46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ropro-patcher.exe
Size 5.2MB
Sample260509-radfdahs71
SHA256 46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab
MD5 a45a9b8f355e4eba9bb96171f572b3ea
SHA1 87a8a3acad2b65db9e5ef978d795f4f5e3c89ea5
SHA512 5afa6388c7d1019eb713efaf4e0daf275e65553152cdab8b06ad253278733e7b1b7a84a99cd059c0cde3ed7d20bf9fe5c7eb3bae1cdc403c7f4b02ff1d933d1c
SSDEEP 49152:4ksMKU1of3gRlm2enekEWacjeQrLBNCF2Uw5qfzWfE1KlWNz3005xjYmGklytaj/:4id30+nGHHeecFTZOZaG/L1l3QdQE
TLSH
T15B463B217F5A9AEDC09AC074C24647726A7274CA0B35BAFF45C496783E25AF41F3C398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
724	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228087647000965"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
1028	chrome.exe
1028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3584	3936	chrome.exe	90
PID 3936 wrote to memory of 2096	3936	chrome.exe	91
PID 3936 wrote to memory of 2096	3936	chrome.exe	91
PID 3936 wrote to memory of 724	3936	chrome.exe	92
PID 3936 wrote to memory of 3192	3936	chrome.exe	93
PID 3936 wrote to memory of 3192	3936	chrome.exe	93
PID 3936 wrote to memory of 1528	3936	chrome.exe	95
PID 3936 wrote to memory of 1528	3936	chrome.exe	95
PID 3936 wrote to memory of 2248	3936	chrome.exe	96
PID 3936 wrote to memory of 2248	3936	chrome.exe	96
PID 3936 wrote to memory of 4468	3936	chrome.exe	97
PID 3936 wrote to memory of 4468	3936	chrome.exe	97
PID 3936 wrote to memory of 3608	3936	chrome.exe	98
PID 3936 wrote to memory of 3608	3936	chrome.exe	98
PID 3936 wrote to memory of 4956	3936	chrome.exe	103
PID 3936 wrote to memory of 3172	3936	chrome.exe	108
PID 3936 wrote to memory of 3172	3936	chrome.exe	108
PID 3936 wrote to memory of 3200	3936	chrome.exe	110
PID 3936 wrote to memory of 2984	3936	chrome.exe	111
PID 3936 wrote to memory of 4636	3936	chrome.exe	112
PID 3936 wrote to memory of 5112	3936	chrome.exe	114
PID 3936 wrote to memory of 5112	3936	chrome.exe	114
PID 3936 wrote to memory of 1028	3936	chrome.exe	115
PID 3936 wrote to memory of 552	3936	chrome.exe	116
PID 3936 wrote to memory of 552	3936	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\ropro-patcher.exe
"C:\Users\Admin\AppData\Local\Temp\ropro-patcher.exe"
1⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffedbdbc728,0x7ffedbdbc734,0x7ffedbdbc740
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,595407957598814492,10381281580608808862,262144 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2194546177901815940,4612790736289941880,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,8186709472147364714,401484071122229052,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10912832819697674439,10240619233118038432,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3400,i,7476684030937041921,6224464858534715773,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,11999319065350703484,7376917057449259775,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,13649458817767504055,7117171802066293958,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