoBtbj5cQM2Oa6zrqa7hsYHuDMCtYmiTsA3uKL5FnoIYw5-2FEVE2SwLvoxhsKFewQQ5amWI8yby5h-2FpTyXWd6p7HQp2KscUQ-2F6D4-2FDozXD9mE7V91kAU5kkYnwu6Ucjl-2FpziJNB2Kuk7OL1b9viHMHOHbjFQyngyr-2BPpOEXvp1WwPRwpEN7-2FhC7KRz4o7s0NYXVw-2F93gh1tIQ3QDiwCbqxsShKheu3pX6mvweIV2QI0dmc4Y7pFkQHUSG5j5xyYBkr2LrMFzkHARQSlzgdLPwNVL8lgfco2QZzC-2BneBU-2FmZlTuaM-2BNUhT5-2Fu3ZLziVZXhCdXwsaLghto7UVLrLQuEbIgmqUwLT7MZNoObayUlwtU-2FM11x0iszT7cP3-2Fiv0JQ_ZHkz7iuqKDigqEGT2KEcf9nLYJy9YPqADyH-2B5EA12UD2gUhHwdZfdV7uYy7ak6GWdKMI5x-2BMC2PEN2FD4Ee9cnfb8vuvD7viVqlLS2EoCla1u2ZA5rWR-2FwWUA4z1YoxEG3yUIz2I0DmBAUJG376yhULaGc3zPipdmwneX-2BWCrb-2FB3gi6ls4SdvyhT2qX77-2BGmklqGefNWPjC5LBB4MgitQ-3D-3D

Analysis

user interaction
yes
max time kernel
40s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/09/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url1981.onecom.co.uk/ls/click?upn=u001.RkwHz-2BdfmQ9xu75UudJVCxZkTXE9R98EanngftcAOi4458cyruqMucWJNUfPmGG6oW21a-2FTg00QZTWpXLyTP8ao-2FkXuejzfd4Nx2-2BYRSfA2G2vcFrG5807auyckegLR4vFyWaV8WfV-2Bz38z3zzurpDZC6oD3BlXguoUgsLvZBeMo1htpsQ3m5clOhMhR1mf2-2B31Nq8Dbp1CRkfnoQl-2B-2FvQmdQSoPn1b422Sae-2FZmZaFm4I7iJjYFMo6nUwKVQP0h0zrVnCfFSF6GfptJ8zCkjxk0dGZjqJqwQuJ31GUGwcMeChfVKCJ0AXY-2FeQZ-2Fbu5qyeCNmBSxWCMC5vu66-2FoWOuDRHZhOawCuARI7VxdwTjqdusAm1WMDGadtO9WUcUM4AYHwSNECZRT2rPEhxyqJnqjHfDx5jWjfcV4Znxt6PZ0rN8ilxefE-2Bb-2B-2B6uo6ymc5Xe3IhtoBtbj5cQM2Oa6zrqa7hsYHuDMCtYmiTsA3uKL5FnoIYw5-2FEVE2SwLvoxhsKFewQQ5amWI8yby5h-2FpTyXWd6p7HQp2KscUQ-2F6D4-2FDozXD9mE7V91kAU5kkYnwu6Ucjl-2FpziJNB2Kuk7OL1b9viHMHOHbjFQyngyr-2BPpOEXvp1WwPRwpEN7-2FhC7KRz4o7s0NYXVw-2F93gh1tIQ3QDiwCbqxsShKheu3pX6mvweIV2QI0dmc4Y7pFkQHUSG5j5xyYBkr2LrMFzkHARQSlzgdLPwNVL8lgfco2QZzC-2BneBU-2FmZlTuaM-2BNUhT5-2Fu3ZLziVZXhCdXwsaLghto7UVLrLQuEbIgmqUwLT7MZNoObayUlwtU-2FM11x0iszT7cP3-2Fiv0JQ_ZHkz7iuqKDigqEGT2KEcf9nLYJy9YPqADyH-2B5EA12UD2gUhHwdZfdV7uYy7ak6GWdKMI5x-2BMC2PEN2FD4Ee9cnfb8vuvD7viVqlLS2EoCla1u2ZA5rWR-2FwWUA4z1YoxEG3yUIz2I0DmBAUJG376yhULaGc3zPipdmwneX-2BWCrb-2FB3gi6ls4SdvyhT2qX77-2BGmklqGefNWPjC5LBB4MgitQ-3D-3D
Sample260907-c9963avyay

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332228794743865"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5296	chrome.exe
5296	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5296 wrote to memory of 5376	5296	chrome.exe	81
PID 5296 wrote to memory of 4916	5296	chrome.exe	82
PID 5296 wrote to memory of 1100	5296	chrome.exe	83
PID 5296 wrote to memory of 1100	5296	chrome.exe	83
PID 5296 wrote to memory of 1224	5296	chrome.exe	85
PID 5296 wrote to memory of 1224	5296	chrome.exe	85
PID 5296 wrote to memory of 1996	5296	chrome.exe	86
PID 5296 wrote to memory of 1996	5296	chrome.exe	86
