78abe1816fa22677815e6b6866047a28ffb93a35f4551b68f7149750ed808e55

Analysis

user interaction
yes
max time kernel
110s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
APPLT-MetroBank
Size 5KB
Sample260421-kbp28set3y
SHA256 78abe1816fa22677815e6b6866047a28ffb93a35f4551b68f7149750ed808e55
MD5 273e664d3324db0724a99702a0fd2ff8
SHA1 4d8f6f64e0dd106a2b48638645d60243b5348fe5
SHA512 a3e7ea9a1da7cf677e33fbf6a2b7a598040267ffc0593fb50f2cb505ee59d046d4945ff47ac137e26b6830e08588f656373d5225b9147eb880b1bd056a68541c
SSDEEP 96:D7/w2/EvYcT83Lf5X+2L6mJp8K2MKMFRrujIMa65HMKsMtjcfGpPtC+AfSFmEj:D7o28h8j5XtkK21whujI36V/sccfG5tP
TLSH
T1AFB1A4124CACDC5B4753139378CB36155A5A124BA6C8CBE9E8E5CD3802C46C997BB64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212336137855942"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3824	4676	chrome.exe	96
PID 4676 wrote to memory of 3164	4676	chrome.exe	97
PID 4676 wrote to memory of 3164	4676	chrome.exe	97
PID 4676 wrote to memory of 3356	4676	chrome.exe	98
PID 4676 wrote to memory of 2280	4676	chrome.exe	99
PID 4676 wrote to memory of 2280	4676	chrome.exe	99
PID 4676 wrote to memory of 2424	4676	chrome.exe	101
PID 4676 wrote to memory of 4928	4676	chrome.exe	102
PID 4676 wrote to memory of 2424	4676	chrome.exe	101
PID 4676 wrote to memory of 4928	4676	chrome.exe	102
PID 4676 wrote to memory of 3328	4676	chrome.exe	103
PID 4676 wrote to memory of 3328	4676	chrome.exe	103
PID 4676 wrote to memory of 2168	4676	chrome.exe	104
PID 4676 wrote to memory of 2168	4676	chrome.exe	104
PID 4676 wrote to memory of 4384	4676	chrome.exe	106
PID 4676 wrote to memory of 4384	4676	chrome.exe	106
PID 4676 wrote to memory of 2968	4676	chrome.exe	107
PID 4676 wrote to memory of 1824	4676	chrome.exe	109
PID 4676 wrote to memory of 1952	4676	chrome.exe	110
PID 4676 wrote to memory of 2852	4676	chrome.exe	111
PID 4676 wrote to memory of 1056	4676	chrome.exe	112
PID 4676 wrote to memory of 1056	4676	chrome.exe	112
PID 4676 wrote to memory of 1416	4676	chrome.exe	113
PID 4676 wrote to memory of 1416	4676	chrome.exe	113
PID 4676 wrote to memory of 3408	4676	chrome.exe	114
PID 4676 wrote to memory of 3408	4676	chrome.exe	114
PID 4676 wrote to memory of 4652	4676	chrome.exe	115
PID 4676 wrote to memory of 4652	4676	chrome.exe	115
PID 4676 wrote to memory of 4292	4676	chrome.exe	116
PID 4676 wrote to memory of 4292	4676	chrome.exe	116
PID 4676 wrote to memory of 3868	4676	chrome.exe	117
PID 4676 wrote to memory of 3868	4676	chrome.exe	117
PID 4676 wrote to memory of 2244	4676	chrome.exe	118
PID 4676 wrote to memory of 2244	4676	chrome.exe	118

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\APPLT-MetroBank
1⤵
PID:4984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c826c728,0x7ff9c826c734,0x7ff9c826c740
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,198959796220867424,8653066755327602261,262144 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13106476307971273006,10865063952790767430,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,10878752839413566327,3993738992777593349,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,5669405124817651238,8194571245589845828,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,4226469190403594403,5453056792185866702,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,9688198357098631261,561490011742566590,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4544 