,4641555440244406645,1147182805754131586,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,1585746150873799763,8939121605293198390,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,17864024735294729589,11280615711335338685,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,9469906671317508431,2911224156260914149,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,6468867056029253324,16506427306708214940,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3584,i,2002879327113417848,570104537502759336,2097152 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3960,i,2755209982019814655,8533916847020297409,262144 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,542947188124315361,11590727116201697233,524288 --field-trial-handle=1896,i,6387913229981972165,12630775104468829062,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2810cf025de64167733eb756ac0bc561b25c9e1c7dceb9e373f21ee2ef1055d4
MD5 e13b7f9f7075336b3481effa973dbb82
SHA1 8890397e74251622b5375fc6a01eca1b2725f78a
SHA512 321d640275a864e14d9e071c72dac8eb99d0d7969e34019fa17fb2e43ffac18a3d91eb27f21197125a0e9f8dd4805084d8b4c5692327dc914d113a2f8de00838
TLSH
T130E02BAAC965AC3708FD071920855345E714035B1B41550F363C821C8FB023E918682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 442c38b3d472dc11a563b8dff0840f6285d449ee44538af4dab70df6d794fe06
MD5 49b502837328291949c0ac7671b5bd4a
SHA1 b523750d69d24c4536e1c246f8affc42d3a5b84c
SHA512 e577db39452c9ffe15dcb4bf1e45b0e97e3fa3e7e7b21ac0014fc22653ffbd06e5f42f79f958f10f0342010d780e3bd828b11ed131701e1a1977723c10e10c8a
TLSH
T1F8C0921B56849022FB800771286244CC36E829E80EAE6AEE95E04189FE127F32505E46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 307f663e093a53d2cedf2cc9fb3fd13905cd7045442685fbf6b64e68b5b054bd
MD5 eee907433c821e291bc8dc63608b94d2
SHA1 b3f42a24486150b570f26fa511878a0f4be566c8
SHA512 09a0817ef5d0f3338d01fb01ecc8f8b94c67cff19a7002cd51c87a5dcab63aac8faef6f817c856f5bdca6908d39eac6a5f1e88c61b0655d205eccdb57560900f
TLSH
T18501AC0B8C894035E7B0E277BCE50C183ACA2D9B61C20BA595D6B134EF933329F5B943
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 91bc7c308b8135bfd09abe6b20295e6a9b6698c764e23a19280b8a2bd91e0401
MD5 3a7f0d071fc1f827d62cd9e20819aa35
SHA1 d89d188844a6d7e838fc6192c8a073024022d818
SHA512 9e890282aca9cbf2ccc00fb3698f7e44b1c972d8b30cd3e849532df3ebc6aceb45bdd554dfb9b6986b3841eec5cd5767c367e0895925482a71a50800b9ae5722
SSDEEP 192:DCTdKVKZsHxmwSg5aIa2yZaWIbj9+HHJA0AUCgoILp:DCTdKVKZsHxmwSg5aIa2yZaWIbj9+HH/
TLSH
T169028CF7C3D8856D891156F8E7157F1FCE2A0A24431D3C66C8D8BE4BA3E2872D21529E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1896b439fff9832f99a1af315a81093201976ebdb4197ab825512c602b14c998
MD5 1177e62cf59f09e87b46e0c3d3a46c92
SHA1 7dbe21ca0db55bdbfa99948268a722f5ec07172a
SHA512 4538d7a1f1a46ca1b7bf99cef1ff4a61026fe6d8da073656e872f2ea6b279152cf353efdcf6d83a7ebba891b21e872f9416bba4cfad6b9fccf6cba5aac27ed32
SSDEEP 192:DCTdKVKZsHxmwSgh/aIa2yZaWIbj9+HHJA0AUxImOar3p:DCTdKVKZsHxmwSgh/aIa2yZaWIbj9+HH
TLSH
