c1469dea551c95d2c68eb42ceb37f020cb5b75d777e7083f24bf2e54ae2e4f55

Analysis

user interaction
yes
max time kernel
1049s
max time network
1026s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windows.ApplicationModel.Store.dll
Size 2.2MB
Sample260425-rtcyysds4k
SHA256 c1469dea551c95d2c68eb42ceb37f020cb5b75d777e7083f24bf2e54ae2e4f55
MD5 86f54a87a6260befbd8372fdd150b127
SHA1 8e92ff0b8ff2d1b0c2fbe59bcbb1705febadcbfd
SHA512 101756ef73eb4d8cd85d3151fa20dfceed4773039bd1951bf685b913ea7fa0c36df992a98f6d12197befe7bfe2a57cd4115e76251190a33e84da62b9322d3cc1
SSDEEP 49152:Tl6ZnGC0xHw4Oan2YLqybPLLgv22SckY03ZXB6md1OI6EmT199zGl33Rq:Tl00kjGq
TLSH
T118A5395626DC49A5E0B9A23D86770B0CE7B2BC041731E3CF0A28094D9F7BBD5973A365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3748	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216010274660295"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1788	2140	chrome.exe	90
PID 2140 wrote to memory of 3416	2140	chrome.exe	91
PID 2140 wrote to memory of 3748	2140	chrome.exe	92
PID 2140 wrote to memory of 3416	2140	chrome.exe	91
PID 2140 wrote to memory of 4680	2140	chrome.exe	93
PID 2140 wrote to memory of 4680	2140	chrome.exe	93
PID 2140 wrote to memory of 1612	2140	chrome.exe	94
PID 2140 wrote to memory of 1612	2140	chrome.exe	94
PID 2140 wrote to memory of 4308	2140	chrome.exe	95
PID 2140 wrote to memory of 4308	2140	chrome.exe	95
PID 2140 wrote to memory of 3332	2140	chrome.exe	96
PID 2140 wrote to memory of 3332	2140	chrome.exe	96
PID 2140 wrote to memory of 744	2140	chrome.exe	99
PID 2140 wrote to memory of 744	2140	chrome.exe	99
PID 2140 wrote to memory of 2376	2140	chrome.exe	100
PID 2140 wrote to memory of 4148	2140	chrome.exe	102
PID 2140 wrote to memory of 4148	2140	chrome.exe	102
PID 2140 wrote to memory of 4784	2140	chrome.exe	103
PID 2140 wrote to memory of 4840	2140	chrome.exe	104
PID 2140 wrote to memory of 4752	2140	chrome.exe	105
PID 2140 wrote to memory of 2676	2140	chrome.exe	106
PID 2140 wrote to memory of 2052	2140	chrome.exe	107
PID 2140 wrote to memory of 2052	2140	chrome.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Windows.ApplicationModel.Store.dll,#1
1⤵
PID:4168

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6072

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2372

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x80,0x7ffd2899c728,0x7ffd2899c734,0x7ffd2899c740
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,9900783674480046749,15848933681248672683,262144 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2614350860933761738,11514752548119560556,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,4308714459178795817,11225249077418632906,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,14368300726736681368,6707772820439413833,2097152 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,7165869118597066725,10211153323793484155,2097152 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,10690648158632963563,9293545189090191169,2097152 