hxxps://tqr72[.]vercel[.]app/?xi=gerald[.]deleze@cevalogistics[.]com

Analysis

user interaction
yes
max time kernel
299s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tqr72.vercel.app/[email protected]
Sample260915-ma3caattay

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 3 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	4	[email protected]	1112	chrome.exe	1
Email address	108	[email protected]	1112	chrome.exe
Email address	129	[email protected]	1112	chrome.exe

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
76	1112	chrome.exe
87	1112	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134339410047547993"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 860	1952	chrome.exe	85
PID 1952 wrote to memory of 4320	1952	chrome.exe	86
PID 1952 wrote to memory of 4320	1952	chrome.exe	86
PID 1952 wrote to memory of 1112	1952	chrome.exe	87
PID 1952 wrote to memory of 804	1952	chrome.exe	88
PID 1952 wrote to memory of 804	1952	chrome.exe	88
PID 1952 wrote to memory of 4688	1952	chrome.exe	89
PID 1952 wrote to memory of 4688	1952	chrome.exe	89
PID 1952 wrote to memory of 4488	1952	chrome.exe	90
PID 1952 wrote to memory of 4488	1952	chrome.exe	90
PID 1952 wrote to memory of 2480	1952	chrome.exe	92
PID 1952 wrote to memory of 5064	1952	chrome.exe	98
PID 1952 wrote to memory of 2512	1952	chrome.exe	99
PID 1952 wrote to memory of 884	1952	chrome.exe	100
PID 1952 wrote to memory of 4600	1952	chrome.exe	101
PID 1952 wrote to memory of 4600	1952	chrome.exe	101
PID 1952 wrote to memory of 2444	1952	chrome.exe	102
PID 1952 wrote to memory of 1136	1952	chrome.exe	103
PID 1952 wrote to memory of 1136	1952	chrome.exe	103
PID 1952 wrote to memory of 2224	1952	chrome.exe	104
PID 1952 wrote to memory of 2224	1952	chrome.exe	104
PID 1952 wrote to memory of 1820	1952	chrome.exe	105
PID 1952 wrote to memory of 1820	1952	chrome.exe	105
PID 1952 wrote to memory of 4940	1952	chrome.exe	106
PID 1952 wrote to memory of 4940	1952	chrome.exe	106
PID 1952 wrote to memory of 4904	1952	chrome.exe	107
PID 1952 wrote to memory of 4904	1952	chrome.exe	107
PID 1952 wrote to memory of 116	1952	chrome.exe	108
PID 1952 wrote to memory of 116	1952	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tqr72.vercel.app/[email protected]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7339c728,0x7fff7339c734,0x7fff7339c740
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,5559996967914927609,1420290899455906736,262144 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,12201578085017141278,7000208517711146881,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,9651915000752877258,8846394054206191076,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,283472372829231470,13313212752585755718,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,5936455609381322723,17137082930867822967,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,2236665941653592982,1144561680202304358,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,18270230976981107920,18386693782553791564,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,13727142014896404008,2469649813858161904,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,12899837012287594022,14442622678183932807,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,10692849004037907474,9661631089124177445,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3420,i,7940024337637406228,10612304462444736072,262144 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,3472913480918423230,14068591472145028004,524288 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3256,i,3479529126560972005,9249931068308974226,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5628,i,5093416810753806438,15974206440340714947,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5652,i,3159157613783166196,10344499796001744477,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5852,i,9773122350274806006,52817339279299183,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5776,i,17393032351018654922,8657050034257554931,2097152 --field-trial-handle=1996,i,14001665303153273940,6397332203358207218,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6df545ecdd99f656fc2a29d36350a9522b62b0ee8adda22f4b1b5d74f3080833
MD5 6237b0d72e9251a0bf52cf3959f7f974
SHA1 3adfc9806ae1ebf9aed1582eca4ee4044b6b70be
SHA512 90c0deb540041de3e39e85befab69dd397e952cfcc539b2398f03598f42965bfa51dc3af0c40ecee9e4300594766c3d25bc6483a60814f0f5b4320f336d9d0fa
TLSH
T13FE0ABA9C861AC7B2DFC032820940B46E650036737404A0B373CD9098FF423B01858AC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 10dcf562c45d0da23b42500674e72e7c84ce9087eb0eaa303f3b779c6dc6594d
MD5 1033d0e1229ad661496414a97de7ce77
SHA1 eb38d1f09c543aa40cfd5c5c24211e5a742e4780
SHA512 e207f47b0e58cb269ddd610658871a22487cd675fd83072e2fae9d90d7dc76719a130b92343c60f92713a1ecc1f96e094d86385ba6f867379d02f17b703fbd6f
TLSH
T194D0C96511A421B0FB483175151259802590EAFDCF12578A7D5C6CCC553BD95B115E85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 eded74b1fcc7a663234b5e0d036b050e720c73655e8b548ba4f5c9bf9c4edbb4
MD5 6ff903578c1a80f0be3181dd2c0425a9
SHA1 3c00693f98f91caf50bfde43f299891c464e040a
SHA512 5e0129982bfc1f154ab62e0d81e6950276f721c8dd3cfc66d4ce4dc922ccb1d8f92c37e2158081bd800cfe4356d13627738732a34ebc7578d20c70971fcdbac2
TLSH
T180F0220462E03570FF08B6B100811F816140D8FD8F121B8BBE7C2CCC597BDF02525C86
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 6a1b4474da187358d33d1372b1f8e1bca2130e74e784fb2d8e78ebf1b7e890dd
MD5 080c1655f783cf1c24a980eb96d0c481
SHA1 9c29c6b105a2dca6cb3806c2c874cab104a9ef75
SHA512 633222f2ef8a8d9fa49a93d4b2a6429778062d259003a059d1e27283bec645242c25af51ba316c070ca8b21c50a07783869987037f438a573cedbcf1e6321c17
TLSH
T14A01FF8269D06979FF0836F101815F122640E4ED8B117F8BBD6D8498783BAF5A1A6CD7
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_tqr72.vercel.app_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

