hxxps://tinyurl[.]com/bdea7bwy

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tinyurl.com/bdea7bwy
Sample260929-skqzwsshpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1292	chrome.exe
1292	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 4988	1636	chrome.exe	86
PID 1636 wrote to memory of 4572	1636	chrome.exe	87
PID 1636 wrote to memory of 4572	1636	chrome.exe	87
PID 1636 wrote to memory of 4180	1636	chrome.exe	88
PID 1636 wrote to memory of 1832	1636	chrome.exe	89
PID 1636 wrote to memory of 1832	1636	chrome.exe	89
PID 1636 wrote to memory of 4596	1636	chrome.exe	90
PID 1636 wrote to memory of 5056	1636	chrome.exe	91
PID 1636 wrote to memory of 4596	1636	chrome.exe	90
PID 1636 wrote to memory of 5056	1636	chrome.exe	91
PID 1636 wrote to memory of 4608	1636	chrome.exe	93
PID 1636 wrote to memory of 4608	1636	chrome.exe	93
PID 1636 wrote to memory of 4132	1636	chrome.exe	94
PID 1636 wrote to memory of 4132	1636	chrome.exe	94
PID 1636 wrote to memory of 872	1636	chrome.exe	95
PID 1636 wrote to memory of 872	1636	chrome.exe	95
PID 1636 wrote to memory of 2548	1636	chrome.exe	103
PID 1636 wrote to memory of 2416	1636	chrome.exe	106
PID 1636 wrote to memory of 2416	1636	chrome.exe	106
PID 1636 wrote to memory of 5056	1636	chrome.exe	107
PID 1636 wrote to memory of 5056	1636	chrome.exe	107
PID 1636 wrote to memory of 3900	1636	chrome.exe	114
PID 1636 wrote to memory of 3612	1636	chrome.exe	115
PID 1636 wrote to memory of 4904	1636	chrome.exe	116
PID 1636 wrote to memory of 4268	1636	chrome.exe	124
PID 1636 wrote to memory of 4268	1636	chrome.exe	124
PID 1636 wrote to memory of 4972	1636	chrome.exe	126
PID 1636 wrote to memory of 4972	1636	chrome.exe	126
PID 1636 wrote to memory of 3012	1636	chrome.exe	127
PID 1636 wrote to memory of 3012	1636	chrome.exe	127
PID 1636 wrote to memory of 4824	1636	chrome.exe	131
PID 1636 wrote to memory of 4824	1636	chrome.exe	131
PID 1636 wrote to memory of 1292	1636	chrome.exe	132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/bdea7bwy
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0184c728,0x7ffb0184c734,0x7ffb0184c740
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,6649588280055709635,12551516014727607107,262144 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,17278044457819277674,9992611275913415429,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,3565065477523864970,3367369294751192674,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,8212063095688620477,5182017397584493179,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,7854763262001299552,7782570723074783301,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3200,i,3500299668905430568,283957608340517662,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3476,i,10072253721314726063,6693064645494366252,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4688,i,16945034827826555319,420911402988187634,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,1900415015839853940,8700029159635098009,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,9239595042046363185,2848587017071501699,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3236,i,6744390569117168341,11604652565627566624,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,10061367324727899379,12262502226255988677,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,8859873260061125981,15315620630466452532,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,9589114526307528031,8193820654284977935,524288 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3956,i,12205029625230791936,3150661485095752891,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6196,i,9026766235870418834,12848861071234614142,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6304,i,2054357771594712922,16770901497564616906,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6196,i,4409287114359802260,18130571147874988059,2097152 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3388,i,14436242348674647785,13167216428703234426,262144 --field-trial-handle=2016,i,1838983082132368984,12511081341446129811,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3f22c4c28dddea70f059a51aeb112904a8f8d45f7cf15abd5a0834a094c39c51
