6e33c991cf807eba5835208085c4e471a292947cb4875f3b935249df74f18158

Analysis

user interaction
yes
max time kernel
300s
max time network
306s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/04/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Trojan Premium Express.bat
Size 602B
Sample260426-xmlkeaez2v
SHA256 6e33c991cf807eba5835208085c4e471a292947cb4875f3b935249df74f18158
MD5 3d62a13b28b47bf706db81c537888c47
SHA1 7a574754c9bae0c804da3ffec6ab5ecb16e1e8e6
SHA512 b540f2e55ae2fc10fceab6b9e7dc77d9ac9147074c77cacbf875c9fa13d5d742ce5473d726011eb3451388d384acef9b000dd868d52b7840cdac15f9e5fe05c1
TLSH
T13DF0AC1636C6407A0035857267D82199F36512F77305CA0DBC8CD2C26F791E6A3DABE8
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5080	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217036073256491"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5324	mspaint.exe
5324	mspaint.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5324	mspaint.exe
5324	mspaint.exe
5324	mspaint.exe
5324	mspaint.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 5324	4856	cmd.exe	85
PID 2808 wrote to memory of 3624	2808	chrome.exe	105
PID 2808 wrote to memory of 5708	2808	chrome.exe	106
PID 2808 wrote to memory of 5708	2808	chrome.exe	106
PID 2808 wrote to memory of 5080	2808	chrome.exe	107
PID 2808 wrote to memory of 4480	2808	chrome.exe	108
PID 2808 wrote to memory of 4480	2808	chrome.exe	108
PID 2808 wrote to memory of 6012	2808	chrome.exe	110
PID 2808 wrote to memory of 5268	2808	chrome.exe	111
PID 2808 wrote to memory of 6012	2808	chrome.exe	110
PID 2808 wrote to memory of 5268	2808	chrome.exe	111
PID 2808 wrote to memory of 2488	2808	chrome.exe	112
PID 2808 wrote to memory of 2488	2808	chrome.exe	112
PID 2808 wrote to memory of 5768	2808	chrome.exe	113
PID 2808 wrote to memory of 5768	2808	chrome.exe	113
PID 2808 wrote to memory of 3700	2808	chrome.exe	114
PID 2808 wrote to memory of 3516	2808	chrome.exe	116
PID 2808 wrote to memory of 3516	2808	chrome.exe	116
PID 2808 wrote to memory of 5088	2808	chrome.exe	117
PID 2808 wrote to memory of 4376	2808	chrome.exe	118
PID 2808 wrote to memory of 3908	2808	chrome.exe	119
PID 2808 wrote to memory of 4224	2808	chrome.exe	120
PID 2808 wrote to memory of 5780	2808	chrome.exe	121
PID 2808 wrote to memory of 5780	2808	chrome.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Trojan Premium Express.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\lolz.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffcac1fc728,0x7ffcac1fc734,0x7ffcac1fc740
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,13151751334294144673,18034938442683773314,262144 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,14601105474988352300,13153725739082637056,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,10254257058969375526,2543431292293310488,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,14682355724919068171,18071347169757439550,2097152 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,1237045308401022821,3499755650497647690,2097152 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,17834109649587625338,18107978809457477604,2097152 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3908 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,10218003486043477788,7378453701921836012,2097152 