38be2830eecba0ee415fc2e02981bacd5195b5bf10329358127dcf7afd08dbf7

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
server.exe
Size 95KB
Sample260429-wras2aet2v
SHA256 38be2830eecba0ee415fc2e02981bacd5195b5bf10329358127dcf7afd08dbf7
MD5 d40d35b8a2ad1e66c1c6c873b42c14d3
SHA1 6f0c4a05b104d5988386faf229c4e2af4cd29977
SHA512 d199858a5f2707f3f9d062e9e8a3780d63948c55d87dc1e65d62828f0aeafaf5415c1438011df3e755a9a5b61216192b160fae9018cf086090911a02dc2d5df7
SSDEEP 1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfQw8NjmOp:b7DhdC6kzWypvaQ0FxyNTBfQr
TLSH
T12E938E41F7E241F7F6F1053500F6A52FEB3AA3285724A8DBCB5C2D529602AD0963D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
27	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5096	PING.EXE
5092	PING.EXE
2804	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5416	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219597616843863"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5096	PING.EXE
5092	PING.EXE
2804	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 5108	4444	server.exe	80
PID 5108 wrote to memory of 5096	5108	cmd.exe	81
PID 5108 wrote to memory of 5092	5108	cmd.exe	82
PID 5108 wrote to memory of 2804	5108	cmd.exe	83
PID 4324 wrote to memory of 3440	4324	chrome.exe	85
PID 4324 wrote to memory of 5416	4324	chrome.exe	86
PID 4324 wrote to memory of 2744	4324	chrome.exe	87
PID 4324 wrote to memory of 2744	4324	chrome.exe	87
PID 4324 wrote to memory of 5832	4324	chrome.exe	88
PID 4324 wrote to memory of 5832	4324	chrome.exe	88
PID 4324 wrote to memory of 5700	4324	chrome.exe	89
PID 4324 wrote to memory of 5360	4324	chrome.exe	90
PID 4324 wrote to memory of 5700	4324	chrome.exe	89
PID 4324 wrote to memory of 5360	4324	chrome.exe	90
PID 4324 wrote to memory of 3764	4324	chrome.exe	91
PID 4324 wrote to memory of 3764	4324	chrome.exe	91
PID 4324 wrote to memory of 5804	4324	chrome.exe	94
PID 4324 wrote to memory of 5804	4324	chrome.exe	94
PID 4324 wrote to memory of 2528	4324	chrome.exe	95
PID 4324 wrote to memory of 3876	4324	chrome.exe	97
PID 4324 wrote to memory of 3876	4324	chrome.exe	97
PID 4324 wrote to memory of 3264	4324	chrome.exe	98
PID 4324 wrote to memory of 3264	4324	chrome.exe	98
PID 4324 wrote to memory of 2348	4324	chrome.exe	99
PID 4324 wrote to memory of 5192	4324	chrome.exe	100
PID 4324 wrote to memory of 4544	4324	chrome.exe	101
PID 4324 wrote to memory of 2436	4324	chrome.exe	102
PID 4324 wrote to memory of 2436	4324	chrome.exe	102
PID 4324 wrote to memory of 3476	4324	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2527.tmp\2528.tmp\2529.bat C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5096
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5092
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd668ac728,0x7ffd668ac734,0x7ffd668ac740
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,10479868380452791991,8808548935540582818,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,53129647959545486,8100619497108917345,262144 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,8690952332681935093,5739962839468063052,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,6165229877889633096,4620022201866514737,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,14229876946988050695,4096891299345551070,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,1399051191575300745,9748230454151245000,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:9
