ee960a4fb22242f17bfdb9decbdbcc2954487d5de7f5cd23c0105187afd2f451

Analysis

user interaction
yes
max time kernel
241s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cyrex_3.2.zip
Size 37.1MB
Sample260508-2pc39sfs9x
SHA256 ee960a4fb22242f17bfdb9decbdbcc2954487d5de7f5cd23c0105187afd2f451
MD5 3eda5ffbf1fc12048b00c859a1ed7610
SHA1 d09c207a1e2f45a2210624f144784eb1bb180958
SHA512 86ed0eb5810a1f9340d89de6fa3ffff71047c41d4624dfd59dd7462c3cace12fa0959590ff0e13f80eb95df0f683413f51f29c088f942f9a94c1b85f8d01641d
SSDEEP 786432:6Pwl174+Iao3qTveIScPRnBdNt0mJXq1Sr7dYIkpdr2gfCm:+wl17FIB8veWP1f0Y5YJdr2K
TLSH
T1D88733F40D924F05F9E26CB62E7E358C5C5A4D648708DAB62E9AF4ACFB1CA70950F530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5372	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227540244012566"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
3104	chrome.exe
3104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 3868	5304	chrome.exe	96
PID 5304 wrote to memory of 5372	5304	chrome.exe	98
PID 5304 wrote to memory of 5292	5304	chrome.exe	99
PID 5304 wrote to memory of 5292	5304	chrome.exe	99
PID 5304 wrote to memory of 420	5304	chrome.exe	100
PID 5304 wrote to memory of 420	5304	chrome.exe	100
PID 5304 wrote to memory of 2740	5304	chrome.exe	101
PID 5304 wrote to memory of 2536	5304	chrome.exe	102
PID 5304 wrote to memory of 2740	5304	chrome.exe	101
PID 5304 wrote to memory of 2536	5304	chrome.exe	102
PID 5304 wrote to memory of 4020	5304	chrome.exe	103
PID 5304 wrote to memory of 4020	5304	chrome.exe	103
PID 5304 wrote to memory of 5068	5304	chrome.exe	104
PID 5304 wrote to memory of 5068	5304	chrome.exe	104
PID 5304 wrote to memory of 4896	5304	chrome.exe	107
PID 5304 wrote to memory of 220	5304	chrome.exe	109
PID 5304 wrote to memory of 2204	5304	chrome.exe	110
PID 5304 wrote to memory of 2072	5304	chrome.exe	111
PID 5304 wrote to memory of 2092	5304	chrome.exe	112
PID 5304 wrote to memory of 2092	5304	chrome.exe	112
PID 5304 wrote to memory of 5624	5304	chrome.exe	113
PID 5304 wrote to memory of 5624	5304	chrome.exe	113
PID 5304 wrote to memory of 2644	5304	chrome.exe	114
PID 5304 wrote to memory of 2644	5304	chrome.exe	114
PID 5304 wrote to memory of 5988	5304	chrome.exe	115
PID 5304 wrote to memory of 5988	5304	chrome.exe	115
PID 5304 wrote to memory of 5460	5304	chrome.exe	116
PID 5304 wrote to memory of 3104	5304	chrome.exe	117
PID 5304 wrote to memory of 2028	5304	chrome.exe	118
PID 5304 wrote to memory of 2028	5304	chrome.exe	118

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\cyrex_3.2.zip
1⤵
PID:3752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa7e3dc728,0x7ffa7e3dc734,0x7ffa7e3dc740
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7566046675292925691,4844378688622537610,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,12946507465902969412,4307284592099261268,262144 