hxxps://url5751[.]acue[.]org/ls/click?upn=u001[.]8Sk-2BdC1oCOsjzhpc2qQ-2BePJ-2B2EVa2HppockG4cl1DN-2BmBBVvcVnEVHgqLev2XSA871VqpmcobDkAzPbMT-2Bu-2FKQgCULUToMY245gIXCn77FOrusnGTUk4BsEXZ4-2BWg6hEXUP6sMJrOVWj42qvOeBczlUFA-2FHj6jaVyXGXM17mb0ws8BeRY-2B5Hjuzc8gSKimbFOLdKoJZIl1Z-2FyBN8aFhrFX3qxv89dzBsFA22qxVmwtZbKHspuSfvhh8tuttoF1eQjrNIB5W9F9w5jGi7-2F2AWKvVxWFsy04iLqOuG9nkhGJNMk0YouMCRNuXPmtdgpsIuFtEZvlLuI-2FX4B7UIMlPB0KhvZsSBLwUmVvZMOwShfoHCmI1UE7ITJbEp3gLro5NvIEgmBtM-2BmZAUiBby87zOGZs4tQd8wdYxWg9h2r7UzfRExKHVlfKSTErSf-2B3lsuz2AvryIzASzW4UGru-2B1YoZgIabdS8FCBBs-2FT4-2Fo-2FUpQjZQj1gKiF60tFtrQyLLtDqgcnOapdDhfV3Js8gAccybbLDe5niR9xY9M-2FpqWdTCUxm5zWgrBPvp3hsiLbka4OJIaixMP6LEivPSYdrc7cE-2FoSZoDfBPpuxd26fKdd4aQvxFQRBOQoHnZ1KEBEhgpmP986N-2B1lskTxHoi2rt4pOwEfrp3-2FranSneqT7nKdLgcBZv6Y19FCXNzNVJvDEsSf8JX7k1kSM0OK3qwr-2BayTu0N0A2UdHQz0Mq6oHLJMMfg1q2BWqNH5m54sfDIuE5A8DSNDs1AymP3XAlpYsqBMAqBly-2BRFkcmeDWeOkTLzlNi16tdb6B-2FpRk4qMHUZIojRO0LnQ8soT4jJoJ2AXscpke2bK1i6LruOrH41Xdi9KIrfrTUQRgOFnxJacrhEIhW26JKuPJN98xJYKX-2Be26aRM-2BkYIru8zLExCSGUBn-2BuiGUriVw1-2FC9FS1HO0jlkHQCrpypYOe6qfYYG5gY2KmfLUSNXj1dN1MNtxBcAhS7B4bi-2FJfhWhlKStvKdzFXuTgbN8QANmSBQe6jcA96ARX8U09yvajeHRiQnWrn-2F3N7GyWeZpDrRL8eKBNFiLf9-2BzYbEleBqOAJiOP62VNAo4in6fCZVZuwxj2SRX0f3FnNfVcA6uRF5ppf15kPRaMEKLOk5exBH7kVuomczdhcCV4Ksmi-2Bg-3D-3DVrv2_fTl-2FO8gP7iMUemMIXoAs03Xn5aRJJ-2BosUHCgUpYkn935KsarLGp80enjdof7ArjfX2GO1-2BFzZmroVRFXtwiX3eNXTmFj1Zmd-2F3dPXczFLQOZh2T81Kw9-2BqNfz5JxfkVjNdsvOVYR5vB0Iam0Eab44MGh1pfv-2B7KS-2FYLmt6jiEVhIdaL-2BFn1yIRlz-2Fd7jgaIJFs0WKKpNxll6QXqt973A7w-3D-3D

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/09/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url5751.acue.org/ls/click?upn=u001.8Sk-2BdC1oCOsjzhpc2qQ-2BePJ-2B2EVa2HppockG4cl1DN-2BmBBVvcVnEVHgqLev2XSA871VqpmcobDkAzPbMT-2Bu-2FKQgCULUToMY245gIXCn77FOrusnGTUk4BsEXZ4-2BWg6hEXUP6sMJrOVWj42qvOeBczlUFA-2FHj6jaVyXGXM17mb0ws8BeRY-2B5Hjuzc8gSKimbFOLdKoJZIl1Z-2FyBN8aFhrFX3qxv89dzBsFA22qxVmwtZbKHspuSfvhh8tuttoF1eQjrNIB5W9F9w5jGi7-2F2AWKvVxWFsy04iLqOuG9nkhGJNMk0YouMCRNuXPmtdgpsIuFtEZvlLuI-2FX4B7UIMlPB0KhvZsSBLwUmVvZMOwShfoHCmI1UE7ITJbEp3gLro5NvIEgmBtM-2BmZAUiBby87zOGZs4tQd8wdYxWg9h2r7UzfRExKHVlfKSTErSf-2B3lsuz2AvryIzASzW4UGru-2B1YoZgIabdS8FCBBs-2FT4-2Fo-2FUpQjZQj1gKiF60tFtrQyLLtDqgcnOapdDhfV3Js8gAccybbLDe5niR9xY9M-2FpqWdTCUxm5zWgrBPvp3hsiLbka4OJIaixMP6LEivPSYdrc7cE-2FoSZoDfBPpuxd26fKdd4aQvxFQRBOQoHnZ1KEBEhgpmP986N-2B1lskTxHoi2rt4pOwEfrp3-2FranSneqT7nKdLgcBZv6Y19FCXNzNVJvDEsSf8JX7k1kSM0OK3qwr-2BayTu0N0A2UdHQz0Mq6oHLJMMfg1q2BWqNH5m54sfDIuE5A8DSNDs1AymP3XAlpYsqBMAqBly-2BRFkcmeDWeOkTLzlNi16tdb6B-2FpRk4qMHUZIojRO0LnQ8soT4jJoJ2AXscpke2bK1i6LruOrH41Xdi9KIrfrTUQRgOFnxJacrhEIhW26JKuPJN98xJYKX-2Be26aRM-2BkYIru8zLExCSGUBn-2BuiGUriVw1-2FC9FS1HO0jlkHQCrpypYOe6qfYYG5gY2KmfLUSNXj1dN1MNtxBcAhS7B4bi-2FJfhWhlKStvKdzFXuTgbN8QANmSBQe6jcA96ARX8U09yvajeHRiQnWrn-2F3N7GyWeZpDrRL8eKBNFiLf9-2BzYbEleBqOAJiOP62VNAo4in6fCZVZuwxj2SRX0f3FnNfVcA6uRF5ppf15kPRaMEKLOk5exBH7kVuomczdhcCV4Ksmi-2Bg-3D-3DVrv2_fTl-2FO8gP7iMUemMIXoAs03Xn5aRJJ-2BosUHCgUpYkn935KsarLGp80enjdof7ArjfX2GO1-2BFzZmroVRFXtwiX3eNXTmFj1Zmd-2F3dPXczFLQOZh2T81Kw9-2BqNfz5JxfkVjNdsvOVYR5vB0Iam0Eab44MGh1pfv-2B7KS-2FYLmt6jiEVhIdaL-2BFn1yIRlz-2Fd7jgaIJFs0WKKpNxll6QXqt973A7w-3D-3D
Sample260924-ermn6aydrc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3892	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346966613976616"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
5876	chrome.exe
5876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5236	4656	chrome.exe	83
PID 4656 wrote to memory of 3892	4656	chrome.exe	84
PID 4656 wrote to memory of 820	4656	chrome.exe	85
PID 4656 wrote to memory of 820	4656	chrome.exe	85
PID 4656 wrote to memory of 4800	4656	chrome.exe	86
PID 4656 wrote to memory of 4800	4656	chrome.exe	86
PID 4656 wrote to memory of 6036	4656	chrome.exe	87
PID 4656 wrote to memory of 3816	4656	chrome.exe	88
PID 4656 wrote to memory of 6036	4656	chrome.exe	87
PID 4656 wrote to memory of 3816	4656	chrome.exe	88
PID 4656 wrote to memory of 6120	4656	chrome.exe	90
PID 4656 wrote to memory of 6120	4656	chrome.exe	90
PID 4656 wrote to memory of 4348	4656	chrome.exe	91
PID 4656 wrote to memory of 4348	4656	chrome.exe	91
PID 4656 wrote to memory of 3296	4656	chrome.exe	94
PID 4656 wrote to memory of 3296	4656	chrome.exe	94
PID 4656 wrote to memory of 4916	4656	chrome.exe	98
PID 4656 wrote to memory of 4916	4656	chrome.exe	98
PID 4656 wrote to memory of 476	4656	chrome.exe	100
PID 4656 wrote to memory of 764	4656	chrome.exe	104
PID 4656 wrote to memory of 4944	4656	chrome.exe	105
PID 4656 wrote to memory of 620	4656	chrome.exe	106
PID 4656 wrote to memory of 5876	4656	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url5751.acue.org/ls/click?upn=u001.8Sk-2BdC1oCOsjzhpc2qQ-2BePJ-2B2EVa2HppockG4cl1DN-2BmBBVvcVnEVHgqLev2XSA871VqpmcobDkAzPbMT-2Bu-2FKQgCULUToMY245gIXCn77FOrusnGTUk4BsEXZ4-2BWg6hEXUP6sMJrOVWj42qvOeBczlUFA-2FHj6jaVyXGXM17mb0ws8BeRY-2B5Hjuzc8gSKimbFOLdKoJZIl1Z-2FyBN8aFhrFX3qxv89dzBsFA22qxVmwtZbKHspuSfvhh8tuttoF1eQjrNIB5W9F9w5jGi7-2F2AWKvVxWFsy04iLqOuG9nkhGJNMk0YouMCRNuXPmtdgpsIuFtEZvlLuI-2FX4B7UIMlPB0KhvZsSBLwUmVvZMOwShfoHCmI1UE7ITJbEp3gLro5NvIEgmBtM-2BmZAUiBby87zOGZs4tQd8wdYxWg9h2r7UzfRExKHVlfKSTErSf-2B3lsuz2AvryIzASzW4UGru-2B1YoZgIabdS8FCBBs-2FT4-2Fo-2FUpQjZQj1gKiF60tFtrQyLLtDqgcnOapdDhfV3Js8gAccybbLDe5niR9xY9M-2FpqWdTCUxm5zWgrBPvp3hsiLbka4OJIaixMP6LEivPSYdrc7cE-2FoSZoDfBPpuxd26fKdd4aQvxFQRBOQoHnZ1KEBEhgpmP986N-2B1lskTxHoi2rt4pOwEfrp3-2FranSneqT7nKdLgcBZv6Y19FCXNzNVJvDEsSf8JX7k1kSM0OK3qwr-2BayTu0N0A2UdHQz0Mq6oHLJMMfg1q2BWqNH5m54sfDIuE5A8DSNDs1AymP3XAlpYsqBMAqBly-2BRFkcmeDWeOkTLzlNi16tdb6B-2FpRk4qMHUZIojRO0LnQ8soT4jJoJ2AXscpke2bK1i6LruOrH41Xdi9KIrfrTUQRgOFnxJacrhEIhW26JKuPJN98xJYKX-2Be26aRM-2BkYIru8zLExCSGUBn-2BuiGUriVw1-2FC9FS1HO0jlkHQCrpypYOe6qfYYG5gY2KmfLUSNXj1dN1MNtxBcAhS7B4bi-2FJfhWhlKStvKdzFXuTgbN8QANmSBQe6jcA96ARX8U09yvajeHRiQnWrn-2F3N7GyWeZpDrRL8eKBNFiLf9-2BzYbEleBqOAJiOP62VNAo4in6fCZVZuwxj2SRX0f3FnNfVcA6uRF5ppf15kPRaMEKLOk5exBH7kVuomczdhcCV4Ksmi-2Bg-3D-3DVrv2_fTl-2FO8gP7iMUemMIXoAs03Xn5aRJJ-2BosUHCgUpYkn935KsarLGp80enjdof7ArjfX2GO1-2BFzZmroVRFXtwiX3eNXTmFj1Zmd-2F3dPXczFLQOZh2T81Kw9-2BqNfz5JxfkVjNdsvOVYR5vB0Iam0Eab44MGh1pfv-2B7KS-2FYLmt6jiEVhIdaL-2BFn1yIRlz-2Fd7jgaIJFs0WKKpNxll6QXqt973A7w-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd877dc728,0x7ffd877dc734,0x7ffd877dc740
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,12232729962199052761,10248477751063614419,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,5400967283331167233,3789857839989136472,262144 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,9276576698329100753,7164078216131474933,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,3149077617363633364,15909308144869207939,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,9836580840756261336,16338609765722245762,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,12401522188438371503,12879431361104124484,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4428,i,3560376715234366142,11652098765400120909,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3956,i,13075123835758109646,2069843481589335075,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5460,i,9050287969329999404,11034049069554436112,2097152 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,12222999323558053955,12530513233775016745,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,10861366079985265001,8851881608014918262,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,11003616276196185100,10787511205983921853,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,11746050251527408957,14519178136914424129,524288 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=844,i,4841802571620701189,14071488728234903493,262144 --field-trial-handle=2060,i,7253294586657009950,4409156098877303259,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 953e71919d00d0dec264aabb2cf716c27a5c3cd67baa38f7429057a2cce6f3d6