T169128BF7C3D9816D891156F8E7157F1FCE290A24432C3C6688D8BE4BA3E2872D21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8f10a611cb3a608244edfcad8a9db6773e8ec6d1d543c3ed0076f5b44dff1593
MD5 7e8c9b3286763015d47a92cc9ee4d276
SHA1 482c0f4a7b57cfda6d7b77fa2b16dceafeda3b67
SHA512 5b30e21c8f066f487a065cdf6d3bef1c6d183d4652337669fae64d5087bfb6092a32049ef29027218c03e2de4c346a90df4c21b61b6b95063a83db3ec8ae1553
TLSH
T16F818BB3C3E9856D851156F4EB157F1FCE290A24031D3C6688D4AE5B53E28B2E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c8508fe363939a568c540eeeeacd50173d7e88fe1214a459180f5a06deb3e2f5
MD5 ba39d15cabeedb52d399aff8b49cd63b
SHA1 938400da25ed1b4a0c5f9c62952cdac1d85bd13f
SHA512 c908eaf438101da705ba3eb79213b71efc8ac9c69ee3443e6f3acaa822f09dc23418782443456a7c3c7bfa8984fd22b6534c9b34f9cf02f06ce1f58bf4bf2326
SSDEEP 192:aRkjHcBzeQrbDl2RNXPv7rp/PRpnpbd19+Hsb+WN+cET4WWEOd2y7aES1nVyIsnt:aRk7mz1jAhHfpX5EwE4Em2WaFBv6
TLSH
T1C952C62EA9186A3B9DDAC21EF9117727D7F5202171D42E88E6FCCA2C15E75CD321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4085525d605c2803f93bf144e2348d95da9102a3390088b4c78bebb923e20e44
MD5 69f21401c8eca693ca42b8786db7ca6c
SHA1 82f92b2a9bf3741311e25061c2a1d7ef5a5768d2
SHA512 1f2dfd37f8621edd0de633eca9b4c861f8b0c6cbc4d02a59fe712cb4faa41d95cfca34b51102a5c9b49c9255aa441b475008a013873c9dd72f68356c63096708
SSDEEP 192:aRkjbeQrbDl2RNiPv7rpAPRp2O9+Hsb+WNnET03d2y7aEShnVyIsnAUgtaJ:aRkn1jA8HfUXlEwY0N2WaRB8
TLSH
T1F942A52DA9187A3B9DDAC22EF9617653DBF5202171842E84E6F8CA2C15E75CD331702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 675c5a83057718163aeca2c4b09ddaab76821bbb20eff4faaabf1f242748c04d
MD5 9d1a00804a2c2dfd7b2aa2813c684e2d
SHA1 4694cbe2fee5521274fbbc8b2dbabe7e4abfbf9c
SHA512 8499af62031eaded4ee542f1967448e2be032720711ccd2a52cb516d4ca1a1ec7ad49ef665705330acda824596834c138bcf68a969e21598bc0825e28790db3c
SSDEEP 192:aRkjbeQrbDl2RNXPv7rpAPRp2cp9+Hsb+WNnET4CZ2Vd2y7aEShnVyIsnAUgtaJ:aRkn1jAhHfUXxEwY32L2WaRB8
TLSH
T11E42B62EA9186A3B9CDBC21EF9517667D7F5202171C42E84EAF8CA2C15D75CE331702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5d211d3c2f82f1c615c510ba83d4394cd83ecbd10e9abdf1692d12690ca2d596
MD5 b758d7c69bed770532bada94af7a06a3
SHA1 cc661aafb7d9d895584610b08427de572a75320a
SHA512 2de6f9e6ee25f98d6b9bbdf1e47d159b0ce637fb82f95f870c20483a4a95c037fa590a73321a8662e8355ac32d895d55b12b9b922c5f484c50bb0ef434874f86
TLSH
T1D1B012A280425611C00702F41AC204D83114DF109705270173E46975D82B1A0C014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586fdc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586fdc.TMP
Size 96B
SHA256 694330da7504e1feebd4b40cf0cdbac1e6a834e9e24c5528bfd3f69dd0dc2d7d
MD5 97131ccb0ae37a7befb9805ff399cf89
SHA1 fa34820b4a74280399f7a8a3f55f4441de7c52ac
SHA512 125a7de77e9e71b886e1f86b432c8d393e8e8991d8d68bacdac3e9822d74a3dc910c8009405d053fad611d12a939bf99ac80c84d46fa3b26545b6956b3b6a140
TLSH
T125B00265D2536217C04A03B43D9696D971A0DF39C713372693E12A7ADC356A1C636660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 7fcfdf7e80c6322ddc4aa7edd9e872c9f820ff8c3ad173ae5c532e22a3826158