PID 5296 wrote to memory of 656	5296	chrome.exe	87
PID 5296 wrote to memory of 656	5296	chrome.exe	87
PID 5296 wrote to memory of 2528	5296	chrome.exe	88
PID 5296 wrote to memory of 2528	5296	chrome.exe	88
PID 5296 wrote to memory of 776	5296	chrome.exe	90
PID 5296 wrote to memory of 5464	5296	chrome.exe	92
PID 5296 wrote to memory of 5464	5296	chrome.exe	92
PID 5296 wrote to memory of 5672	5296	chrome.exe	93
PID 5296 wrote to memory of 5672	5296	chrome.exe	93
PID 5296 wrote to memory of 5796	5296	chrome.exe	94
PID 5296 wrote to memory of 5796	5296	chrome.exe	94
PID 5296 wrote to memory of 6076	5296	chrome.exe	95
PID 5296 wrote to memory of 4708	5296	chrome.exe	96
PID 5296 wrote to memory of 668	5296	chrome.exe	97
PID 5296 wrote to memory of 404	5296	chrome.exe	98
PID 5296 wrote to memory of 404	5296	chrome.exe	98
PID 5296 wrote to memory of 6056	5296	chrome.exe	99
PID 5296 wrote to memory of 6056	5296	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1981.onecom.co.uk/ls/click?upn=u001.RkwHz-2BdfmQ9xu75UudJVCxZkTXE9R98EanngftcAOi4458cyruqMucWJNUfPmGG6oW21a-2FTg00QZTWpXLyTP8ao-2FkXuejzfd4Nx2-2BYRSfA2G2vcFrG5807auyckegLR4vFyWaV8WfV-2Bz38z3zzurpDZC6oD3BlXguoUgsLvZBeMo1htpsQ3m5clOhMhR1mf2-2B31Nq8Dbp1CRkfnoQl-2B-2FvQmdQSoPn1b422Sae-2FZmZaFm4I7iJjYFMo6nUwKVQP0h0zrVnCfFSF6GfptJ8zCkjxk0dGZjqJqwQuJ31GUGwcMeChfVKCJ0AXY-2FeQZ-2Fbu5qyeCNmBSxWCMC5vu66-2FoWOuDRHZhOawCuARI7VxdwTjqdusAm1WMDGadtO9WUcUM4AYHwSNECZRT2rPEhxyqJnqjHfDx5jWjfcV4Znxt6PZ0rN8ilxefE-2Bb-2B-2B6uo6ymc5Xe3IhtoBtbj5cQM2Oa6zrqa7hsYHuDMCtYmiTsA3uKL5FnoIYw5-2FEVE2SwLvoxhsKFewQQ5amWI8yby5h-2FpTyXWd6p7HQp2KscUQ-2F6D4-2FDozXD9mE7V91kAU5kkYnwu6Ucjl-2FpziJNB2Kuk7OL1b9viHMHOHbjFQyngyr-2BPpOEXvp1WwPRwpEN7-2FhC7KRz4o7s0NYXVw-2F93gh1tIQ3QDiwCbqxsShKheu3pX6mvweIV2QI0dmc4Y7pFkQHUSG5j5xyYBkr2LrMFzkHARQSlzgdLPwNVL8lgfco2QZzC-2BneBU-2FmZlTuaM-2BNUhT5-2Fu3ZLziVZXhCdXwsaLghto7UVLrLQuEbIgmqUwLT7MZNoObayUlwtU-2FM11x0iszT7cP3-2Fiv0JQ_ZHkz7iuqKDigqEGT2KEcf9nLYJy9YPqADyH-2B5EA12UD2gUhHwdZfdV7uYy7ak6GWdKMI5x-2BMC2PEN2FD4Ee9cnfb8vuvD7viVqlLS2EoCla1u2ZA5rWR-2FwWUA4z1YoxEG3yUIz2I0DmBAUJG376yhULaGc3zPipdmwneX-2BWCrb-2FB3gi6ls4SdvyhT2qX77-2BGmklqGefNWPjC5LBB4MgitQ-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87435c728,0x7ff87435c734,0x7ff87435c740