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,10113805425345694188,13604217850027193388,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,9497392152349117624,4063840669837104637,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5764,i,10645005047674221673,17917139598765633426,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4848,i,13606608374364070881,15793663467494042392,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,2144524365731867800,320009859940844600,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3308 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,10701299423431141379,16183750286124669190,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,8813058824688458282,14930516089496085490,524288 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4808,i,2157523716773481819,16198906449710324275,2097152 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4764,i,11407468521584493967,16716157502868021397,262144 --field-trial-handle=2000,i,14956688888749039532,11776032078656782052,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 5df3e2af36384b258078c18b62ee029b04f7499784cde4aec1e4a778c2daaeee
MD5 78a7ee11b53d15ddc3cd40395bc74db8
SHA1 8e1e77a17178b794ea276ca7ad3b8955723a6cb8
SHA512 8cdeb3d325492f1ae963d753a6c6c03b4c2d359ec9f6e9f225833c6f814a9af8e82cce0c3dbc8ccc1c504a191c78e2856c8bf017ba07f97b41102fc1bf667ed0
TLSH
T181B0120533E0031EFFA8C3F05416ACD416B145543964432781A0888C44263E4AB2A082
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6406dd7d38356941ec52bdf97798ff1621646a9bcfe690e52ff43686c506911e
MD5 18e0383b17b9e32dd192c65ab3bcdef4
SHA1 c82cb4b6861aea1fe4a505a4f5b0983fe5b67996
SHA512 ca9d21df84640110122435b181750996e062a296d3cdac09cfc09c07e81ba03f12a8431a5af2ca445b1b266e0c801831b09fdf45990f06ca679ba6c7600818cc
TLSH
T1C3619CF3C3E4897EC91196E4EA146E2FCE6D0925431C3C66C9E4AE0B53E6972D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b7fb907365c419c966cdaf605ee7508f2e549baaad8d7f95cfcca2e2c37f7e07
MD5 7c21f5c46b324872688794c7444e0328
SHA1 8b8e1287005a4284b9c1698fcf00a7ca2edbdd2a
SHA512 8e5ddb091508edf5e7055a9b557b984d2ed598c14531e71ed7c4ab80480828ebc3524cb3b92d93edbeaafec5fd115e895e352ef25d281656aa83788ae1a1572e
SSDEEP 192:q2RQkIe7NzQ0y6T/mn/f3xetua4Yv7pFhAPRp2Ulh9YHsb+WNnj43lS2GeDTS8yf:DRnIe5ZpkIb8XrOwsE2GUTre
TLSH
T17652E72DB944697B5CD7C62AF9217B17E7F21021A1D41E88EAFCCB1C11E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cba786fc122bb476bd34b30f92ccb6fadf1d8d6ceccf221d253c5d50158451b
MD5 ab6254597d8ec54e11a75ecd76e9db17
SHA1 c8a6b12c489802b539e396a9a3e2f646fbf41252
SHA512 34b135da4c8c5cd545c39279ba3b15ab0ab513380b9873792b4c693ced7f9bf97b4c6fde4ca9f96579dc9c5dfb35700b11cdaa086e81f376ac45f0d5d94498fb
SSDEEP 192:q2RQkIe7NzQ0y6s/mn/f3xetua4Ev7pFhAPRp2a9YHsb+WNnj40LeDTS8Y6VyIsH:DRnIe5ZpXUb8XtOws0LUTZ8
TLSH
T18C42D52DB954653B5CC7C62AFD217B07E7F2102261D82E88EAFC8A1C11E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 967f71b123d92742fc264863c41b3c159b4dbf299e16ad8ea3b725296f4f9b06
MD5 87f577be8ce6077c15f5af6708ee0f4a