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,248095139037947142,14481144595606715062,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,7970379912160314143,9340953536621047962,2097152 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,18289242388418821261,2976658923157341458,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,12455370433739913362,17424499490286830449,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,15652612247629816639,17208589741230798941,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3452,i,11179517700385084867,11373525517582143685,262144 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,10696499785956224113,10118267020090635732,524288 --field-trial-handle=2032,i,6286698491101806023,16423097231443589802,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:5780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 87999a425db598b8b42d501410cb6502952e519985207db3227878a700857200
MD5 32f6f934f3649f3c1fa025cda4322566
SHA1 7953ed80bfe4285c5bd8596821ec97b032c68d0c
SHA512 e3a3703fe56a71233ed7412e21b516195de1ebde3bf04697b4a8af99990d8e0ab9908b876b87beac31563572e3e8f0ef0cfa74243a10e8179212112348c19dbd
TLSH
T1BFE02B6ADC31DD2744FD0B6C64564742EA5113172B50884F3A3D820D8FF86374782C3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 61cab5726098b78e20f26c3fdfa714d0d2f396978e05e8759d7613514e503594
MD5 fe9e23235c6d88ef14f0fc9d4f2c922a
SHA1 2978d301eb5f24d732bb896c719ead6aab40cdd7
SHA512 492306476aff5eee9545e373d9af36083fa237a5a11ba5e0a1121a323bb3667a423c374d099d1c265d72de752cdc63ae4269934b9e734d2289d2ed7a2df6a372
TLSH
T1D8F09B683104CF38CF7F1672F5520E9A65659ABC3016262A64C25CDCDE0A6B5714D1C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a0342a816047c67e8b8fe46ae77065437a9171a8febfb79db0f43d399254cee6
MD5 84a391d6e3ae5fe00ba1f7d50fe5368c
SHA1 da9da619f7fdd037944e0276dfc6dc66d95c0d06
SHA512 bc787e5f6bf9d0b870a7230f7bb02144b63e87bea10854a1a06897bfb9174a568cf29b7eca2a9a8326d296d7bc884923fdae9c0fa6ae928b3bb7f614e6cc92f4
SSDEEP 96:DVPvVd9waIaDHSdELnALgFCD5VHVrywIoNIGluLom:DVPvVd9waIaDHSdKA0ENtdzIYIGoLN
TLSH
T181C19CF7C3D8C62D891156F5AB256F1FCE6D0A14431D3C66C8D8AF0B93E2872D21125E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee8d1af2a059ad3d610cb785645d00d6ed1d80a1d5ac0bcec826cb9e38433f1e
MD5 7449ae432c109b22593ad60960912bfa
SHA1 aab18669f0e66a00f2c47c4434a45eed104860e3
SHA512 66304a9e2bff288b289d85a58943a47c369c0a84bf78f590bcf014f3e00f92f64ebb38dbee39305ac29859668a305a3213d2fe200abd144a765f075f39c09068
SSDEEP 192:2RwWtD/fPmXev7opAPRp2o9sHsb+WNn1C4dlV2adskwNiiVyIsnAUgtaJ:2RwWRfiasUX36wg4d72a+P8
TLSH
T1E542D62EAE14753B9CCBC22AFD227757D7F5242165912E84EBFC8A1C04E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a76c27bcb106039a75fdfa5d44dcebc182f40e314777b640ba8d6b69a57efda8
MD5 be7125b06c890dedee2bd8b6d40e5a3d
SHA1 fa2816ed0a25b45a4610382dc0e02869313b5d61
SHA512 1f762ff4925cee815cd4bc828eb55d6e54a27e487463cb83886fbfbd02699422d9e7add2ff4d5d1684e7ecb728455672d678c2c952a71d42dd6b67880139f20a
SSDEEP 192:2RDcBzWtD/fPmAjv7opVPRpFtcK9sHsb+WNn1C47pW42OV2adskwNiaVyIsnAUge:2RDmzWRfpbsDXn6wg4Y42S2a+Ne
TLSH
T14E52E72FAE54697B5CC7C269FD227B27D3F5242265902E48EBFC8A1C05E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2870d8e3f92ee999728ceea3bdadd869b5e5cdcb96e78ee9b32ea1ef49b85c07
MD5 29a80c9f7a04bda84163ca85d94fa64e
SHA1 d6fba637f577134f52a0eca5ec2f85a737dc72a2
