9c2ac002040dbdcf20178ad058091adc44a14d6d3a2deb4e2f152e47bcfcf45a

Resubmissions

09/05/2026, 03:30

260509-d2mlgaat2s8

09/05/2026, 03:04

260509-dk4tesh15t7

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build-wg72emms49fx-7073c90a.exe
Size 108.4MB
Sample260509-d2mlgaat2s
SHA256 9c2ac002040dbdcf20178ad058091adc44a14d6d3a2deb4e2f152e47bcfcf45a
MD5 e98c209a2f9d49a5ac1e6705daf4e791
SHA1 d957a187fc69d01ddfe7cbc1f635785355a6c40a
SHA512 9d085949cb0ab13af062a26016debd12db843d842ad068ed2581d053f420b1bf0136706a83dd069c529f4c8d98a2d1031b8b1675de4f4929eb20263789f5dfab
SSDEEP 1572864:MdliIZoDiKOLLWG3ZCNrpwQ6FDQMtOJGvoEm:MdlUO16GarClDQeOVEm
TLSH
T1A848F01663E111AAD577D138C7AB6203EB72B40723309BDF329C43652F63AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
136	964	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1808	build-wg72emms49fx-7073c90a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
964	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227711057404313"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3672	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3672	7zFM.exe
Token: 35	3672	7zFM.exe
Token: SeManageVolumePrivilege	1216	svchost.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3672	7zFM.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3180	OpenWith.exe
3180	OpenWith.exe
3180	OpenWith.exe
3180	OpenWith.exe
3180	OpenWith.exe
4492	cmd.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4876	4720	chrome.exe	94
PID 4720 wrote to memory of 964	4720	chrome.exe	95
PID 4720 wrote to memory of 1576	4720	chrome.exe	96
PID 4720 wrote to memory of 1576	4720	chrome.exe	96
PID 4720 wrote to memory of 2672	4720	chrome.exe	97
PID 4720 wrote to memory of 2672	4720	chrome.exe	97
PID 4720 wrote to memory of 4416	4720	chrome.exe	99
PID 4720 wrote to memory of 4416	4720	chrome.exe	99
PID 4720 wrote to memory of 932	4720	chrome.exe	100
PID 4720 wrote to memory of 932	4720	chrome.exe	100
PID 4720 wrote to memory of 3388	4720	chrome.exe	101
PID 4720 wrote to memory of 3388	4720	chrome.exe	101
PID 4720 wrote to memory of 4960	4720	chrome.exe	102
PID 4720 wrote to memory of 4960	4720	chrome.exe	102
PID 4720 wrote to memory of 4568	4720	chrome.exe	105
PID 4720 wrote to memory of 3312	4720	chrome.exe	107
PID 4720 wrote to memory of 3312	4720	chrome.exe	107
PID 4720 wrote to memory of 648	4720	chrome.exe	108
PID 4720 wrote to memory of 648	4720	chrome.exe	108
PID 4720 wrote to memory of 4304	4720	chrome.exe	110
PID 4720 wrote to memory of 4304	4720	chrome.exe	110
PID 4720 wrote to memory of 3996	4720	chrome.exe	114
PID 4720 wrote to memory of 3996	4720	chrome.exe	114
PID 4720 wrote to memory of 3324	4720	chrome.exe	115
PID 4720 wrote to memory of 3324	4720	chrome.exe	115
PID 4720 wrote to memory of 2988	4720	chrome.exe	116
PID 4720 wrote to memory of 1472	4720	chrome.exe	117
PID 4720 wrote to memory of 1388	4720	chrome.exe	118

C:\Users\Admin\AppData\Local\Temp\build-wg72emms49fx-7073c90a.exe
"C:\Users\Admin\AppData\Local\Temp\build-wg72emms49fx-7073c90a.exe"
1⤵
- Loads dropped DLL
PID:1808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3292

