hxxp://url8214[.]done[.]lu/ls/click?upn=u001[.]MIO66-2BwL5N5Q3ffqkEynXn2GJbWRhzfB9f5pgHRAIF5UASwV-2F91Xr4Y18KoIPolsGRRiBs-2BxYgQB6FFTa2Zw0hfCc4lcEogBrD4vUJjt4hYRExbStb-2BJioxiSqsBb5lrpLUXkPUo9rSEAvzn2sowb-2BOMy3NtsCdFnieEPYbEHikkGUvPExD85-2B7ZcRpHT52tv27IHn7shB2mAcn8jH0afSY70Xq2rRHWEoO7Y4xJoruAYINfhwwf7XZKp0niZZpx4IEMc-2F1e-2FVCI5-2FtRARNg2CKZWe3ocAQDEFKo2LUnE4eZ-2FLbOXDY-2Fh8BuL-2FlKNXS8dmHJb5CQeKgY1dVnNu0bL1HPa3Mr5VylI6d-2FEA4s6mAqJjFY-2FQQm4WhGaDF1seB-2BwwSpHWL47cpicJd2vZ46tjHUTHonKy2P2iNRxaf4s6hHuMVzjDlNLUCd-2FcI-2Bwh3y5YZVukYwE2xebqd9DwK80XySxtJluAKtmavlZYDoBqwA-2BnZn3hcS1VxUfsl4-2FkT5l9s4CXqMuohkioyJDHtej-2FWpcShjaMPpFt061HYpB74AEAEZUCDIEYEwqw-2F-2BABZFqsR3grLmgM9DJ0XLG-2BEy0v8X6Re11VvNJlx74rlOyxcX7t-2FEc3rWcRJZ75Ih-2BMCONWTL7E-2BrvPlEmNxnX79E5FXOX5D4zqQfzoOIte8oiBJxiVKIW87y2QLzWfajfwF0e3NC7zZy-2FHq5njpA8Y5cU7K2nK5zLLimeTwGo-2Bs5PoxrhQLMpQLl9Lhlck9fJ3dwIi-2F4rc65eDjd1QKbIJz5wMcauRNc26THaXYDJMlQQOk5LFV8nSvjjBY6lhpl8iHTa8-2BZAVd66QYu-2BAGQyWppWoRBWT7L-2BTSHr-2BsqdXmOHP4UYg1z8uXG3lYBHLrYyIBNtJaq_ZmF-2F-2F5HZlwqmSUfbmN9RNA2UqmKCFwYWqFtcK3RvHEHspW-2Bec3IZESpjjmEfJ6dpjEEM6UIx6mt-2FY5ZCGX42hAkM6KEFP6FKmu-2BUeQ7fiRxJpQ7cFTM3IeJmDJXrqCnYBjor5WuIVBvY4fCExr-2F4636FfwWGI8-2BITVZTKFLY1A7USSiPMwVFiTIMDJdSy5mo61ERM6xMoST3dQGMgM4kpA-3D-3D

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
20s
max time network
23s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url8214.done.lu/ls/click?upn=u001.MIO66-2BwL5N5Q3ffqkEynXn2GJbWRhzfB9f5pgHRAIF5UASwV-2F91Xr4Y18KoIPolsGRRiBs-2BxYgQB6FFTa2Zw0hfCc4lcEogBrD4vUJjt4hYRExbStb-2BJioxiSqsBb5lrpLUXkPUo9rSEAvzn2sowb-2BOMy3NtsCdFnieEPYbEHikkGUvPExD85-2B7ZcRpHT52tv27IHn7shB2mAcn8jH0afSY70Xq2rRHWEoO7Y4xJoruAYINfhwwf7XZKp0niZZpx4IEMc-2F1e-2FVCI5-2FtRARNg2CKZWe3ocAQDEFKo2LUnE4eZ-2FLbOXDY-2Fh8BuL-2FlKNXS8dmHJb5CQeKgY1dVnNu0bL1HPa3Mr5VylI6d-2FEA4s6mAqJjFY-2FQQm4WhGaDF1seB-2BwwSpHWL47cpicJd2vZ46tjHUTHonKy2P2iNRxaf4s6hHuMVzjDlNLUCd-2FcI-2Bwh3y5YZVukYwE2xebqd9DwK80XySxtJluAKtmavlZYDoBqwA-2BnZn3hcS1VxUfsl4-2FkT5l9s4CXqMuohkioyJDHtej-2FWpcShjaMPpFt061HYpB74AEAEZUCDIEYEwqw-2F-2BABZFqsR3grLmgM9DJ0XLG-2BEy0v8X6Re11VvNJlx74rlOyxcX7t-2FEc3rWcRJZ75Ih-2BMCONWTL7E-2BrvPlEmNxnX79E5FXOX5D4zqQfzoOIte8oiBJxiVKIW87y2QLzWfajfwF0e3NC7zZy-2FHq5njpA8Y5cU7K2nK5zLLimeTwGo-2Bs5PoxrhQLMpQLl9Lhlck9fJ3dwIi-2F4rc65eDjd1QKbIJz5wMcauRNc26THaXYDJMlQQOk5LFV8nSvjjBY6lhpl8iHTa8-2BZAVd66QYu-2BAGQyWppWoRBWT7L-2BTSHr-2BsqdXmOHP4UYg1z8uXG3lYBHLrYyIBNtJaq_ZmF-2F-2F5HZlwqmSUfbmN9RNA2UqmKCFwYWqFtcK3RvHEHspW-2Bec3IZESpjjmEfJ6dpjEEM6UIx6mt-2FY5ZCGX42hAkM6KEFP6FKmu-2BUeQ7fiRxJpQ7cFTM3IeJmDJXrqCnYBjor5WuIVBvY4fCExr-2F4636FfwWGI8-2BITVZTKFLY1A7USSiPMwVFiTIMDJdSy5mo61ERM6xMoST3dQGMgM4kpA-3D-3D