SHA512 780d82a551bff94565a5d699205a619ec125068e8c5c228a8378034e23ec854868dc43ec5df01d62efde461c11aeb1570cb412070cc02b7eb5037a15cfd8e113
SSDEEP 192:2RYcBzWTD/fPmAjv7opVPRpFtcK9sHsb+WNn1C47pW42OV2adskwNiaVyIsnAUge:2RYmzW3fpbsDXn6wg4Y42S2a+Ne
TLSH
T19A52E72FAE54697B5CC7C269FD227B27D3F5242265902E48EBFC8A1C05E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 26b582489e89a0aab26f2a634293ff866e3734a8081c4c3b32744550662a0381
MD5 2538b64a37abc8ab2468e7bf8267cbef
SHA1 2e9da51864a04b602e165c9875c0eaff5c2b84ad
SHA512 9ef607a1bec47c47516cbdc33f298a626e3e42de9695ed57e588ad127844ac1a896f790810b88ca25df038ce5179b2541fbb6446af905f23b39377c2892bea8b
SSDEEP 192:2RDcBzWTD/fPmAjv7opVPRpFtcK9sHsb+WNn1C47pW42OV2adskwNiaVyIsnAUge:2RDmzW3fpbsDXn6wg4Y42S2a+Ne
TLSH
T11F52E82FAE54697B5CC7C269FD227B27D3F5242265902E48EBFC8A1C05E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 57a7ce80ae53ab0eeb9e091615dabe48ed33261f75c9db36caea77a20cebbca1
MD5 19f13eb97f5fc93649c9b7de23057d9c
SHA1 be167accd65ae8fda4d2c62175931cdcd6af4662
SHA512 08b864d22024bd15aecc9c26105fb2647263ee914e60f713c6bb07a43c7080baa87d3d2ac38b38ec2e1321c52567ee0672ecc54664de6d9ebb7d9e044f3951b7
SSDEEP 192:2RDcBzWtD/fPmAev7opAPRp2tcK9sHsb+WNn1C47pW42tV2adskwNi0VyIsnAUge:2RDmzWRfpasUXw6wg4Y42z2a+he
TLSH
T16652D72EAE58697B5CC7C229FD227727D3F5242265912E84EBFCCA1C05E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 54712e6cd4313bd231930870f517a708002bf5e3e6d602032bae250f07862ce3
MD5 d71c357db1e5924c071b483138338177
SHA1 b128ff595b26a256c328f7123c7421a4d500c1a8
SHA512 1c7122aa6ed6a3ba57ca77badca93277e2054556c6d573fbb8de08d6ed499582a5ed9dafcd11875b89115ecb063843f9078b3a43d6e0997fcfcd7930a013fa96
SSDEEP 192:2RYcBzWtD/fPmAev7opAPRp2tcK9sHsb+WNn1C47pW42JV2adskwNiiVyIsnAUg8:2RYmzWRfpasUXw6wg4Y42/2a+P8
TLSH
T16252E73EAE58657B5CC7C22AFD227727D3F5242265912E84EBFC8A1C04E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3d93d7e83d2d6212112a97e8d679e4fb22ec907c21584671cc7e50b9310eee23
MD5 25b7ed0ab9c3386b0a97de6e6a43c597
SHA1 ca1a25d795bdffaf98824848e4bfa3025b20c297
SHA512 df5e048a4d29095a6582e1f16e3c9d3c22d791f4a3c3d21efb7bbb347d3b87e1a410762945190f1a68eb34245ed35ab4683b8f810094c40ea974936f4e425351
SSDEEP 384:jBj/a7KxkXqKf/pUZNCgVLH2HfgslYn7pLuLcifVQXOD/e+ErU3FRHGLL+vV5bsc:jB/a7KxkXqKf/pUZNCgVLH2Hfgsin7pi
TLSH
T17E7209676C4C9E7B0F94C6CCD8267E4FADB5024B61EDC86452FA981903D5ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 fdf42db8435af11081429584f0a8e282830b1148932b17b415a74ebdad33a1d6
MD5 8f225a65234136de26433292f7262998
SHA1 80b77d569a66903c46b4a509c19e07141814c8ae
SHA512 151e5421e5e8fc18e822af468cd2e70106a4002083c1384b9ba444d3fe17df0384fe11e12b5c029564452bac104641be846c93953295f669fb9e0254bc1b6bc9
TLSH
T1C6B0121080019901C06302B01686068931185F208709530253E06EB2DC3F1A18018192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593d4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593d4d.TMP
Size 96B
SHA256 39d1f46c7e857d72cbe1ee2d218f8001c32319401cfdda671e8b56f58d0fe2fc
MD5 9dca2ca3ae8b01386f5233d65385a378
SHA1 76e401ce61b8757f655ed1e8eb9ee820776acaf5
SHA512 cc0ca91ddd12d683b115359d8edb19654650fb1f41efabbe68d9308224f2d7c27bea054246fee54a34e5d6b6ec374143633b0b9f178212d948585e6f4562c470
TLSH
T16EB0228BC003AA02C00223B020CA88C8B020EF32C303020382E00AA3CC2833A0028020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d296c41a1b77a7861f906115776675de7d79b8087a120d9031756a088871ae38