38449cfb-0e21-4ec3-b7cc-bb1cd07e6422.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\38449cfb-0e21-4ec3-b7cc-bb1cd07e6422.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d51de4f79a176c7b159d1c628756d4c51cdf18686454cbc238158d94f0ed3fed
MD5 e523c8bfc298e03c82efe89addb7ccc2
SHA1 f72859db2faf32d0e7e7c3160831a2ca6435d927
SHA512 fa4f60fc01caa18afdb3868021ab302ddf30222b2e17c9eb56582d6987be79369ae45e3ce75edac855c4f2194d63e301921bd8b4cf3b747e3e1ace0c4929f99a
TLSH
T199718EF7C3E8867DC91152F4A7152E1FCE290924532D3C16C4D4AE5B93E29B1D24158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c56cbfe8c16bc83fb6714a60607403c835310d09bd6d7c26266e8a9def196d5e
MD5 8c727752707836a71518a4acdc5090a3
SHA1 83cdde4d62f6325a428a7e674ddd8e37da249191
SHA512 fbb8ee4ff4d6d1b206072729dba5b1d0a77db9e258a1665ab702303adfb4eff7bb16ff937aeb75edcb7ce5b2e112929a335826792b8675dd9251a942bb8d5670
TLSH
T1167190F7C3E8CA7DC91152F4A7156E1FCE2D0A24532D3C16C4D4AE5B93E29B2D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 084670cb7a104bae6b6d541268130a51f03681e4e2dd2074695995a98e80ff9a
MD5 da0024ac12e3ab1462018a9c94ba8ece
SHA1 6de567350dc352f2d43e354c0de125e5dd23b37f
SHA512 18c733efda67730be082967a33cb2e616315b823be28ad23af0509ea1409870a2c7882a1f9584ce2ecfb5d496a496c40534fcf3839d3ca73ec2b8950c36ef7d7
SSDEEP 192:iRNhfF0w8REBPC6v7UpaPRpclrD9/Hsb+WNp9jHEIyIK/esyRebJVyIsnAUgE:iRNhfF0rEBPCWAaX0hwpqx1es/vE
TLSH
T14C42B52DAD20297B5CDBD21BF9667B67E3F5102124912E84EAFC8D3C29D76CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2c0a84a67b9281b8a7f2500fe9e9306ab56096e34f046a74b0cb17f8a73782af
MD5 d3bd5b92f9a1d732054c7af3ce34ca7d
SHA1 5567710b7ec72fbf02d35c39771e128b899ea2b3
SHA512 157bdc7657056af5a978fbad4df6ad450494b13759e4af03a42e0879086a06bbb643af8567b8ae5d275eab0266f379c1eb5dbcd9231aabf31fb423ca2817f16a
SSDEEP 192:iRNhfF0w8REBPmd6v7UpAPRp2PD9/Hsb+WNnEIyIuj2gyRenJVyIsnAUge:iRNhfF0rEBPmdWAUXChwEx52gLve
TLSH
T1B2328229AD10757B5CDBD21BFA667B63E3F5102124952E84EAFC8D3C29E76CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e2e30a29c5a986d8d297c66c54bf2cd1f052b194dbf0fb8241da91635b4f60e3
MD5 437a651cee671b266d7e26557d2daeb1
SHA1 36391164235866ff818f5ff2ef4593f7fc7928d7
SHA512 0b52c0b8a2679794a47025154c179064d28a19e8ad2369bbef294e7f6811aa9d4fa514e6831bc04b229308295bd107dde057c88e8233f7563aea1de23a9c3ecc
SSDEEP 192:iRNhfF0w8REBPh6v7UpAPRp2lrD9/Hsb+WNp9jHEIyIK/e0yRedJVyIsnAUgE:iRNhfF0rEBPhWAUXqhwpqx1e0xvE
TLSH
T14442842DAD20697B5CDBD21BF9627B57E3F5102164912E80EAFC8D3C29D76CC6217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc8e0b4fe0005e40143ee286021cc5598971cfa00825399b4ec4c4b6797af764
MD5 049b2f650da46e783ad18600b0e87210
SHA1 d2760aec6648b52e9d6585f9ce65d6ed896a3076
SHA512 27874f465d3747778aec3e639ef3a9716853e47dfaea3aebcc2879ce199482fcd589532315da31086a1b8fe8b7abe504ae2d60378e685587e128d619cd51789d
SSDEEP 192:iRNhfF0168REBPh6v7UpaPRpclml9/Hsb+WNp9CLxxEIyIeUEAyRebJVyIsnAUgE:iRNhfF0jEBPhWAaXVhwpAsxaEA/vE
TLSH