SHA1 22dc8f93610b1dec1954f0fe9c8174c8ae624635
SHA512 75ac6e7650e6828cf964fd64bfd1689f9f1ad3c07815ae89a8170ccc5a62028c72bb6865b6980c12488bcce2f4f21cc5a6eed8aad4e5e681af5acf5c0955a971
SSDEEP 192:q2RQkIeBNzQ0y6Jf/mn/f3xetua4uv7pFhRPRpFUlc9YHsb+WNnj43qBY8eDTS8I:DRnIebZpJQWbXXvOwskY8UTle
TLSH
T1FD52F72EB940697B9CC7C62AF9217B17E7F2102165D42E88EAFCCB1C11E79CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 65e11fb74fb8c35c4fc49920be3c178a40a4487c9b8bbb7101afb8198840f61e
MD5 5c5fc726d6d5bf0529381aeae1c53deb
SHA1 9739a966c20f68c621868a0e83f668498855b251
SHA512 c9c7356e780f8e9bb82f2bb53de12553b39a4536fec1d2b2b9274bbd7dea3550dac7dcfe4e4d12a032c4232c69d7cdd680d6e7f411b2094eb2fb336e43951288
SSDEEP 192:q2RQkIe7NzQ0y6Jf/mn/f3xetua4wv7pFhRPRpFUlc9YHsb+WNnj43qBY8eDTS8I:DRnIe5ZpJQQbXXvOwskY8UTle
TLSH
T18A52E72EB940697B9CD7C62AF9217B17E7F1102165D42E88EAFCCB1C11E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c9bcdd5e8018e0eb1b8c8adb34cb10b83aa8f82f5fbcb3ab0f58874fbd06ef18
MD5 6e23d5e12c85e622318729e1d442d267
SHA1 3ef15fe2bcb06514670f5f58dbc31d9797e9cdd1
SHA512 67ec0f097de8d7da9d74e7db1d1c4c11a614275fa5428ddc34dafb6a795f2cd5561cd7212371250148cb8c869b057481c26ea3eb9cbd956f5d5913f424232227
SSDEEP 192:q2RQkIe7NzQ0y6C/mn/f3xetua44v7pFhAPRp2a9YHsb+WNnj40LeDTS8Y6VyIsH:DRnIe5ZpZIb8XtOws0LUTZ8
TLSH
T18042D62DB944753B5CD7C62AFD217B13E7F6102161D42E88E6FC8A1C15E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 901f159c7001e7f9828e9014953e6e9a755f0363ad51a2c0535d731bc63677b5
MD5 b0b226771cae5e4cecff1a3bc15a6ff6
SHA1 df1d0dd2d8b5cee24a0bb6952c1a6585caeee4e2
SHA512 6f2660a8132722938f3b80cc3800b631304ed53b40ff33e4ed6fe1dcbbd6c34804e765442f5aee370269fd91ed6159a23595076ac1b78f831b278560bdd70fa1
SSDEEP 192:q2RQkIe7NzQ0y6w/mn/f3xetua4Bv7pFhAPRp2UlZ9YHsb+WNnj43t6YWeDTS8yf:DRnIe5ZprNb8X7OwssYWUTre
TLSH
T1A752D62DB944697B5CD7C62AFD217B17E7F2102261D42E88EAFC8B1C11E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bce7c6051dcc58fc946f37775f849b8250f062e82fb193e6aba6132632f7d2cb
MD5 2233a59ba8b4d7737043559843a13590
SHA1 e225958b14ba71aa2ed4d1505b566a2f0b1a99fb
SHA512 6b263defcf4c47fef9fa03ec583cf6f3b60b746ac9a7e8d49bd89d37d9d6b6e1b6b13fd97d148391df2c7b23b92c3ca764d2c0cff549ad461322e63be081a872
SSDEEP 192:q2RQkIe7NzQ0y6t/mn/f3xetua4Bv7pFhAPRp2Uld9YHsb+WNnj43R+W+eDTS8yf:DRnIe5ZpCNb8XbOwsQW+UTre
TLSH
T15A52D72DB944697B5CD7C62AFD217B17E7F21021A1D42E88EAFCCA1C11E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 55f62737c8b15c17deadfb92797f7c6024237cb65000579ef3652c99f71b089e
MD5 3f25901d85e812421772e947256b7e9c
SHA1 f444cff19ef6191fa27112c931a5407520f3a9a3
SHA512 70834600f0ecabaa47a103e3a1709d62a658216fbb8ccba53c08ec955542101f7cfbf833eeea9cf0c82b1411ea729f6aed3767f8a0e52bd23167724057ffcf9d
TLSH
T123B0126184015509C48712B11182448C33345F60BB09130593E07BB1D82E1A18119191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf53.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bf53.TMP
Size 96B
SHA256 cb2db9561a94413f0272dbf9b93d3df7189928b2b27d328e19c0b1fb9305dc7d
MD5 39b4cfb49137c54bcad9092c0f52f8dc
SHA1 4e288d57ec00324fffd351765ceb5e5ea07f9502
SHA512 6cb31642d94a8cb9338bdd09415270ef81fecc8c7df7bac12e8b199c90632c42d00804b41789afa56854d68f413fdfa18d2bbc22d2ec8aa7eab8c3087a9bc651
TLSH
T167B02280C0022202C002A3F8328088E83032CF20C203220282F02A2AEC232B00822030