MD5 6815190b750f8488a2cbd74077677215
SHA1 2e4bad939f9c265ade96bca2f46d171e0f4de591
SHA512 913952c1571bc3d14354fbf5261b711f5a20e2bc674872a81e40c62a6b7f388bb21e1785683acd527393da981d96914a9898d2ce9744908d606ddcd7a4842f74
SSDEEP 6144:wqs/qqac2AS/K5Xpi5LPGIUfcbarOk0HOGm/SFyEEQ:wqWSbPGIUfIarOjuGdF2Q
TLSH
T1E244123BEB2789B7446D0B60315EBE074E925B4E866DE9DC1318534F2C456C61B27DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 876ad51a7bba503577cb7f0ce91040217ccc0cf5d7ce0cee5f80cd87baaced96
MD5 fe50022cf5de289dde17208ca0b2f56f
SHA1 0da6fd527d9c4dd60b2f0b0011f006b014f560b5
SHA512 4554adb8d1566771b2d333ff315a75d069823df97f751f6f90f47f5cb593efd79230993dc1b38a3ed3ec3f7f2aece564a0f54216053e5e10ca2b4409d08a04ea
SSDEEP 6144:1R/K5Xpi5LPGIUfcbarOk0HOGm/SFyEEQ:3bPGIUfIarOjuGdF2Q
TLSH
T18B14123BAE2B4DB7547D0AA2311D7E0A4D929B4DA2ADE4DC5329520F2C5828B1F17DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 73b16bba3241f5065fc7217a66a20492a6dff4dbc5a195019bd04d9196b4756e
MD5 7585bb50c306a30d501a3fed7a3082c4
SHA1 4e6f3817bb678c615913ebdf34fd360acbf5ef77
SHA512 3a1dbde1c1946f6029951db3713cb69ae0fb1a3127475964d59f42631f546df236d9e6dc6db2df762ec8e5067ff82fb4a1e2326caf3ac41159d30f23f5a72c70
SSDEEP 1536:jVjcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xj3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1149302BA5E174AE7957D4A8176AE7809CE12630D70AFA8CC315CA38C61D41C92F63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 187fc30a3f7ce5ae66c34620e06d4061952f2ea711ae1f7504033e2421e1e830
MD5 eb011d408b68dc5e9bd7313c87d36b03
SHA1 04bea3927762c60232cb6f8bb1298c7a976a79f0
SHA512 626d43b390720030a4de952bb66a8c3ad6fa6637eaae5773926c114b3821bf60e50c0bbf04cc68b5e863907829c0c96a13609e2143896b3850b1133b1863e764
SSDEEP 3072:skjzg4KEoTTpiQ4zOexlzejIHRCZDRce2a3Qw/xLANk0mUW5GmRntSFCjEENe:p/K5Xpi5LPGIUfcbarOk0HOGm/SFyEEQ
TLSH
T1AA14135BEF2B8DBB447D07A1312E7D0A4E525B4CA2ADE4D85369520F2C942CB1F27DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 cd0301900ef87a39e906f344af237dcdc56d8b3a7d8c89ffca9fb4143ba28a0e
MD5 e76bc5145f00d6f9733ed6e6fde63545
SHA1 68d2610ca9df1f8077965d5b0a396ffd495195b9
SHA512 9290eccdade8ae76ab931aa7c7394f8551369391ae50deea6462a9ac476fe5676478b41debfb849415146c71611167a89ac4b8fdd4c1c490b1514d7edc4793b5
SSDEEP 3072:Nkjzg4KEoTTpiQ4zOexlzejIHRCZDRce2a3Qw/xLANk0mUW5GmRntSFCjEENe:W/K5Xpi5LPGIUfcbarOk0HOGm/SFyEEQ
TLSH
T16414135BEF2B4DBB447D07A1312E7D0A4E525B4CA2ADE4D85329520F2C942CB1F27DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\RoPro\_locales\zh_SG\messages.json
Size 4KB
SHA256 12ef5bddc89a43c0d3aa42ff0ccb4dea11a6ed327ee5257cc6e34c37290de6f0
MD5 6b1236d97842e369fc4a307d1a61a000
SHA1 ff9293730d1604dc6ef0d061438a9190e58044a2
SHA512 cb42afd970be5b54c926a26d3bf256b1d12fd004f6466ada6f5f5eb25bc44329747c9d095ff8661a099ca7bbf9e393805d46dc0640620d79c7112fcc6e1e3d0b
SSDEEP 48:2OFWrfLLkr0NGvvupu8e8TeckW2dY6KVG44/nflwVYxwx/QWAJIpLt0twQI:2gWrf/Gvvupuh9tPKVzGXW2Cr
TLSH
T13C819C1CC4F02EFB168B306278AE7106A6B465DB182C3D2EBE5C142C2F8DD6C55AF391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download