T18A42952DAD20257B5CEBD22BF9667B67E3F5202124911E84EAFC8D3C19D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2de7ac45b8338441ffbbeabb9b363ab61e7bde73b16c87685345a748dac91c5e
MD5 8efb995ba309d0e1fb30da9a2c549dca
SHA1 45b47d77611b1821b316bd424c02d64988f845ed
SHA512 de2ad08279d0e689c29e4d1e5b3c026059f4eee62793b2e8d4afcf2dedf45603b6ce14e3818bf838694a592cfb1d7a29c1aa61f1b387117a642ba82cf1edeac8
SSDEEP 192:iRNhfF0168REBPC6v7UpaPRpclrD9/Hsb+WNp9jHEIyIK/esyRebJVyIsnAUgE:iRNhfF0jEBPCWAaX0hwpqx1es/vE
TLSH
T17D42B52DAD20697B5CDBD21BF9667B67E3F5102124912E80EAFC8D3C29D76CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 742871478a60577ae5836d9732ab03ea7f7cbb04c33c401dd1e70c198d3fabe7
MD5 dff87e7d3a721f83360816c6a8f0f8c0
SHA1 c4237ee68e52b8e4977a217727a4092020c84849
SHA512 cd53ce039088ff1afd5189a6b0bb6c5ee0d11ede77ddb9a1acee4f4e186ff358f49d544d3166584730588fe6b0ea2f3090e6ace912caf74598e52269023f7a21
SSDEEP 3072:1L5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:95+hFD+7t56OD9ZfSApprE
TLSH
T165D31232AA95D877C9F96541B157A300DEB6A8ED45DE2A09444A9F8EE09FC4C0373A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 5771c094b39ce4634556c486a762b30724cdfd9790d2fa8101b6e546e2874fb4
MD5 8089c41a44c464a0ebcdadea65bfb815
SHA1 e3a9266aabb6ef09e026c9a987b17b472fd9c3c4
SHA512 208323f1dbb919b72b3f8e419d7f71ebfbb3720f06f376e401036cdfdbb26ecbe03ef484b0a8fd380d5b63f643af171454c965b7b3945bcc5d2b13910cfef998
SSDEEP 3072:1WV+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:EV+hFD+7t56OD9ZfSApprE
TLSH
T177D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 acc59017e5d9eae0f27245a9072e1ecb373daaca89d8012681870f8a92fd0814
MD5 50319cea4f9e317a3eeac5c6956461f1
SHA1 6bab26b939b0a7d20688ea1015f205db6f6bf650
SHA512 ffbb7be946b02b96d3ddef9c22713a686d481e4858d6548165c2ef45a0e552d8d06489c3bf871465b4238cde9fa8c507505d9b46cea41dd78d27712fa261f860
SSDEEP 3072:OL5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:U5+hFD+7t56OD9ZfSApprE
TLSH
T15DD31232AA95D877C9F86541F157A300DEB6A8ED45DE2A09444A9F8EE09FC4C0373A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 47b6bffb3be1bc1c73cca34e6950f4dd14743e048da0637f74276ccdc7155414
MD5 5341ee221289a014c0eb0cf975f5fc7a
SHA1 234150e9ca2466a854ccad596435b3447ff8fb66
SHA512 80dba4b7557dbbcdd9c9a352868ab5680600ce08f9918f8c88cea70b36fb83945ff213ce3ac321bd34cc68495fccb5648adbe06795c2c015aedb04f0846317f6
SSDEEP 3072:KLG3+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:4G3+hFD+7t56OD9ZfSApprE
TLSH
T1FAD31232AA95D8B7C9F86541F147A300DDB668ED45DE2A0D844A9F8EE09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 ac2c9af26367556faba630becc9eb4a8ca70661de016d5d9c260b05f3578629a
MD5 05c5dbfc9ab6ce2712e1bd2396f54e47
SHA1 9fe0753ece277d73c1447f91df4de5d0dfa7e848
SHA512 b04eabdb7104f7321f98ddc234791f711b68ae98219db2d3d7264e1228e0ec6f0be8369dd7cd17d7818f8d8dc2b4f730bff68ec491685d32aada26a0f9718d20
SSDEEP 3072:OLG3+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:UG3+hFD+7t56OD9ZfSApprE
TLSH
T1E5D30232AA95D8B7C9FD6541F147A300DDB668ED45DE2A0D444A9F8EE09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download