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,11996450348717094701,15454912746309045790,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,15717543741546360033,14471578808463607615,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,2373058118430208120,1840882942066891726,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,14996855048292165555,2956180978962494582,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,12666019796954034762,6225766122179289278,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,14530863358893956581,17372153454508112873,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,9562251024919926293,9890626707168385109,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,6252803439429894001,13023746320420343163,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,16462870505790824045,6517195723766889204,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4468,i,10778665062270380462,10115019517464678354,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3328,i,2914274893027976190,4974051849349841586,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1208 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3456,i,9368726309139320158,1518822167145337830,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6032,i,3778915066258144329,2360168829852277108,2097152 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,15985354532692511941,8629172671064112258,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3364,i,9726065122885985903,5656659263438605885,262144 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,9968894965163856436,9148745509920796019,524288 --field-trial-handle=2056,i,12940908108902656216,463801974164244980,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:2028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a2a74633b3a01152cf24d9e169cc4c3dfd42c710204d58ae2d90d533261b5eb
MD5 1af6cdc22cbd2748099e92244c1f717d
SHA1 7d5882f7e720e5ca26e51aa2988cf7ab366e2058
SHA512 7adbaf5db411852b581b3f32b37f2283ddc5d6d1750963e4ff269a33857830918da584f38c225a13637e81bb2f761296d828df31be9d23ce75d3cf6addbfa547
TLSH
T1F9E02BA6C961EC2716FD176870544649EB8813472B458D4F7E3E82088FF463A068281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f917ba5e2a9cb618a1d34e5d87b77bd1885b102aec0ba7e58ba546dffdc56dee
MD5 ef533305d0fa0f1ea68f4ae2a8d4482d
SHA1 8a2b5131896436f79c9aba74bff4efe2d00e247b
SHA512 3436f654dbb9d12b874c4d966c4f32041ce08b1c0244cb708eafba89d28bd6476143f3e5d0bba40ec924a920d08e7642022a77f41526da3c9e223e0b7adb0437
TLSH
T1FC11851AA10180C1C7FCDBF3EDC0BCA5477819E1B45213EE4EA8C0FF48827252040799
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e62e71cd5d5216e6fab0249b0298091b11fb59fd7c7188434980be4fd7ef2cc9
MD5 4b7e52ade0bb0d6af1d167bced61a5ae
SHA1 719534c3bda232a12781e2a896dac66c65c3b504
SHA512 174b80f764178959ee59a6b7ca87fb5d70402752f1fcee9cdb4e044e45f0133470420c52e35ccf5ad2b3489effe9b21fde36e1f4f411b39ce2ba391e35e21923
TLSH
T100118519A14184D1C7FCDBF3EEC0BCA553B419E1B46167EE4EA8C0FF4882765204078D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0afa8345b7892a348830eed8472e60a0db20609918e6fc887819b3e0b4f3d98f
MD5 64be587273da2ad8d38f4bde97a938ef
SHA1 bc3ad47a4c1a8b733c4a58d687cd2114fa48ba17
SHA512 25435628b6a6126cf49e920e2d1bcc3c82a852353cf231756ceddc70f9a0ba9e84ea521104f8a8cfb981b2dd2f4b426571c61d52f693cdc473431ac9d1f9a107
SSDEEP 192:Dx2KklWlZXhqnVQYHaIaXHqbuXgIL7IHIQnJIKIHAyGPyY58jhTi:Dx2KklWlZXhqnVQYaIaXHqbuXgIL7IHP
TLSH
T16A02BDF7C3D8C52DC91156F4AB25AF2ECE190A28432C3D26C8D8AF4BA3E2571D21065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 3a0806fd540ca394a5c1f28b26a6d4ea9307c6c048b4cec01d003c1643fa3ec1