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\.cache\pkg\b3c55b2ae7bf2c596e9647998bb9a5d49f63c1489732e3f5363c59e9bdcc2b2e\addon.node"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdffccc728,0x7ffdffccc734,0x7ffdffccc740
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4041728632276390723,16974228196426084995,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,5156566848693485178,12050096405351454700,262144 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,15025334002149124357,358050783577583800,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11679839520049972393,15649629582484976604,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,13253973533241443923,16482620301044800239,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,5117426371598650158,12685357224638196895,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,16925661726629881430,11480024100859528045,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,15613742003688473553,17202788166051715973,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,10472044629120647462,10965621885846188226,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3544,i,2503600665421062951,2045885587572606611,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3840,i,16825204812853982656,320591198801457947,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3528,i,6315919216335552537,9495861504502536301,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3272,i,121466129352200542,7249101031176491608,2097152 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,14613326618503053581,17155428364911654302,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,11170577645130846810,7526568334730069513,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,788712458590582432,14554728113796572848,524288 --field-trial-handle=2040,i,1580704865496914484,6423016170140912352,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 46d4436a0ad90e704a848193a835da8bb2732540aea3ea8649834fc32de5f9fe
MD5 fb35a3b89cce6022d60b6bdc41c03697
SHA1 2a35fc78950eeb5f5d0ac97c05b8f9e07757483f
SHA512 4020730d37acae919cc216aebf4b9c0247b58cc866a3140831fc68006b07b36a024485dde1759987a1e3b55024a47f0c322900d6748c049b56db948babba592e
TLSH
T18EE022AAC826DC371CFD0B2862144A46E74427172782895F373CDA0D8FB867A868682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 6a46db4d5d0bf9c50f8d5c246b3647dd801953781685fcab168bc6b9635cc516
MD5 1f54040c054df5d1810792489d39c8b7
SHA1 4a167eff004682cafd5f7bbf7006d14bbc35164d
SHA512 fd5e90d0cc7f6a8f1430242f809875ec4e809394754f85ed7f3af37b17ca8282573034f9dde53d674d113024182f3b45e084e571a63e1287bda8477085781959
TLSH
T1C5F05C373E8D6013EB5B1BF391B11D0A6123024DD632167540DCBC749D1B36DEE011D5
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7a1fee4708b3d053e142bb805680dc623caf7f95b38dd8c70498fe521d5d15d2
MD5 62c5ddb697a58854bdc317ece857a807
SHA1 1f2bdc370e121a91fb20388e34b73cab9b212e5b
SHA512 34012df586c45ef13dd5d3389b35c26587f61cea837f8f8d22304671c84cc8348bee31e6ff625471d25e8eda67673a17739192a743c30a12d16d990cfd7c85fe
SSDEEP 3:MsEllllkEthXllkl2zEIUdl:/M/xT02zJU
TLSH
T1D94404057FC00C07CD4010315011C3505370F4100511D747345104137CC75D0CC00140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 5172ef5a9549b9be7b495689aeb1dd050f12ba812b10397ea071a9b51feb720f
MD5 c7c91ff98079bf3dca97db42893288a6
SHA1 537a40dc9b04c9be169cab08e235bd9edd7b0722
SHA512 56ce228a30d2f1bc03d9bd8cfe7fad3c3c556f2c248c74aeff7e6f2bdabf9b572e5578878e8223474e2fdb3a56ebc2784c0c383e1f98af8bdc25c27594228bc5