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,6185151223284509652,6914891889067355335,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,14779269642828370386,14380701563790444740,262144 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,2083697017799700842,2116403603806704549,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,76244938485239626,2957964750869299505,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,12956625818617196596,5180950831086152480,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,6695311668987294556,14487908640304612538,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,4984078174143776285,14658998815972735950,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5848,i,12013751572902661598,2631618126310719315,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3216,i,14291984478144102796,17443697408887217116,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6056,i,12148403153238920063,18069754335268095450,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,12842057738861813158,15424429093123710075,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,3655639526599776185,13863053087883521589,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,2731191303630978247,11915715711989779571,524288 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6064,i,12277239535051482405,13613028884237619693,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6092,i,3684526760220848261,10890071023574557271,2097152 --field-trial-handle=1952,i,14910684512093159956,8580475896048124195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:6056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a525888cdef9f2840f3144e99ea33f934a5f9b9653f3a51171c0664ed52ac42
MD5 266e8d5a59b8156768eba411fd20d5e9
SHA1 07ce2c87e7bdf6d8ae7000b6d992e5acebdc2e91
SHA512 1c8cbd56f95b149c4974bd76f98163f8a79a32b47764bf7a41530bf69f5a68075c530904359f1de530bd0c42590395af6c3b9d258ae4382c72a4ad551240b761
TLSH
T165E02BE9C831EC370CFD471C6454478AE714035B2780854F373C46098FB063A419692C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8cbf2f9f8109062ad391c2ad35c1d17bb306f9ee469b488cb5394da147879c7e
MD5 0e705c1286fe222904b48a808f74dcb1
SHA1 9023c87c06bd0fb8663a657a1effb569a4d06b5f
SHA512 c28808253ec1db8d18ba1a02007a004089161953a841a4a6938b69437a400fc1533176300a6e4bd7e4a8044fdaa5b7a2e002af0db70bdc0b579abb1445202d03
SSDEEP 192:RRwlv3v7NZv7H+pAPRp2X9WHbSb+WNnRpPSX2+dY/kwGDVyIsnAUge:RRwVB5iUXQUavPw2+d0mle
TLSH
T1C542C53EBD50693B9CCAD229FE617B93D7F9102161942E80EAFC892C11E75DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b1aa0254042ec74e1c3cc05ed838f0d325c43d4bf10cca2e36319d8f6c595c77
MD5 d92c2098260f14998de95d14c0918a51
SHA1 c56b5333a72a20f4921a3b0611f59d13ab044e53
SHA512 4f14ba1644eaf02090e02661b17657402599833593d3c028bda57853b29718b11fd129c10d93650d6007d7d476daf7827bb06a9463979b07d6a50cdfc2cd624e
SSDEEP 192:RRwlvdv7NQv7H+pAPRp2yhP99WHbSb+WNFqtIXsLRplJh2/X2+dY/kwBDVyIsnAI:RRwVPMiUXZUaFcIcrl2P2+d0hlE