MD5 SHA1 SHA512 TLSH

Submit Download

b4bfb516-d17c-43b3-bb38-46b6da193fb4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4bfb516-d17c-43b3-bb38-46b6da193fb4.tmp
Size 414B
SHA256 bae84043e70b4033efdaa246dc02d6a10a7c150a2374f75318d95f4aec5b2467
MD5 acf9095087f02234f399b4e024ee14bc
SHA1 aa1694463c9606ca1be6892d1f1be7d6265ef360
SHA512 699301214645272c3094bcb1b476e25210e58ba61331d112416f116c6cc20f4ea13610a57a02c535d1142bbf04fc32d0b2ec9913a4ea10dce55f1a7f9752abd8
TLSH
T1CFE0556AC820D83B0CFE071960404341EA4003266BC0980B3A3D82088FB0226418AC1D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 12136103dcd30f8497c02583261a19de6a98d294d835a9cfe3ec4d3076fd7da7
MD5 187352477b5d0bf012e04b697d4b91eb
SHA1 06e1d3b651a096c41696417a216435f495496d53
SHA512 89ec361b773933327ec346f44ecfe09db1b28b171f0c81bd3d43559862bfc44f548e18c5c81fca9e55c2251305ed25740f88a9c875e6526fc6102550b078aaa1
SSDEEP 6144:uQcb1fF5wPGwGtIHxYVKnEr++JjcMW2VcVLs:ORDoGBIHxq5OMWq
TLSH
T1241413B50C257D69622BB345C01759A00CD28CEF853878EDB2C1A70E259E3F1EE5AEF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 2acbabfb202d0a38c3fb74110f93141333395a1a054a7df9ff6eab085d60da6a
MD5 1ac9304ced9eb98b5dcccf6fe657dbc6
SHA1 12d9678674c3ff697e5418db181fe0b67bd45696
SHA512 0761f1d616898bc9fa417fb79806731f7caca9cae5d78b1937ccc584021343791a325a55832fc195edf99ec95e43cce8808b0d89e356ba4a14abccae3ceea2e6
SSDEEP 6144:4cb1fF5wPGwGtIHxYVKnEr++JjcMW2VcVLs:xRDoGBIHxq5OMWq
TLSH
T10B1413F90D257D69621BB305C01799A44DE24CEE403874EEB2C1A30D259E3F1EE5EEB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e388e20e67662f3633f164a3781c4c716af6a46cb3412e643682d51703f51ef5
MD5 ecf0b9f704bedffa4b60dc7b252b3734
SHA1 4308c238ebfa298c507a847ec0cf82473b6eb94b
SHA512 727d167fdd4d580c8e003e941c3eff9e07df18871b771d0c04f14ab58c372013f129dbe776115397fcf04a38afaf8c53f5d8fc25d9349fd800c6a60d1032d2c7
SSDEEP 1536:SpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:i++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T15B9312B9991FBC79635EC69690079CAC8CE38CCD151050BC30C66F1E14BA3A2A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 47ddd55b780111d4fb179c977c75b327b49a9f9a4e22ba6645dc6442ae36f37f
MD5 12a44b77d8092795318ac6c8cacc07a3
SHA1 db6b7dc69f625c59f4cefb78f63f7dd7bb248854
SHA512 9734b64c63634478dca738292ffa8fc1278f3812a110a42ea94be03ea106a2549b1dffe8d66ec5df95b2d42bf6a43e29a1492b44970920efb6f87dcce034b9e8
SSDEEP 6144:hcb1fF5wPGwGtIHxYVKnEr++JjcMW2VcVLs:6RDoGBIHxq5OMWq
TLSH
T1251413F90D257D69621BB345C01759A44DE24CEE403834EEB2C1A30D259E3F1EE5EEB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2529.bat

Path C:\Users\Admin\AppData\Local\Temp\2527.tmp\2528.tmp\2529.bat
Size 1KB
SHA256 721bf0b2c7b0309393cd028b6d5dd631c32928710c253f92e91c1ee650f21446
MD5 e62ce1905ac0195f5bfb74ed690b201e
SHA1 aa9a8676c75f4071f5bfbe0d1101843b867121af
SHA512 d2403083fc19c5065370e163103cc39bd0706fd7dc6b029c3ade88f20fd83456b6e676bb104264559f327793915a04aeffd011120bebc1a6c29b1aaae8fa92ba
TLSH
T1C23138ABB00C2CF1074F67C9147C606EE047E41F1F42A8D8903930BA762E4CA933D00C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4444-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/4444-3-0x0000000000980000-0x0000000000F82000-memory.dmp

Download