SSDEEP 192:DHo9Aq9/LbBep7aIaH9l3roOWq5DNNOJ3CpfixOO+TO5SSOArAwCS:DHo9Aq9/LbBep7aIaH9l3roOWq5DNNOH
TLSH
T18F22ABF7C3E8866DCD1166F5AB146F2FCE290924432C3D66C9E9AF4B57E2471D20124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 63334f4525134aef6f05b1f3334604f2ea23b050b72af6134007343720eaa5ec
MD5 604c20424b8dc2b449ce46a0f09b7f8e
SHA1 e0cdac3442ee1f5c0e6880c98e28eba7d55e0874
SHA512 1fc81ab6045da41b581d3431098b2ad19dccb551d3b82f131fc7ac21e93c8e8545a38233421db59f3f41b23a1ffb2a8ac21cc15205a48dd6897f37459d73d8a5
TLSH
T183216D57D2FD789B107D4CB71D04BA092B75B431039154E8DDBAD16C70D24EB6B06472
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 040d7e1a0fa6166b413e59303dec40d5dd8ad608b55e48de2652f6981e509184
MD5 3b1a3810ecafa9b59134fa6d6b69273c
SHA1 dba64bf50ce3835cd3fb71513ae2933e2b0a4bcb
SHA512 09c323354a0801830c671a398990e01d5ddf44e7292727433c1b4a1dbd2f6a26a9501f440ef805ea64eb527e6b5c53f5b8f45d1e52a60656d4c454341819f69d
SSDEEP 192:5hRBcBzHnEMAdMDoycv7rpAPRp23GnYkJ98Hsb+WNskpmO4fH2PyVX3VyIsnAUg8:5hRBmzHE3yIHUX/J6wNBo2POB8
TLSH
T15552D72EF954397B5CDBC22AF9257B1BE7F6102161952E88E6FC8A3C14D7ACC211B047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9735cf539e143b1a49d182977ef212de0b885850b7e476ff578c10be066d5c79
MD5 a023d1c655606afddcd424ee9aacec47
SHA1 9927e928ce5f67c0d212c667b83b39fa35b8065c
SHA512 46e031911af8dd96fed21254f8cd1c8bf8bbce40da8ba628d08ec5555e34a61bf76ef08d1a7d123e3acf23b126634f76a79b64b1da8a1f711736ba23a3c26d26
SSDEEP 192:5hRucBzHnEMAdMDoycv7rpAPRp23GnYA98Hsb+WNskpmO4fH2PyVX3VyIsnAUgtK:5hRumzHE3yIHUXD6wNBo2POB8
TLSH
T1E252D72EB954397B5CDBC22AFE25771BE7F2102161952E88E6FC8A3C14D7ACD211B047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8e303060c570cf2f0bef081820ba0d0367bd21dd96344016c2710e8da7b0baaa
MD5 499b6f6ec7c2a6f2735e26611fb38bd0
SHA1 4cdfc4ca0b2a2efea7c4ee294a482b78e26fe01d
SHA512 e974d73beca8f4d0c7509ef83c5b90697cf512ae4784c361fe619ee805a169219125fe464dab3e7ebd38f8b76f6107051ee0fb8987a9e78d7607cc4629c63da0
SSDEEP 192:5hRucBzHnEMAdMDoy7v7rpRPRpd0OGgeYA98Hsb+WNSKkpmO4fH2oVXrVyIsnAUp:5hRumzHE3yDHzX86wQBo2s9e
TLSH
T1DD62E82EB954297B5CEBC229F9217B1BE7F2106161952E88E6FCCA2C14D7ACD3117047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fc708c3f292e911600957ac6311f8d7a7f227ebc505ecc248cae185636c2dc9
MD5 f0e0e43fb7b36378dcbf62c8b804f986
SHA1 53f579e98c2643afee89724ce2e61fd7596b8943
SHA512 3cabf84dae0c822121286510fbaaae09241a21756ede9d7b408f5fa5401b197dd9a85ab871d367845b11e3a6cc1e7b5c3fac6065d182255fbc6e62282d4d7c2c
TLSH
T15AB0129080019542C4C302B1618604D831149F31C706130153E06972EC362B18064250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597d16.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597d16.TMP
Size 96B
SHA256 a0f56c5f314b02a4b14cb6139addf48d81458a7f2f3eedc9b94f40100cad6268
MD5 e70e8cf9a1a1a5c99bfbaf053ac24f52
SHA1 260d44e605f66f82a328d018df05fe7a91c4c7b9
SHA512 1666762b16f62fdbda6d007cf84d94c99875508d0eb7b0936d297984de53df815bfc344dca5ab0e5032e2582e518af47c04536cc79636272c651b6e9631c5d08
TLSH
T18BB00299C2026222C05303B069E59AD97660DF25D703122793E19E66EC796758929271
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e35e4bf2f58d759c31f94a0de85a95f7f12fa1c0a383542c0a829aab277f0dd5
MD5 a8c766425dcbbfd97b63d2a92deaabd2
SHA1 670c84dc4bc6b6bdbc8449aa8b3a6a965165ef40
SHA512 38018f0c795cc2d70d6d4cf930986600489ca61b39d59f68e09f3da8e2f7f61002727f758104d865625f514e6f9102a7bacc531fce50fb0519b2ffe0d788d088
TLSH