MD5 120370c73c898ee929be9758d090c4f0
SHA1 588c2a50774a554fbfd49c0cd47a9c62ad188a9a
SHA512 2491627e856a350386e242c8ddc569285c298230c7ddd12309c85500b79cf8607ff1cad9ee570b697f60fa79344dbb746a39248d6d63665b117f19527880fa91
TLSH
T1C8F0F9B5DD21EC3714FD471870E50A4BE741132B2780954B3B3D811D9FB1637469685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a3e5c94edbabe27b07ce51aef5a8f977263037b0cb444321ae43fb82b5d1913b
MD5 e571e41802693855f3e27091b1d28e89
SHA1 f55382d3b33d75372953c912f38723283c1da687
SHA512 8ffbc3986cd819377e3c408984fb6ab47ff15aa22b2e223c6b5132bda5c98db8467f0a0a75ee152f0e58a961269aa172b13a747fc95c01fce7d400431b20e0a4
SSDEEP 96:D29nTYyVDh1Ef76aVDiyp1G2GTGBXTauOK:D29T7Dh1Ef7fhic13y2X2lK
TLSH
T1E291AFF3C3E8863EC91195F4AB156E1FDE290918532C3C5AC8D4AE1B97E28B1E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b885d62f77430bc7889dff434fbe028ad002c70bed5d23dd99b7aad8f6bfb35e
MD5 06004ee0313944a1f1405265b96a3c4d
SHA1 014d5a863e6040e12bff5cbca6a75cb2365032bb
SHA512 7f8576887e2841aa0b1701cf5feb3a90047bc7bd31f15ca05b551a69a7261a954d2e078524647fd4541aae1931ee4d67cddac3e73c2878c21b6ff5cf4af053bb
SSDEEP 192:ARk1u3j1av7upAPRp2KPf9DHsb+WNTj61la8r21Xe2yYTP7kwJmVyIsnAUge:ARk1q2yUXNdwyF2I2z8e
TLSH
T1C142A53EEE10797B5CDAC26AFA657A53D3F5102535902E80EAF8893C35D7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 97bc66b4f155b0c7d1c1155ae8d3954a623213984f10f23f42e9e1fb19904a17
MD5 2be92c7643ba48fb4aa831b67bdf1af3
SHA1 79be648a0d33bdda874579b35bc4130d1a99c838
SHA512 807a577b54aae138829b44e4a6f8d45c0e84793dd9d5979325f6c50c10138ab57dbf6926083a46c29ed6ca492c7a21eb9c9bcc6ee1ce6172001f1ab91694f4d2
SSDEEP 384:KkjuF7KxkXqKf/pUZNCgVLH2HfgslxH7pLuLceSsNXODuF+ErU38jHGPQB7IYjL:KouF7KxkXqKf/pUZNCgVLH2HfgszH7p6
TLSH
T109721A67BC4C9E7B0F94C68CC8177E4FACB5025B65E9886482FA982603D5BCF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 eb6ad6be0cfb60a17a7294ad374211a6c5d6c76ca0a1758cc5f14d35655371d1
MD5 8903a697b693ef58787575ba39eea20f
SHA1 b28f8a1dd55752fc719ba4ab24eb9f5da8939ead
SHA512 322464ca2f241d829845f2d692a09de96a0dcd622ea8de3772b0c9a1ccdfa0e09ae731e14e2e7e5c3c334b24ac0388abce28b78469ab558a32ae80576829c945
TLSH
T136B0128480827382D00302F81194258C3198EF14E607134261F00E419835161802B254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ff99.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ff99.TMP