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,12138264189328239888,8558565555863762656,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5432,i,4330457883975349084,4572166329367053939,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,15972713372250114685,11988231206351649562,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,2511313265295200274,2157085446735722388,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,11855422954510276406,9509310069997922142,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,13975122844546770672,14269775950765431739,524288 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6104,i,15552409896863530640,15263031346539341685,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6012,i,7672306217585577472,274363786295981328,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4608,i,15462481262767573594,6528357390081891104,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5364,i,15857108149897519146,10120852010100642872,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5144,i,10074186850463465420,8275018278993291724,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5052,i,2848441822707715054,4260810041274711658,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5364,i,2428350661814691156,11416975957934338388,2097152 --field-trial-handle=1904,i,2854097189626876430,381663793410152441,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 38e52b1402c9544441a093a854b30f745eb85f0ac1f24c8a0a0671de8ae56ad6
MD5 776d4667290f31801e0a09811bca3c8f
SHA1 f8fe8b9a95cde4caec1a280e5cc8f91ced06c662
SHA512 ec664cbdc9a6ecdc7b7f8bf8b4af1742f35d62f89ac5712a29cc49dec3d997bb7f0c0b7581929fb15e402e24343b3eff54b3c6d949a2b5ee1df389cebf8f8a3d
TLSH
T165E02BBAC821DC3F08FD07696061074BE700272A2BD0995F3E3D820C8FB467A0582C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c324aa6e3ae5d5b225b2c6a43f00cdb1c07b75886e25c478e0dda31b64424158
MD5 3b01b6b5d389e8023024538a9f62c8ab
SHA1 c056a6d744bbbfd22c863cdc0fa07fb2db58a4e6
SHA512 e1665d5da9f9206534b8081fd1e2812d14dd1fd723ed4bbd762fa4297dea46a4533390b4003360a0d0677646ee65de3907e3b50106280f8f75a9dc570cadd53d
TLSH
T1E1B0025412545C16CB9113715D95444136544B641726166141D151F886667754196645
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 cdba213ee98f402ad944717a37282322b32a7324cf4da4e892855dc77f478a16
MD5 d3e3aba83cd35bbbd1d1b9435bda166b
SHA1 2cddbecae9bebe1d279d944897741702856e6b91
SHA512 6feed17e2c4d874ddfbca9d009861f99cc559b69b0facce87bcffead2941506f652a4ec3d005715fc5fb04bd5225154b73d2c8d1776b4abb0b469b7e40914f00
SSDEEP 96:DxOdFEexk6gT6OfaIaWwvkSHCPgiiMBu6x9FE1Q56YFJ:DxOAexk6c6OfaIaWwvkSHCPgiieu6xg6
TLSH
T193C19CB7C7E8866DC91196F4E7147F1FCE29092943283C16C9D8EF8B93E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a43ba863276a6aef5a7a1d63f7d78eb453908dacf4ab54ac67d535c85985ddd6
MD5 e34452aba0200d72fb6b47ce5b6e6599
SHA1 6792a6b8987d275119a44f64b024f3307b7f617c
SHA512 c5cbce4bf967858feb20c27e4bdc2c45aeecd9b489bebe6f909e4353a08f7d8a5bee898fe38927b2c39cdacf71fc61a0faa72791081bd7d11c6e1c11ec2e71a9
SSDEEP 192:6RAmWve+7b2sv7CMpAPRp2u93Hsb+WNnV702WZAgkwoayMVyIsnAUge:6RAmke+G4xUXZxwx0hbIaxe
TLSH