MD5 9f28000536be4e4c190f36d52c312afd
SHA1 7427b5917489484490c24a7124dc5fd7a50eaf45
SHA512 773faf848c308ba17a9ae15609e181902dc7fe5ffd29d398e02381cdcacde28a9e5927b54d3c9e5f3cf9465eea0ef363dfa886ce3b98e5c28ab6b317a9fb7ae7
TLSH
T11EF0F4B5CC21EC3B2CFC5B1920A4474AFB9013572681995F7B3C950D8FB563B868681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 3ce295876c2198c820cbaffbe10d236507fbde5bed1338e83b27fdf346cfbbb5
MD5 18dcba1e7b57d08bcc63e478c3c12b86
SHA1 646d53c5634c9be2b617f94a91ff989f1faa10a5
SHA512 9e6964a9a49aa84d23577a043dbbf5eff0fb8a795a0bd71216d8d7ce9124a37284400407154efb516f614be0d99a9d5cab12dc48ef1884e99e81a727e967740e
TLSH
T192C09B8155E52001F78551FDFCF11754353365AF4656465B805818D57D92295F544005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 04fc1b799b0a8ab9571d731514ad976f9df3ca455f1c8c6149a6d4f8d7989d14
MD5 c3ac532fd062b5cb4057343cfa2879ce
SHA1 202c9df535906934391ba980c5e499bca6d9bb30
SHA512 ecbfe7787edbeb1a56c19b18f1f2763d90767fbcf8ddc612a6b1eb8fc2042ebdf93d776c6b88d369f36ef4398e0381afbbddd4cbe77133fa626f6428d20c255d
TLSH
T1D2D0224021A62011E720007DECF05F48333240DB8E20122FC0547CED3DA23E4F24008A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 e258dd936a316ddd8b2abe58165c18a8526bb5e29f60f7a28212ca4b059b54aa
MD5 5ff9fba6d7fa4dadf63bbbfff233c31b
SHA1 42363c0ee8f2f0fd452d07665ed84efcffedb4ce
SHA512 9112d7499dae6c00dd7422249d6dea303c0876291d96083f4c335513ec17c62429d53ea543d82248d092aca2e1c4a34d17c840c69eb1cc1cb781b6234b726301
TLSH
T183D0126030911815F751197DDCF117183762945A45221A6B90A068E9BDB23E6B54414A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1a29cce1665e16f1a5cd83844587252de8fbbb76ccb6e86a12cb384b48593f15
MD5 62fc018078f8e992c1b390267714bfe4
SHA1 1bddc23fc98df2dbb350c927356e9efea68d5d1e
SHA512 c6e76abd6ed4de4311e1baf1250071b46adfc6a1a1db60613cd46fd15c738f0fb0fb2fb077f73c7a32f654ccd5f6c77782a28069bae75142271734cdfd21a83c
SSDEEP 96:DudIJZ+ZncDueSKhpuh1rdNL8s4BmexiNQ1:DEIJZ+ZncDuxKbArdNL8s4BmexiNQ1
TLSH
T1EDC16BF7C7E4866D891152F4AA192A2ECE2D0958531C3C5AC8D8EF1FE3F6871E25064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4dd1be1fc03f7e79d33f33a5b2e5afc4ae2486590260644de000beb026d1a6dc
MD5 87cbf3e97cef7d18f6f1f01d97438616
SHA1 22e7ba6f3dc46ae27532bd5e494b1e16a477612c
SHA512 bab5c7d4944eeb11b14265aaeb0e95acc311094ee547aab8161c0d45334b2ec0b50508269e2a0e19d0cdc25710b23fed788b26f5dfe84c6b386f6c81078ee4d1
SSDEEP 48:YALlOBc4jIe4ZIeSIXI/SJh/sERswXLs5foKsofsbosuSKsc4shpOB4s9Imsh1Iv:DudIJZHncDueSKhpu9A1rrmxLcImXk1
TLSH
T160B17BF7C7E4866D891152F4AA192A1FCE2D0918531C3C5AC8D8EE1FE3F6871E250A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b41018d03b5393eb96e7a9c1fef9fd220999907febb1cd4f23b44f9a9573b8e8
MD5 6c08095f624a1f5866b43d35ea995da8
SHA1 6ea4e623b5d80283b5d74dc9a54e96d2cde4b6cd
SHA512 7cbb89e1d13d6c8e5c6575453dda89b2f511e71b853ddf86dc1ff0571b53287eadb8259773c5c307bca0dcd8b10c07eac5ee689eb4e76443219e57a0b2024da9
SSDEEP 192:XRFEDqyv71vAPRp2P9Ie9IHsb+WNn6Kmq82qEAsUkwLVyIsnAUge:XRFEGe56XA2wfw26Lte
TLSH
T14142B52DED14357B9CDBD22AFA21B757DBF6002561942E88EAFC883C14DB9CC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 47471d329b4e9f227a566024a55d715ef77b02c1371d32760723422ca9b402e2
MD5 b7011ac89050f4c9603ce63474db0454
SHA1 a67df2786e3ded95f118e0dc8884bfac238cc1aa
SHA512 de202f9ad3c8b4649e9f95eb5cf9dcd56a970715cbacb07e2a4523ef69849d1df68163d3db03e79eb106aacef0b0bfea3eacbc5b7a90692bbf719a4d8134a356