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,1233008321399351267,5682887968975068879,2097152 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,4151388090447690476,1554821229981156347,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5932,i,13743094748993779276,8591828228467143696,2097152 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,2719266012819638523,17605601431208818175,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,16623100852503025654,4831739144249048512,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,2961838929277275884,10706799317717601810,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5432,i,59131557343283533,11835548336324998056,262144 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,93444342916789215,10080066579064209888,524288 --field-trial-handle=1892,i,11226110554690718804,7642670372616042571,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3192 /prefetch:14
  2⤵
  PID:2052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 97cf5d3e45fad31287ffa42399b3854255df168928555bdcfb9b69ecb4e9e80a
MD5 27741bec2f1bf4392cce311eb3ce6bfe
SHA1 9c662508a14526c67a1b9e92ae8eeacae20c6407
SHA512 cde39be10795b1ba9af18f33bf1155187010dc6116ad65ac0ce020322b4e3399c8d100b77e7f040a0b2a2a579181efca3f3aa87c3b293e85c1790c514b5d89f2
TLSH
T1CBE0ABAAC821ED370CFE071894804343E74903972740441B3E3C820D8F7073E4285C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 816586cd0f79275557df0e2da071f3f984008f151dbb2b997658b7ded03a01c3
MD5 1d63cb24071096e1bc153b7075d3eb4c
SHA1 f7ec2fed125735c498bad28b74e4eabe250c4545
SHA512 f436708df36962a6606a349d98f5e9f97bb07290d41d8ec7a8364cad08965bcd5dd8370399a558b2e185907bd6125ea6708be487677b9674e05f295ae68de4bc
TLSH
T143B022B00088E082CFCC83F038B380C03F300CE882222222C0E233BC8A0B3A0220A0C0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 30910187fca9bc8cdbdf8ecf768c69ac4dccd67bd334afc3b39c16af339a7637
MD5 f11f3f9cf0fba430b7560bd715e36512
SHA1 8744c72288e11cf12d028aca9df22e44f3ef14e3
SHA512 06a1e6911880da932bae4a875d7887d81e83cb8dba997670b0d8cedf47e252790021315fb251a4b68aae39f75d2b84959bb5918065a0b8b70c606c45cec65b24
SSDEEP 48:YALlqcq0hyhbrh9hdhhaXYfo7zsUgmzsgfstospKsLe/tsn4s3JzsO/stcseBsTi:DbtMRrbz3aIa5PQZle/43Jw6Akow
TLSH
T1DFA18BB7C3D8866DC51156F4AB296F2FCE2D0A54431C3C66C8D8AF5B93E2872D21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 67bd9e5fbb82d23d5bed370d6d370af81426324b08858ef7e2231b9931dc3312
MD5 b74fdeed0e5873b8b8f99e032980b5ac
SHA1 3df6085616e9164eda9ee1b2063ba9805e57124e
SHA512 a5c0dc48106016b4d339b47da5b61059f4c270523ae96d4ecd778bf030e2c1340e730454cb6f17cf4938208edfad8af112c941b1d5b900dec9730114584324a1
SSDEEP 48:YALlqcq0hyhbrh9hdhZhLaXYfo7zsUgmzsgfstospKsLe/tsn4s3JzsO/stcseBO:DbtMRrbzjtaIa5PQZle/43Jw6AXJLJEw
TLSH
T1C4B17CB7C3D8866DC51156F4AB296F2FCE2D0A54432C3C66C8D8AF5B93E2872D21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9eafc5de72e98ad853fb03dc60008bf5c51aeae9a2bd1c4ba4bd90a2bcb6f6ec
MD5 d5b52d0f9d95ecafe900d5c4521496b0
SHA1 ba6bce8b6ebb449fe3e0a3afa5fccd17405adc52