T110A0027183430401C047B6B7949603432B329C5041020317A2D12644FB54694CA62420
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 d6eaa0f6a08aa2fdc54b2ee78a0165a0cfd6ffd3e891a6cd9e644bf80e65541e
MD5 be97eeb74152a8f88d8e536ad4841c21
SHA1 74bf0a02c27d88608de8c4ab4f257774a507ea2b
SHA512 0d607ca59c7407472df8d36ec1fcb26ee1ff0920a0324d8c45aa5698058ad35394d55cc1c13e828053df9002b531711e7c6ea2e2757fc7c60fafabc01cd8dd10
SSDEEP 6144:o2glB2HWb+GP1Rlb52/EurOk0HOGm/SFyEEW:eEWb+qRlbKrOjuGdF2W
TLSH
T1CB14127C5A1A8ED7787CE243B13B6916CD2276D7605D81CE3679238E3AD81807B33D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 9aaa79ea15d637627aa518521ec251d6009c3779f2e9e24f38a705fe410ebf88
MD5 039051703405b136dacda42b2a20cb58
SHA1 3955feeb5ac41ed9cff1312d033054a0015720d8
SHA512 5c6f4b5c2354d4922c16efc4369f17e97db1ed796ad0975956d50f2cd8e4a418e092247af98f4755d03485685cc5105ce9e0aa54c924e4c34eef2cafc432c465
SSDEEP 6144:n2glB2HWb+GP1Rlb52/EurOk0HOGm/SFyEEW:BEWb+qRlbKrOjuGdF2W
TLSH
T13314127C5A1A8ED7797CE243B13B6916CD2276D7605D81CE357A238E3AD81807B33D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 9592b8c178eeedfe8d0ee6b399bb111f894ec934bc6f5f0abc553573c334d4ca
MD5 cb13dfd3397cceddcda35d534bf07c22
SHA1 d8b8d997457efb67d7d60a8be0d7ddbc4fa84b61
SHA512 85cf63175a10bd9a24aeecd214721cb9caa1808806b85e472acb5a6a112e07c589f3ec40dfd2317b4454f3877349f844001e60c5405df88d33d6503789f71a08
SSDEEP 6144:L2glB2HWb+GP1Rlb52/EurOk0HOGm/SFyEEW:tEWb+qRlbKrOjuGdF2W
TLSH
T1A514127C4B1A4EDB793CE183B13B6916CD223687615D81CE3676238E3AD81803B33D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 a725e9451a44550a6a47325075306aceadf908f0cecd2119ead1fef842ebc1b3
MD5 e7e8fc1237345b0d10a7c5a0af7fab82
SHA1 d2268cdcbc403e305862408e4143e19b95864f15
SHA512 3b50f4274f91004cb701c7a6f9dd5840811d9364a5810460392be57f78cdd652c2c21f529313a4abe12e140eb527e931ce3c86e34faf9d71cc80db351e15ca84
SSDEEP 1536:g5cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:U3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1C29302BA5E2A4AE7957E469176AE7809CE12134D706FA8CC31AC539C31D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 720c75ff4dbabd20baf6d3a1c4a73a40016456966114413bd8a3c6fb668d3cda
MD5 f9cde4c91141d51476fa056e2689b2ca
SHA1 81d208c8c0ea4a84074b96de8fdff9fed38c978d
SHA512 7a6d375b25bc9d7041bfe927a26e3b9f331640e9b06cee82f2287384198d75b5da15f4279b51a1afa337eb4943f905a5bcebc25c7ef650d3e5d6600566001a1a
SSDEEP 6144:02glB2HWb+GP1Rlb52/EurOk0HOGm/SFyEEW:yEWb+qRlbKrOjuGdF2W
TLSH
T17C14127C4B1A4EDB797CE143B13B6916CD223697615D81CE3676238E3AD81803B33D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-42-0x000002805D220000-0x000002805D221000-memory.dmp

Download

memory/1216-97-0x000002804CD40000-0x000002804CD95000-memory.dmp

Download

memory/1216-43-0x000002805D220000-0x000002805D221000-memory.dmp

Download

memory/1216-44-0x000002805D330000-0x000002805D331000-memory.dmp

Download

memory/1216-40-0x000002805D1F0000-0x000002805D1F1000-memory.dmp

Download

memory/1216-7-0x000002804CDA0000-0x000002804CDB0000-memory.dmp

Download

memory/1216-23-0x000002804CEA0000-0x000002804CEB0000-memory.dmp

Download

memory/3180-359-0x0000013713E90000-0x0000013713EE5000-memory.dmp

Download

memory/3292-4-0x0000019AE0C80000-0x0000019AE0CD5000-memory.dmp

Download

memory/3584-39-0x00000196776E0000-0x0000019677735000-memory.dmp

Download

memory/3672-6-0x0000014BFCE60000-0x0000014BFCEB5000-memory.dmp

Download

memory/4772-58-0x000001D9FA040000-0x000001D9FA095000-memory.dmp

Download