Size 96B
SHA256 697744c353c52f540e46defaf6583771cbc6b4787af5dbf55538b25a7dfe3b58
MD5 69ef44155dac3269449deea945d7eff2
SHA1 7bc0252398325e58024396747d3895d7a46076c8
SHA512 73cdc1bdbf39ceeb564299bd750b8cbdc52b90acf81993e4a2e24c2f5eb758939fbaf991d94d0b96146dd803cc23230eedc16e5a2cecd0bc730e053ee37133d3
TLSH
T176B02220C0032323C00303F0288E80C8B220EF28CA230E02C3E00F33EC2333000B2820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 177KB
SHA256 9e3ea95f7e36ccb8b2d6021f4472187ed384e1c77125ba85b43e0e19325df717
MD5 aa907469c83a0610cc7c8908ae1ff046
SHA1 d6242ce44a4800ac7e0bfef25a90afae8894051c
SHA512 6522f0048b0864fd5ed9e946ec8147f432743f10ac35a3b24b8d722f7d2b12dda9b64e914c936faf0f38d274e2f4d2f3a09ff370f794978faedd81c7d3d79a90
SSDEEP 3072:718OziwjkCtCQEkrKjIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+L:71LhICfALPtbmf1K49XLWbEPi4NTKlL1
TLSH
T17F0412713E11BEB48A9FEB91B1945709A6F4DC1B92793AE15CDE3E491993EE8C300C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b52a016cc3614846a5d3844614f43da6661ee55d65be4fb957e1b109821f3ebb
MD5 93ab8ddc8973668e8a9a44f99ce3783b
SHA1 716bdbafd91c1bc744ec1edca74e6a38cd9789c4
SHA512 7e4dd65cb94e02f2053d66666c60c3eb985c75622c28c35a2c0d19524f0d47ca5aa6782774ac23ca4dcbf3bc5e4d9783e96d6ee146462b22eeac2fd287566037
SSDEEP 3072:AIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:cPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T106D312217D01BCB8A9AEDB21A1901E15EAB8D94B953D3FE61CDE3F8C05A3699C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 f1e935b42d17145ff76065d9f3e5378f8aaf64c34738b3a8d2e93c3571efd8a4
MD5 4ffa040269a83815db42fd3216a87cff
SHA1 1d7b07c325226626472fa8e1b74d86f3ba28ca74
SHA512 f35fcf4c4f90181f6f3f3d8fa707439782418111f7c0aaaa5e0c2817fee2ad26d8a4db931afc44f5d60fafa4fb446f8570b6b24cf6abc4e1d1a227d71c632363
SSDEEP 3072:RIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:9Ptbmf1K49XLWbEPi4NTKlLz5
TLSH
T1FCD312313D05BCB4A9DEDB61A1901A16EAF8C94F95393BE65CDE3F4806E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 40a86d731aaf2f96ba709bdc9cd10ded8b0654240ebafe0d9a0d5e64801616d4
MD5 20b0f0c59b4259553d6007e395bd55ad
SHA1 6f3f3eb5f622cce2dbcc710bb4fab3e982627257
SHA512 52a5e15df4c24c9cde5205b17236c512856043eb72d9772af5d6aea448268da47e35e6563b60dc7555d71ab9fdecbf5bcfbdc77e4759aad4637e66899ef63727
SSDEEP 3072:iIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:CPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T124D312213D05BCB499DEDB61A1902A16EAB8C84F95393BE65CDE3F4806A3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download