MD5 3f0d835094d1a85ecb0ac403a0ac4667
SHA1 6c2d86523cca6e6a9fb0d8278f05ad973fb59c11
SHA512 22d1edfda220db0a1a62601b1768c516a096d187335ed42f59ab88ce623efde254248775dfbb1eef4fa67d4ad55e9a9faba87e3d504cb23d9aaa58701651a664
SSDEEP 192:Dx2KklWlZXhqnVMaIaXfHaYOyqbuXgIL7IHIQnJI8g:Dx2KklWlZXhqnVMaIaXfHaYOyqbuXgID
TLSH
T19FE1ACF3C3D8C52DC91156F4AB25AF2ECE290A18431D3D26C8D8AE4B93E2972D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5c18ac0ee6ce0d724a59b9e66ff2ddaf76917e39c9c4cd923cf6f51a524847c7
MD5 26fb9c16b9b63a3d89a2c449b5391a7d
SHA1 6c44cbaebc9dae4837b5c99b22a22485597fa810
SHA512 6c40ccd83b60935a162b83fd56f8e98c7a3b60162826cdd45a718058a52bb9d3c87ee064e1a235deb725ae06b99b54a2a68d410fffbd94643c3ac863cdcd2f81
SSDEEP 192:FRMcBhvn5ZdYO1v7tYhAPRp2h3yp9CHsb+WNn0qrIZ8eTreYh4Pp4aVyIsnAUgrK:FRMmhv5pFhY8Xee4wT3eRsaae
TLSH
T16552C52EA9546A3B5CD7C229F9617B6BE7F1102161D51E88E7FC8E2C14EB5CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d4b8239c4bc7221bca4aa4ef4c86762b9945057c16853ea1c04e95f81fe2bf30
MD5 05475dc7d9791289e2eabaf9740169d8
SHA1 d06f2f38e289c57a3459a6259fcfd835d7c92fee
SHA512 71329d6fbe902d639a0a4ae1876ebd2866aa543a608c281f43536871d125ec90e332dc67087c6dd120e61daefba4f4cfa42f661aad064672c164d6817e873594
SSDEEP 192:FRMcBzvn5ZdYO1v7tYhAPRp2h3Rl9CHsb+WNn0qrQO2XreYh4Pp4aVyIsnAUgraJ:FRMmzv5pFhY8XeD4wTv2tsaae
TLSH
T12652D52EA9542A375CDBC229F9617B6BE7F5102161D51E88E7FC8E2C14EB5CC231B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c7f3af4a32acaacc962f1dcf3ca833eea6c91ae240a17eb6c02a51aedf6d6e7
MD5 3e87c0e4fbb1c723fb89b34afab83b8d
SHA1 bccd58e55cedee6324bdac3b2da9ac8fc8db9460
SHA512 83078d40dc41b462f0ab0ca1b828d1ae79be917fba948084478939ebd1948dabbc90e544277bfc2cf88c81715f396dfb72841c8ec038278176b8e7f1e7705c53
SSDEEP 192:FRsvn5ZdYh1v7tYpAPRp2hm9CHsb+WNnsC0wreYh4PpcaVyIsnAUgtaJ:FRsv56FhYUXem4wz0Msea8
TLSH
T15942B42DA954763B5CCBC229FD617B5BE7F5102161D51E88E6FC8A2C14DB5CC231B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8cfcc08439bebc0422f3cfe496f810683f6998d2306eb6f43b1a15e2f08286c1
MD5 030dbeebf277e224539a042f11685f5e
SHA1 6cbd8a77db41ca09151ff2b93197f48e3cf7b032
SHA512 f1021ef08e043203b0e21cbfedf2a8e38bc3ea08ec1429209522c220a0a8b1ebe96524fe9008e137d28293f04a57ff4fa1c52bc8787115f836ce4a6aed8f5ac7
SSDEEP 192:ORMcBhvn5ZdY61v7tYI2PRpAh3yp9CHsb+WNneMWUiEsreYh4Pp8aVyIsnAUgraJ:ORMmhv55FhYzXMe4wJsEQsuae
TLSH
T10452D42EA9542A375CDBC228F9617B6BE7F5102161D52E88E7FC8A2C14E75CC231B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 963ef216b7e6252c825f61c6dafe948c8c2790055645c2c99f99ea57d3b68b80
MD5 00046a1fe3c8b6ec723873b00a0b6469
SHA1 56f95202759c4cc79a914e298567da6257b2ccd2
SHA512 4883af42227838f48b872e3ae6818a6b3090f832dcfda50f66cf21933963bdd5223d051a5571ec0004715ee69a5fef7011770ec9567688c6e953a57e62bbc042
SSDEEP 192:ORMcBhLq5ZdY61v7tYI2PRpAh3Uc0p9CHsb+WNneME7mcWUiEIreYh4Pp8aVyIsB:ORMmhLc5FhYzXMy4wJYsEEsuae
TLSH
T1AC52C42AA9546A375CDBC229F9617B2BE7F5102161D51E88E7FC8B2C14E75CC231B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 276517a1bbd68459a2dc588c64c0e16392ca8edcf10041abcc5c140dc653cf15
MD5 0649c7be076ba53d52303a9817c2a8dc
SHA1 726273379815d4d9170a9860476379f46e2c0216