SSDEEP 192:XRFEDqLv71vAPRp2P9Ie9IHsb+WNn6Kmq82+EAsUkwQ8yIsnAUgE:XRFEGz56XA2wfw2mLjE
TLSH
T1DC42B52DED14357B9CDBD22AFA25B717DBF5002161942E88E6FC893C14DB9CC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2eef81b7766c99a2be4247f89318934298d5be4f111cb99017ae428a404ac122
MD5 0ca9d9f8ecebca31ac8b95532217b8ba
SHA1 773d9b19c31054a6d0d9f941083951136362fb1a
SHA512 194f7abb25c4bdcceaf8655fa44d32a4faefd4d2682cd27097d816c5f2b1c5db2375b7fafa546a2b885d6afdd37326528249f061541d10a5be219934ff4f684b
SSDEEP 192:XRFEDqb2v71vwPRpFP9I69IHsb+WNn6KmZpEnEAsUkwS8yIsnAUgE:XRFEG25aX32wf6EDL1E
TLSH
T1E842C62DED10357B9CDBD22AF925BB67DBF5102261942E88E6FC893C14EB9CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 33be8c09db6661deb2092415079da8d97ec4bf52d5b230d6f2d8e26232ef57db
MD5 dce6ff273a542725dd5e2970a8031a00
SHA1 3a5110241b9ee6b1a315ab1448db66d1ee9c1bda
SHA512 c5035035ed765fca18c427e310eee5c6bb3d1f5d35c3c4e5969ae2bc7655e531da760969f4ac739cdd35834b055a96a67a43c67bb93195d7555881933ae32dde
SSDEEP 192:XRFEDqev71vwPRpFP9Ie9IHsb+WNn6Kme6YwEAsUkwS8yIsnAUgE:XRFEGa5aXb2wfaYwL1E
TLSH
T13C42C62DED14397B9CDBD22AFA25BB57DBF5102161942E88E6FC893C14EB9CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 df374cde5b6a970a5a4a5ba0aea9ab5d78071cab84675798ae21c6db9572ff1e
MD5 ac1fe03497b251eb5e2eb72781f22f81
SHA1 121366e78d258ccc7ecc25017b264d7b9095d9f3
SHA512 91fe7d4b4455f8fb54b0846516d8c0481e3e1956527f4b0c9d08f3ff7a0e38b78a5fc047442f2a1604d05a27e466103e08afe477e6e6d052fda855abb70d0104
SSDEEP 192:XRFEDqfv71vwPRpFP9IK9IHsb+WNn6KmZpEnEAsUkwS8yIsnAUgE:XRFEG35aXj2wf6EDL1E
TLSH
T10A42C629ED10357B9CDBD22AF925BB67DBF5102161942E88E6FC893C14EB9CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 253fbb8e1307a6043a37b86932f2fd0c91fe47c77846b881a0c2332afb9668a0
MD5 41c12b3358b839cb3bba197298816c7f
SHA1 055e186c9690285b4a446b015cb0f5823a4724c1
SHA512 471060ccb3604001314e2ae3c6e6719760aed1089403e5869b3a084a0b83a2c32071c1c623a58903b4e0cee9a2fdebf50c45b93d5758e3bd159fb9599b493a28
SSDEEP 3072:QD4+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:QD4+hFD+7t56OD9ZfSApprr
TLSH
T161D30232AA55D877C9FC6541F147A304DE6668ED81EE2A0D844A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3ece5f11dd5b1cc43e6115bda7ce9dc5a061a9e12fce403d253d863a5570e1f9
MD5 6979998ad56b1f3c1b012be725941b96
SHA1 156cc9c18e7d12e421b6d55babfdc332500dad1d
SHA512 f6c717859a7f6c1cea89fd47cdeacf5662210668563d6702895fa9225c8b360414c78093c3d37ac196c5eeb404a4282ab000815745d7131fc48bf6f453829665
SSDEEP 3072:dq7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dq7+hFD+7t56OD9ZfSApprr
TLSH
T1A6D31232AA95D8BBCDFD6541F157A304CE62A8ED41DE3A09444A5F8ED09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 68d065a3299654ff1ad6a19369fc0daf17b32c7382a2dc0d214381a0e065885f
MD5 4c6bfac43a9d7eac453fcb957c8cb25b
SHA1 6765daf04b3b7e199b56d4ed901af3a02a905813
SHA512 981095df1de6b68fae4bf107969fa390954227491e90707420a12f3765f357bb8083ef3657d6618744672b45fd07a9f4da153788e3a40f0981b4ceb89faed9a4
SSDEEP 3072:Qq7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:Qq7+hFD+7t56OD9ZfSApprr
TLSH
T10DD31232AA95D8BBCDFD6541F157A300DE62A8ED41DE3A09444A5F8ED09FD4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1256baa2dce46258fbd5eabafb014a5ac7dec2794470ba29e308bf10f120e5bc
MD5 5ba790f9d689511a57781ddaf83a1b85
SHA1 ace401b20a1e00d20053bcb356971bed0b06eb03
SHA512 1df1d1b3ec4ae639e7aa0326760cfa1c18fc2abbfcd334a387b1234525b7e27ce47caba0ec98c1af0e15b520f690c3c4ed50b465809d5f8cb3af5148a37a01af
SSDEEP 3072:d2++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d2++hFD+7t56OD9ZfSApprr
TLSH
T1DAD31232AA91D8BBC9BC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C06B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download