Sample260916-rh17eabc73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340415626852937"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{5C57F4E1-E77B-4BC9-B2BA-5DD1604998D0}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4864	1520	chrome.exe	81
PID 1520 wrote to memory of 3340	1520	chrome.exe	82
PID 1520 wrote to memory of 3340	1520	chrome.exe	82
PID 1520 wrote to memory of 3528	1520	chrome.exe	83
PID 1520 wrote to memory of 3436	1520	chrome.exe	86
PID 1520 wrote to memory of 3436	1520	chrome.exe	86
PID 1520 wrote to memory of 1796	1520	chrome.exe	85
PID 1520 wrote to memory of 1796	1520	chrome.exe	85
PID 1520 wrote to memory of 4020	1520	chrome.exe	87
PID 1520 wrote to memory of 4020	1520	chrome.exe	87
PID 1520 wrote to memory of 4248	1520	chrome.exe	88
PID 1520 wrote to memory of 4248	1520	chrome.exe	88
PID 1520 wrote to memory of 2352	1520	chrome.exe	90
PID 1520 wrote to memory of 2352	1520	chrome.exe	90
PID 1520 wrote to memory of 1200	1520	chrome.exe	91
PID 1520 wrote to memory of 3028	1520	chrome.exe	93
PID 1520 wrote to memory of 3028	1520	chrome.exe	93
PID 1520 wrote to memory of 3808	1520	chrome.exe	94
PID 1520 wrote to memory of 3808	1520	chrome.exe	94
PID 1520 wrote to memory of 1220	1520	chrome.exe	95
PID 1520 wrote to memory of 2576	1520	chrome.exe	96
PID 1520 wrote to memory of 1220	1520	chrome.exe	95
PID 1520 wrote to memory of 1388	1520	chrome.exe	97
PID 1520 wrote to memory of 1388	1520	chrome.exe	97
PID 1520 wrote to memory of 3516	1520	chrome.exe	98
PID 1520 wrote to memory of 3516	1520	chrome.exe	98
PID 1520 wrote to memory of 2876	1520	chrome.exe	99
PID 1520 wrote to memory of 2876	1520	chrome.exe	99
PID 1520 wrote to memory of 1124	1520	chrome.exe	100
PID 1520 wrote to memory of 1124	1520	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url8214.done.lu/ls/click?upn=u001.MIO66-2BwL5N5Q3ffqkEynXn2GJbWRhzfB9f5pgHRAIF5UASwV-2F91Xr4Y18KoIPolsGRRiBs-2BxYgQB6FFTa2Zw0hfCc4lcEogBrD4vUJjt4hYRExbStb-2BJioxiSqsBb5lrpLUXkPUo9rSEAvzn2sowb-2BOMy3NtsCdFnieEPYbEHikkGUvPExD85-2B7ZcRpHT52tv27IHn7shB2mAcn8jH0afSY70Xq2rRHWEoO7Y4xJoruAYINfhwwf7XZKp0niZZpx4IEMc-2F1e-2FVCI5-2FtRARNg2CKZWe3ocAQDEFKo2LUnE4eZ-2FLbOXDY-2Fh8BuL-2FlKNXS8dmHJb5CQeKgY1dVnNu0bL1HPa3Mr5VylI6d-2FEA4s6mAqJjFY-2FQQm4WhGaDF1seB-2BwwSpHWL47cpicJd2vZ46tjHUTHonKy2P2iNRxaf4s6hHuMVzjDlNLUCd-2FcI-2Bwh3y5YZVukYwE2xebqd9DwK80XySxtJluAKtmavlZYDoBqwA-2BnZn3hcS1VxUfsl4-2FkT5l9s4CXqMuohkioyJDHtej-2FWpcShjaMPpFt061HYpB74AEAEZUCDIEYEwqw-2F-2BABZFqsR3grLmgM9DJ0XLG-2BEy0v8X6Re11VvNJlx74rlOyxcX7t-2FEc3rWcRJZ75Ih-2BMCONWTL7E-2BrvPlEmNxnX79E5FXOX5D4zqQfzoOIte8oiBJxiVKIW87y2QLzWfajfwF0e3NC7zZy-2FHq5njpA8Y5cU7K2nK5zLLimeTwGo-2Bs5PoxrhQLMpQLl9Lhlck9fJ3dwIi-2F4rc65eDjd1QKbIJz5wMcauRNc26THaXYDJMlQQOk5LFV8nSvjjBY6lhpl8iHTa8-2BZAVd66QYu-2BAGQyWppWoRBWT7L-2BTSHr-2BsqdXmOHP4UYg1z8uXG3lYBHLrYyIBNtJaq_ZmF-2F-2F5HZlwqmSUfbmN9RNA2UqmKCFwYWqFtcK3RvHEHspW-2Bec3IZESpjjmEfJ6dpjEEM6UIx6mt-2FY5ZCGX42hAkM6KEFP6FKmu-2BUeQ7fiRxJpQ7cFTM3IeJmDJXrqCnYBjor5WuIVBvY4fCExr-2F4636FfwWGI8-2BITVZTKFLY1A7USSiPMwVFiTIMDJdSy5mo61ERM6xMoST3dQGMgM4kpA-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8558c728,0x7ffd8558c734,0x7ffd8558c740
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,4560887951048164148,13580650775236240127,262144 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,8087308868912107707,1379278277216898892,524288 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,15369154357332749594,3637198245246056670,524288 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,16359018640386367031,17454545573295882119,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3032,i,2302198937875876477,15840598558161099822,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,4300215006807835140,13932872494968523997,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,17823161806885895347,2630005463538437964,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,16858600407194840930,15911497469167162781,524288 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,5408355876028095424,13661523957059778092,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4732,i,8132065386447561953,16448940449206886557,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,8533408986140970916,941824821461125011,524288 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:12
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3036,i,12545691185788925793,7600492613631837611,524288 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3204 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3864,i,1167988280469018962,16390070707996240421,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6000,i,17415493430085959093,16422380717898761461,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6136,i,17578404274867978548,13021324662677628696,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3084,i,15202674824137584485,17483967344175972727,2097152 --field-trial-handle=1888,i,7687703842401254267,11599492937922718711,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 38b062fcb99e93cbc05bb043c4308ff697474d87ceca570d57d5b1ee9f2a1dee
MD5 70e6ce69bd33068401dda0f240078e1e
SHA1 a5f6d31ac71b76b04078ef25cf87aa0c2cba2c09
SHA512 990ce9e2aae91e55944c91bfc8247748ae99cface6ee55ac130d7df1145fe446e9828267792a93ff4edce32f4484389774b1a04cf4bc0fb28a7dc1930fe4aac5