MD5 3271d844bb89ef8423de374259b529bf
SHA1 aacbfa6224b075543e54757e32dd9fc236e58eb7
SHA512 4b2a6c75ed23a780d0643d29d571e2cda5ff73c148c458e48344933755e6fbdb3e2b4eba5b0ad80b2064871ebaa03ca06df8597f37998d6f9793d1d46b557bc9
TLSH
T13BA00230F6444201D1000BB0248305516230CC550707124591A4159EAA602A0C601184
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 1a862bd50b24793e79254a3570e68b08ccc8e3f74db9b30ee6ce5d357efaf631
MD5 e2b0486f68ce995b5c63e0507b330072
SHA1 3a73728d57f9e51cc13fe7fb352f81a5ed0e1025
SHA512 c43c3bdc34348b6b1a998d8d0f57aefd14be1cf05998b724987c20a64fc9922cc9230e63d059ef6aa0555b28cc025b6bae83fcbc52a8ebff0c447d09db9717cf
SSDEEP 6144:u4S/rNxGN1BqcKLYOwtJG9G0D0jKsxdoktsJw:jeIV70D0+SmkiJw
TLSH
T1DF14127C697808A30506C5C928393C1BAE789FEFC189BD7A66E4DDD167D83884F4BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 64a88da5516ce156876ee697dfbdaa43728cdd7dbfec34126ee209efdb57c37f
MD5 9c4c5b37ae3e58ff306b07bc1c5eedf0
SHA1 6a19950f841859773fd10f1f484890b9801e7fdb
SHA512 2e908086229219a41d4ac7ef3864fa1ea53e7107386fa3fb816a995d9c6195581db035637f4fdd5700ec9a3c4858d104c577d1412d84c2046736c73cc66fbeed
SSDEEP 6144:+4S/rNxGN1BqcKLYOwtJG9G0D0jKsxdoktsJw:TeIV70D0+SmkiJw
TLSH
T13514127CA97808A34506C5C928393C1BAE789FEFC1897D7A66E4DDD167D83884F4BC18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 44bd0a9e58425828d7a2f6f6463fca015c1a5604eb815941f51c77811d26ef53
MD5 9d5663a54a7deb51283a9388cb947575
SHA1 ae0530bfbb7d755c8efe3df4f6fb56d2e66c570a
SHA512 8eed1301842f97713f5de820f542c1c1b3c4e8ae7f128f24f19a0ef66247f2cbbd5c69f475f2d9082d2d774a5f0fbe42e6819dbe05b806c09b60476dd95f1b50
SSDEEP 6144:1S/rNxGN1BqcKLYOwtJG9G0D0jKsxdoktsJw:1eIV70D0+SmkiJw
TLSH
T1BD14127869B808B30106C6D528397C1BAA7C8EEFC1957E7616E1CDD26BD83885F4AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 cc8770e5ea66496af4083ef3f68844bb4d8e7d418fe47de7fc46a21614461900
MD5 80aa6677ed05fd6dee5009ff68d1d753
SHA1 527c102cd517d6a4bc54999ea8591e4025fd2224
SHA512 99eeb6246d22bc700e1c4a9ae691bd66a322f5ab2f5ff064d10374fa2fcf325d906278cef715c8e742bde9687a5e11b96da90ed69c52088829ed5a496e8b1bd3
SSDEEP 1536:KSW0eUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:s0NL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T14793126C62A405BB4118C2C6726E7E5BC77C6D9A96702F7835E44D729AD0B8C0FC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 6ce5c6f7dc1bbc3ed3149a286abda9ba2072db5e2deaa621a49a51c89eb754b9
MD5 d7a9b34585ea8263ae0809ba9811d99c
SHA1 0700067e5e62e9222183ebaeb18994d6b9e48103
SHA512 39905cb1d124586f3dcb3fb71b50dcdeae2a0128b59618b7b1305a83274c5fe5053dd7efb5a16f8a7fc103a39a721434334dc8b8fe1d2fcb116ea3ffb5320c3c
SSDEEP 6144:AS/rNxGN1BqcKLYOwtJG9G0D0jKsxdoktsJw:AeIV70D0+SmkiJw
TLSH
T1AA14127869B808B30106C6C528397C1BAA7C8FEFC1D57E7616E1CDD26BD83885F4AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-82-0x0000020411800000-0x00000204118CD000-memory.dmp

Download

memory/1760-277-0x0000020411800000-0x00000204118CD000-memory.dmp

Download

memory/2524-2-0x00000160880B0000-0x000001608817D000-memory.dmp

Download

memory/4856-0-0x000001DE196B0000-0x000001DE1977D000-memory.dmp

Download

memory/5064-25-0x000001750DAC0000-0x000001750DB69000-memory.dmp

Download

memory/5324-1-0x000001492B8D0000-0x000001492B99D000-memory.dmp

Download