T1CA42F66EAD14783B9CEAD319FA217757D7F5102121952E84EBFC8A2C04EB5CD222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aa6ce56e43f9b4bebf410a084f7981d366c3339ffd0c1a4700a0b686b719d802
MD5 eec175de17dc363399ff350213778180
SHA1 e394f4253e063ab420af03d03f8f0f5b1a2512d5
SHA512 9f93d89c8b12f93de9b44a23daf30376c3daa67561cc382acc8fe3d407afdaeccfd11379ddfd1ab2700de0490a46cb89bdd5a482a6357842cf0cfc7412504fe4
SSDEEP 192:6RAmWve+7bdsv7CMhAPRp2u93Hsb+WNnV702WZAgkwoayMVyIsnAUge:6RAmke+N4x8XZxwx0hbIaxe
TLSH
T18242086EAD14793B8CEAD319FA117757D7F5102161952E84EBFC8A2C04EB5CD222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b91f6f4648fdcb39957ba6d4c8010281c1d20bd9d595c70a6e9166073b032341
MD5 ea64b97dc730be5a516c7ccd10c37791
SHA1 013c823306b6b9f424ca14884629031598b361d8
SHA512 bfced06e6811516f1397f61e73ed6164ac801d30b8c981273c00228a3f43a1e60becfc1bc6300df5417cce3b6a94e95e933cf95a8699c8b6ba43b7ca90b34e9d
SSDEEP 192:6RAmWve+7b6sv7CMhAPRp2kM93Hsb+WNnV7j5/2nWZAgkwoaytVyIsnAUgraJ:6RAmke+q4x8XYxwxN2ObIaae
TLSH
T1DC52F82EBD14693B9CE6D319FA11772BD7F1102161952E84EBFC8A2C14EB5CD222B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7f4819efa82711062912d266b057929ff42d37798655c7fc259fa531e7760f5a
MD5 ad0a14390b0069c74ed917a8a8b39e6a
SHA1 cc0b4394652212c1c00f34e929a40ee4c200dcf1
SHA512 67d869f1c5dbf50bc77ff4380db0e5bb46f6befe40ccc66f350e723342f7bae88152ce42d841ea9d208434c5e167ba124ba507b9826deadcc984d1e76bb71938
SSDEEP 192:6RAmWve+7b6sv7CMMAPRp2kcv93Hsb+WN1WV7jpveHWZAgkwoaytVyIsnAUgraJ:6RAmke+q4xtXSxwOReubIaae
TLSH
T13652E86EB910693F9CE6D319FA11772BD7F1102161912E84EBFCCA2C14EB5CD622B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 180ff1c5a54f7a1d1ef25a63b8537db6ad453bc9443b55e986e43bf1e318a578
MD5 de3f3944e13f054924b5310312376019
SHA1 44cd68273e23468a859fb68e5fe73226261240d8
SHA512 a0da591214ef28d9232a3a125bf51ed9a1836d5e97a5d9dc26b3dc4219c28a5d4425416e95140e6ef28799580f9a862df59a4c0fb42b55ab0e11264d5eae2191
TLSH
T133B01260C0029902C09302B01287048831146F20D705230153E46AB7D82B5B14218350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eba3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eba3.TMP
Size 96B
SHA256 4beb769a06fd13fd321ca730d3957932105d0360d50bd664c5adfa63f44378f4
MD5 30981a4d065358cc0d3f0c582086dd82
SHA1 2c7a3f29c131175ab490522cbdd0877a40d142e3
SHA512 8b5d4ea8a86af69e483e4e973cab8bc9c986d07630f41c6e41566ecfb621762e4fa03a5b64d8e9be777df1ad67a771ded0feeac32667a4149bd7b4144f60994b
TLSH
T11FB00255C103B263D18303B4359696E8B1A0EF69D6035322B3F05B66ED2AA71452A162
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 233a2248c8f97d12a52b2d9f3ea528fcd345db82b338d0f3e44cf74cd8eea2f1
MD5 387c9ae4505b36da403268a1d1a0a41b
SHA1 9cab3c8b2b1968b04879b192edc74e3f0c741506
SHA512 50012c734071e85ba0ce5efa0717fa233f96ce73be24e2f91fd67bfb9b27730a5788f4f0d12502a19975f215be7ab8ce3cdff355ff3cfbd002d05e711d88c1c3
SSDEEP 6144:Qv8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:QT1WcLwrOjuGdF2A
TLSH
T1131413B7DB5649F395BC0A5135EEA80D8C22139970BD5A94A18C7BCD90D83C83B63E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 dd0a47f886f8bf9a0537e5b36c21a2fa65170704dba00fb09eda56fe548d3106
MD5 6c99cd7bca638cc80acee0b6d1be5b05
SHA1 494ede0923d5a8f0f26f7b5dd2b14fac22dae054
SHA512 12fe653fd158fad4dd27fc0457aec9558cc5f4dec8e26cd254c706c8902c48e5af9cfaba603fe781c0cdad532d9eea461bb366a35f9b487e7d95a04ee09988d9