SHA512 83040a3489dacc541b356ee87057ab2010f35c834adf48ec5835316a43b2f41b5e6b8a967af3d0be62c45c79b07345f69c4b42a56e6625119cc23554c90f725c
SSDEEP 48:YALlqcqXhYhuhfhsh2haaXYfo7zsUgmzsgfstdKsLe/u4s3JzsOkZqmHqsijhhnl:DbuictqwwaIa5PQdle/u3JkZqmH0jhIw
TLSH
T18FA18BF7D3E4856DC91196F4EB15AF2FCE690624032C3C66C8D4AE1B93E2872D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ceb12f88c34b33b09dd645dd51895d95a8ea8253360d48653a1c4c7a414ad33c
MD5 74359b4543d045cfd76c06d4e1b6bba9
SHA1 b851f038b6dff195445d2c4053eb70c4adac0c4b
SHA512 f6650dec758b4b6e85c5d9730c1817af17c129d466e40caa28a9efa24b8e0a0d3e5db47d132ee4bad42782491c36fb9bbb1e6e9cc47b04e65c06c785a817ac3c
TLSH
T1E0F050A7937DF46710BE46A71E08BC062879A8380281A4F0CEA6C12D90924F70F21563
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7542db3672649c842cefd5cee9c372b6da0e6ece8bb170f3041ed3b1a4912217
MD5 37b092861cc714b86cca44cc86b91994
SHA1 3dafd8b4edfba10f8d2238000e3f06897f0fa996
SHA512 9d3811c7ee897ea8de3131a59783ddecb73f767337de9360641f41a0b35df20c469da197746ac373f2e409ba69c4541ff965058af34bfbbd70471dc6c3aa0147
SSDEEP 192:wR4cBzkydxwwyTJv7+FpAPRp2kbf9hHsb+WNn/U4bw2SMxsei2KfVyIsnAUgraJ:wR4mzkFJ6FUX5bwML2/xA2K5e
TLSH
T11652D82EF910657B5CEAC219FE61BB57E7F2102161901E84EAFCCE1C15EB9CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aa905bfc334cf682c589ff30c8a1cc8e4a9955bc33eb40755094187746a88a8f
MD5 c914c5a1980c5b9e0d14a2efb50d9971
SHA1 8e5021d59cf0a5e82027753934e4323b46bbb8ec
SHA512 3cbf24634b7f891abedb3fab6652df6236412e11ff4baaea529178af0f084878375af6d33030d109a16e8dfb2aecbb1010f0b9abccdc40e8810bcb3b8ca233f8
SSDEEP 192:wR4cBzkydxwwyT3v7+FpAPRp2kbf9hHsb+WNn/U4bw2aMxsei2KuVyIsnAUgtaJ:wR4mzkFf6FUX5bwML23xA2Km8
TLSH
T1B252C72EF910653B5CEAC219FD61B757E7F6102161941E84EAFC8E2C15EB9CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 65a8f8d22b9dc59cc2f7adbd97eba40f938203adadeb51031c1d7b428df34f41
MD5 83a4fad74ebe75dc288f92f647482076
SHA1 b86239ebf44899ec360a3a32b17bb61aed590005
SHA512 ea39be879b1547d463ba149638c8ccad66f48e7d3c8bb814081bf6ac60ad421a5557696af5f15f670cb5f341c666a4918fdfde99bd17072fe43351a0963e3c71
SSDEEP 192:wR4cBzkEdxwwyTJv7+Fp9PRpRkbf9hHsb+WNn/U4bw2uwMxsei2KBVyIsnAUgraJ:wR4mzknJ6FvXqbwML2uNxA2Kne
TLSH
T13C52D72FF910657B5CEAC219FD55BB57E3F2102121901E84EAFC8E1C25EB9CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c7ba70a6efefcc00553bc1704bc5c108882db13c43ea229b4549648f1635ac04
MD5 6a16804446511dc8e472259f8cf5ad25
SHA1 ea98d43e378f3b6a8b142d44ee269f9ffe04175c
SHA512 551ab8e0c5cd155d4ac92a5cc905ad362e87e35514acdec7ad1da708319097ba23ff587012e273e7219e02d47f909e7dbfc8c82a508cd0a453f70bd234ad0631
TLSH
T123B012D094029A12C00312F52293048831189F21870B130153E06AB5B8261D28014350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5907d6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5907d6.TMP
Size 96B
SHA256 f261bd5add7121f133dd5535c30b2ed5ca0a582fd29bc64afe2aa8380c6f5a0b
MD5 c917961ee3ee17630d3f458788d6ca5c
SHA1 c6403a332cd95b4eb6c929231c08fddb0d10962c
SHA512 544d190f80fcd65730ffbb7351d0be4d377cd7c1e511cc2680d86ec1f2fa0ddde9e1bfc581d91891fa716c0b91d000f553412b09927917094f439052ef051b59