TLSH
T11FE02BBADD20DD2B0CFD475854640B05E65013572A40899F3B3C970E8FB9A36069585C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cbe378bd01b3afb3a8ee59f25279147070e1221f3f8ebc4fa29d2d4820b06e28
MD5 73a5834ddf4d7eb8873b427a10d57388
SHA1 5f7bb29eb6286eafd4df1cf284cba2e6d0b8578a
SHA512 eeb07a96945d351ea2c2050f24edab6d7447af45854e7f0cb0cfa851c417353af21bc1ba65789ba3f48ae033fee644b44b7e6b44da05b62a02312bec26e5d945
TLSH
T13F416AF7C3D8867D8900A2F8A7256E1FCD2D0A25522C3C56D8D4AE9B53E28B1D25055E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 41f4223fba19f4f72d7c0e7e2f91028a20bf1814941702fbfb001b7e8efb4f03
MD5 f5d6d23f4b8f17c0faa045c9be3744be
SHA1 a847ebb165a3ca2418346462bdd0428cfd729fde
SHA512 42a68d33a1207eebcabe9249823beff736fefb371e67e6619afc8b76ff6b6b1e1e6e489a13a5603cb91f13ae5dea858247b47cddb366a73696d05699135f6a58
SSDEEP 192:kRGkOx2j5v7BpAPRp2Kn92HH0b+WNnm1X9S42tede/+VyIsnAUge:kRGkJZdUXVwIgY42tL2e
TLSH
T1BC42C52DAD24757B5CDBD22AFD297B53E3F6102220942E84EAFC897D15EB9CC2113817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6b7cee8b1a5eb6f1d44c20ace754a545db0a1024ec3af9927adcfd7fb5491934
MD5 6ebf767a844f07086ae64536124c4a52
SHA1 dfdc2ed2621b56af7ab86ee74a08835c5544579a
SHA512 3d3a2843ec32079f785bc015a3dfab1b143f21902675eeccd9fb84c1a22147178feb9f7d146c1c8203d46344ff8432180128aefaab9fd51e9a50a3c74b2f5ee5
SSDEEP 384:Uijon7KxkXqKf/pUZNCgVLH2Hfgsl3i7pLuLceSijXODoL+ErU3pTHGsUXIoi0lA:Uion7KxkXqKf/pUZNCgVLH2HfgsFi7p9
TLSH
T1D1721A677C4C993B0F94C9CCDC2A7E4FADB5024B61E9886483FA5C2A03D5ADB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 5523fc6f850e8bda816159b8cf9035f135fa7f2eb9cc1d0d9f3b4a2235283eb8
MD5 e3310d77215b3aabedddf0fa754c2788
SHA1 13a5258548492180fc2c08f10bbe93d5aaf4b0f4
SHA512 b8be90a61d95503ecbd710dc57f21c8876cb5629bc6dab9bb16827521287fc0b4d8d3e267a90b3df58a7851370f3fc38e61a063ad4304a384c135d9495efd58b
SSDEEP 3072:z8H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:zEt4fLJ0L6nGJxi3bzqapJja
TLSH
T196D302F1D1E06C7ACBF7EE4145796E908F71D5C689C9BE2408FD881816CEA344A13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 731f40dafbfc307e131c64bb0053b1f1fe23113001a55034f00cff122ccdf685
MD5 a626053e10754a3bcc89f3fb2fde67bc
SHA1 1b5e7a63833ad4c49cef6d8c95829f2c8afebeef
SHA512 4dcccdcaa981a72ecd855f36f121823fe7ca804679fe5a50613214bc4a01a215eacadc275067215fe6666c5a16a084db9ac0373c51b6ab846460a7b00232406d
SSDEEP 3072:zqH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:zKt4fLJ0L6nGJxi3bzqapJja
TLSH
T1E9D312F1D1E06C3ACBF7EE4145755E908EB1D5C689CDBE2409FD895806CEA384A13E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download