SSDEEP 6144:QHb8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:Q31WcLwrOjuGdF2A
TLSH
T1FE1413BBCB5749F399BC0E4131EAB80D8C625799607D9998B08C3B8D90DD2843F63D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 33fbcf2202032159fd688b1638e563009b112d973fadd9ebcbefc9b81a4011ca
MD5 c35fa263a39cd77389919e271eed1da5
SHA1 1d3d034b9bf7f5abfdc98cff3547455792b6cd2b
SHA512 f761e3c5e536a6ce587f74a1dfd52dd267d417535dcade753fc1901875652fae6dd44c945aa6fc87fb3f9da2bfc91304b77046850d57ac3de8e399160d8661be
SSDEEP 6144:QU8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:Qg1WcLwrOjuGdF2A
TLSH
T1CF1413B7CB5649F395BC0A5135FEA80D8D22139970BD5A94A18C7BCD90D83C83B63E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 5ae09a35798bd06f14428f7113d2902570d541933dcb4b37e9a9d0a27d523666
MD5 8455658d63ddc5f29435d0a8acd7520d
SHA1 f8133237af3ed8d8aaccf0a6037835bd4993eb78
SHA512 449435fdcbf1b3c8e182e2593b092ab9d3d3ae3ca84ee9983f1f7875e8c3d545b5ecefde6d37cdab209c6a5ad3c5c5ed6d9fd7a1a0d601b5a314add1f660eaf9
SSDEEP 6144:Qeb8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:Qg1WcLwrOjuGdF2A
TLSH
T1741413BBCB5649F399BC0E5131EAB80D8C625799607D9998B08C3B8D90DD2843F63D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 f26977ec3641074ceb0027549ca7e035a1176f6f773ad38f4612281c9b92487e
MD5 1d6936df66117b67e32e07d28c6b9435
SHA1 c437e10896f0869d985d544f1c27303059d7316d
SHA512 dd0f059e5b2a58aeb0333e23b30c2cc78ab15d2a11d97a21299f25b0ac01194c9544f60688a4bc90be88b489023b56e2220114beb5e78ea6368e0af8802ea6a3
SSDEEP 6144:Q9N8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:Qf1WcLwrOjuGdF2A
TLSH
T16C14137BCB5649F399BC0E5131EAB80D8C625399647D9998B08C3BCD90DD2843F53D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 a969df87babd04fa2f666618cf49d5368d4a2a67fbc860d2983d56696e5e801b
MD5 656680b462128a6312ad309e133ffa0f
SHA1 fa84b8a9b83fb135bfacbe8b606d3be3ca38244c
SHA512 245bf0f1940c114811ef0e35358b7d7d80d3b84b258374fa3e651c493c81c7774aa8c96866e21d6e60a3ff77f9c22adf80628dd814647e4266a68e48e011f228
SSDEEP 1536:ip/0cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:a03Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1B99302BA4E2646E7997D4A8176AD7909CE12534D705FA9CC325C638C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b28c0cd5bbe88dd64f03e63cc59f27a7d6e4275b3471a6f46fc1a6e6b376be91
MD5 cf7b85b994fd5486c20a16b8eabcfb1b
SHA1 a1828998c87821b74b85fe562562482905c2ebce
SHA512 07615a73f4844e46d2a0f182b4eb39e7b4bc143ae11819cb7cfc5804c273d4a784b92fab513dd9b5579c640c84054231c079e528d122c33fc0c17e9edecf86c8
SSDEEP 1536:cpsAcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YL:xA3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T10D9312BA5E1646F799BD4691769E7809CD12134E709FA9CC72A8538C61D01CC2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 8553dcec12224e0a4004917ea1fe1d1571c60ad59d2c5c9b1f80bdecf47a18bd
MD5 b9b67e0ebc61a5552c8901cd9047072f
SHA1 f8ae0390ccff58c302b3274dcd735682f21d215e
SHA512 b87eef2e55bcf0f584cad6132ed3a7aa68161f51523e51a99e204a03baa13ce4d04c3c2bc2bfbf95748ae90cf3a07d50cdefbb122c1056d9f79223754ecceca8
SSDEEP 6144:QRb8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEEA:Qd1WcLwrOjuGdF2A
TLSH
T1711413BBCB5649F399BC0E4131EAB80D8C625799A07D9998B08C3B8D90DD2843F63D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download