TLSH
T14452D62EBD50697B8CDAD32AF9117B57D3F9102161D02E80EAFC8A2C11D7ADD211782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b6f7086f9b42f954118fd862a13abde554d07fe30050b8b4ffa66a3d6eeeeeca
MD5 000c382c58a6f02ba3634da895c0e3ed
SHA1 44ea0a1fcbcfb73c9f51a071380dded6956cf228
SHA512 878e56ab6cd1a108d9745e84a702be810d5e9cd3e1e0350335fadaade4a20aecab732b2deee881c35df19736c025c093cd257816928926989b26267b3f195650
TLSH
T1FBB0125084025542C00202F5214224987258AF11974A3F0583F0A933882D5608514190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58406f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58406f.TMP
Size 96B
SHA256 7737367a787aec0d984ebe3d69d6966bf9eaedee06d843ce1b763d8745c68185
MD5 0681b742d2c35402c7e4d53b30e22aba
SHA1 77609ef93fd5ed5920c2b3561f58b8b70682187e
SHA512 9ce7460ceec0007548c6edc6f06d28c8eb368baafc972d950d5542129df90b46ff30d03a3062b044bf71642888cafd696d46339da73ba91f22a2d516bb28193f
TLSH
T1E1B02200C0023203C00203F02888E0E8B020CF22C303220283E00ABBECB0A208B2CA20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2bb7c8e2cbb4fa0f1fce2339223b1fa18eaabb65ce1ccd5fa837da033b6d4402
MD5 95b215c1437be7e9271f6cc0fbdcf7ce
SHA1 d7e387f2ed1052ab7edb330ee6b735451a111d0e
SHA512 24e7d5f1a191e8e0e7dde358e9493f5e05ffdb074629b95f40c8d51279bf7713e7fb19725c3333bbd7b0011321eb27ee0069ad34fa2c70d3d512e6077314c197
SSDEEP 3072:u9zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:EWDfxA3OnjrYQ9EU0/hEV
TLSH
T1C4C302A11C3ABD660DF8EE98640D3A60FFF4AD9A91875DC392ED1F4C14FA5C8113A931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 792d70beae2ebe15ebbc3cf0be81b98ad08a70622d50441238a0e4b68181ae78
MD5 1da3aacab491c537b4d29938fbfaebf3
SHA1 69f41ea7e7de889b4d2419864700ef2e4efd8a58
SHA512 66afc89925115486390c8cf340ad791da38f3c8fe6092297908d98b812bd0ccb50c622b32d09ae42ca7557d0fe8f4cc98ccfcda8cfb33f52ee7ac477b34d9a7a
SSDEEP 3072:bzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:fWDfxA3OnjrYQ9EU0/hEV
TLSH
T1B8C302A11C36BD660DF8EE99B40D3A60BFF4AD9A91835DC361ED2F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 374c5e7293db8714981f0827fa981e865e115394b4eeaa9cf34ad50ea4d2550b
MD5 71d4d715e42b55d094527801b937e294
SHA1 c7bd5ccdc46f4e342041455a68a6190164997528
SHA512 fa544e878bdc41dc708b0f943d02d0aae1c08c9be4b54872fe9f6552af7f19187a93d60b86d645d66b1a9c34ee4f783d9f697294e575efc972b1d27a7b62ac1b
SSDEEP 3072:99zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:rWDfxA3OnjrYQ9EU0/hEV
TLSH
T19FC302A11C3ABD660DF8EE98740D3A60FFF4AD9A91875DC392E91F4C14FA5C8113A931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download