SHA512 79e34ceab30253279ee8898f8fffe7a9457685ea041ff002c085200b5d8d668eeda116c32a19e5f4d46b1511c6b067c629a514a291d9bd4c78600c0fd1eff8cc
TLSH
T1E5B0125191417581C42302F815CB04DC35149F248706170553E07A71A82A3924118151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59381d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59381d.TMP
Size 96B
SHA256 3c8e5789120c1ef1f85c96df0d43e1d8ebafc70b7e7c013e75815d5ece708e9b
MD5 ee504c26eb08a9dc3d97473761b74436
SHA1 2197b5d77ee7ca651bf8010d110d97b292caa6f6
SHA512 d8baeb958dad02acd7c71db3b179a2f70a0e5b89cc47872e4a3193818893b41d0a5d796414bce2bcdc51b2005964c4dbbca6718c3b1d0bb013adf9ce77c7ed79
TLSH
T1C2B0220AC002E202C00303F02C80C0CCB2A0CF20C2030302E2E00B22CC2B220C038832
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 dd267386acd0a665304ebd05200d08911194141bdc1706bfa02f57304e5a1b83
MD5 0e259d8d8245a66d07d593fb5b614f70
SHA1 85c2c419486ee35f676a20e550f778e1830b5171
SHA512 aaa2cfdaa1d0c6e11aa4c03244334e457921ff9103c22c9b3c0d8cbafc947dba95558b72472111fb9aecf8177a3e2c9f21281eaad9004afb6c1115f3a6392456
TLSH
T1A7A002528750408AD212A27358A95340732599B11202360342D52A84BD905D4C9A5110
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 4a4d788cdf1a566ce7194264776755f781a0d6a96ed83ff32fd07f79c94dd022
MD5 7fc4d78a2077999f788801729ad69fb1
SHA1 8f6d75bf9bc5a61dfaaafbf82ed79fa68d0c3ab1
SHA512 9768dfa960a3d7765b1ecfff6bf7d63cf8bd5962fda487439f7aaecbf61c855b8ce2a82bad72d8b6691b9d3252ce306d1baa89bf02527c9ed97e90574b5cb8e8
SSDEEP 3072:X2TZ5XOBuFXZj2LDTsrlRq2uD6+3Qw/xLANk0mUW5GmRntSFCjEEN0:GTDOcFXZCL/Iw6+rOk0HOGm/SFyEEO
TLSH
T18A1412782D1B9DB32CED0793329D7A158E15E34BA04ED9EC93A89B8F62941C41F31E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 d5464872d70f288bc71d58b39bfd039f1b9eb9c77930c278b1ebe0ae2d7950aa
MD5 c00f56cd8fdcf81b63c9cac8c63c9237
SHA1 fa621b2339650ef946ca426c7280be73eaa7f3c8
SHA512 90e31531ddbb74dd7ade5a62c2b55f47a12dcf5f26d1bb8e94dc5db8d7df960127f49d881c93de0064f905500e37e438d3093f303a2f0242df1d0d8c88385ff5
SSDEEP 3072:42TZ5XOBuFXZj2LDTsrlRq2uD6+3Qw/xLANk0mUW5GmRntSFCjEEN0:TTDOcFXZCL/Iw6+rOk0HOGm/SFyEEO
TLSH
T1EC1422382D1B5DB73CDD06E3369D79268E05E34A608ED9E993E8D78F62941C41B20F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 f364fcab106ad368847155167bfdac89ccdf1e9c3292b046aa4a0d1889fbe90f
MD5 d4a0b0b75d1f3a2484fa73472ebf9829
SHA1 390854091e76785e09963a818d893b2bbd3a0ce9
SHA512 89a51c7485a4e61d0a3199f8258dabea71b885fa24f6b31d1d0cb5c095999678cdd45e7bcd8367d494d51804bf1ebc57a109184005860bb0517b3045bc836bcb
SSDEEP 3072:f2TZ5XOBuFXZj2LDTsrlRq2uD6+3Qw/xLANk0mUW5GmRntSFCjEEN0:OTDOcFXZCL/Iw6+rOk0HOGm/SFyEEO
TLSH
T1061422382D1B5DB73CDD06E3369D79268E05A34A608ED9E993E8D78F62941C41B30E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 188a759f555a4ab734604bc376abfdb74fc4454599923a053db41a4d244d051c
MD5 cbed223a9962e1dda06b840b4f9424e2
SHA1 563832afbb0947ebd31932c669a8c3efc43050f9
SHA512 8d171b1def0ee6e73600f04b8806ecdc531581ecf55ccf3795c03927b2e1d6d395bbffe262724e7c938a4f1d3686c9a1f6bb6d0fdcccc0331d1d7551a0e8f455
SSDEEP 1536:0NrcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:Ir3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T19C9312BA4E1A46E7957E4AC176AD7808CE22130D70AFA9CC316C639D61D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download