TLSH
T148B02288C002A203C08283B02C82B0EC3020CF20C303020383E02BA2EE232A00020030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6a185d1a06bf7e038afa196894b55e0c559fb64c759b245c603b18c0189df1ff
MD5 b94e533d9b692209151470e8a104697f
SHA1 4ed04f465aa91902603fa1b63308737bc10c1ea0
SHA512 d975ada03929369578c5e44f1446e5ba90c1721f8539e02ef738698de4a20a5d5d2975fdd81d8e8626b922bfc8690f842cce5fa5247118db0c3e46d760bec9f0
TLSH
T1F6A00254C6D44021D013627039C3028033214D505612430180E8A248AC51152921A010
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 dda8b53b87754cfd1adb5e06f10095d55b64aa403568ed457f25ab042b4cee53
MD5 9ca6532bee5a8c5229408f84039566cf
SHA1 2cdd71d2d837ba1b58999e9ca63152be523b47d8
SHA512 1dfe46182a4c76c36c2feeb9291ed4440eed04f666e8c519c91f313cd1dbed9ed85284a5ac1cc566d76047c35e00da1ef99bf886b61ec062f56adfa3f5f4fb10
SSDEEP 6144:f5dRqe7NvoXMZjC+a+lAFqBMQ7++JjcMW2VcVLI:f3YY8GjC+28MQtOMWG
TLSH
T196141377DE283DAA271ADEB69023FC5D4CC3CCEF1114691C60993F0A259CB92265EDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 82685ff704d11c2d04d10280f1b9fc505322631ed50f7b9a882616c8126442ff
MD5 809cceff3941738f3e5ea4ec88e77dfc
SHA1 a3a37b6bde6f1ba9c3bf89bbdeea39edc9194cff
SHA512 df3ea00c13f4b458d1791fdc2031e74fc544601faac8dea9da1b811da48932b3ff5d2e85fdeed37abe3f059f76ab47b9c5e85e381e81e941a2e9544b6af5f457
SSDEEP 6144:n5dRqe7NvoXMZjC+a+lAFqBMQ7++JjcMW2VcVLI:n3YY8GjC+28MQtOMWG
TLSH
T10C141377DE283DAA271ADEB69023FC5D4CC3CCEF1114691C60993F0A259CB92265EDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 475b06462a0040327746d82d8d03439d550d549b8fed8f351b0bbb146620c1ae
MD5 8ed57dbb48e595d9ef1634c2acb0bba8
SHA1 e10c1930f7538e5280c20cb93387b4b690e57ac8
SHA512 8865d255487fae207f9621fb54631dd84e72b2b3ddb0ca03d3952610e31330db84d3f3c95db93bdd33447f973ea911f832bd1dda917ceb38369b6bfd12d45b31
SSDEEP 1536:eGEuHP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:Vv++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1109302B9991E7D75636AC6D690079CAC88E3DCCE1514117C30C7AF1E28BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 abb8926982935a23f1b53d3a9dd8a98c322c21e13dd659602bc4328794fef586
MD5 badc07592cd2e3c2b4253e9194baa6ce
SHA1 691ac09bd2942662aefdbcedb6c9126c4f49505c
SHA512 53ab885468c3bfabc2d1d410b640e460e9d29bfe0859799fd5090e785256a0fbcdf2bbbef3fd4b7048373cc619af52ab0162bbf66bd1f6d7b4491da196e882f1
SSDEEP 6144:MfRqe7NvoXMZjC+a+lAFqBMQ7++JjcMW2VcVLI:MfYY8GjC+28MQtOMWG
TLSH
T11E1413B7EF283D6A230ADB769023FC5D4CD3CCED1114586C519A6F0E25DDB82266E8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 ac75249bf4f25e87dd3f00cda9a802011557fff66959e85d4b9de697cc24d923
MD5 58db968b34f9ad5cb3fb4bc4b3be7917
SHA1 0440fad5907860c97a45dacb6852194e070135f1
SHA512 1eab8e71077bf0b1d9a2f56772c3ba3d4719f7a199ebb78ce5fc9c4213f0f2093ab05ad38cfdffd735b9d2c9b600e10d4f94c08907ebe0ba05d0947650f9f76b
SSDEEP 384:vJWJqVca12krtuJPpmXmlJVjeQ8RJoLPcghKjUG6WD5Pim5i+GDa50Hk+cK3PYXV:R+qVcWrEl8RJccgsjUG6Cbi+GDa50Hk3
TLSH
T15FA24B743AF51319F3F29F759AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download