killmbr | 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1

Analysis

user interaction
yes
max time kernel
1559s
max time network
1533s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Size 84KB
Sample260511-rdj3bsby5x
SHA256 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1
MD5 f8b1e2d0b92311062cd2e1b5bec88e45
SHA1 53b1b3589b8acd715e96ab70f4405f7392092730
SHA512 8936621679326f1684a522dd1b09a3d8f4f5a17c4a13cb8f680718e16fb39d749c2e064cfd4b8915cb456123f14237e745aab88f98dd9a532cacc4e95bcac170
SSDEEP 1536:QVIn7vLAsry2eslLS8Ti1nQyd9O3jKVfOcHoHoPFXOvs/WP:QU/9+vstGGGFO0dXOv6WP
TLSH
T15C837C53B6C24372E68156B4419129B7EB31E73BC3625EC3C3045A07EF561F2CC7A2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution killmbr trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244ac-186.dat	family_killmbr

Executes dropped EXE 1 IoCs

pid	Process
4008	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3352	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229819267932954"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2412	4904	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe	85
PID 2412 wrote to memory of 3908	2412	cmd.exe	86
PID 2412 wrote to memory of 4008	2412	cmd.exe	87
PID 2100 wrote to memory of 3124	2100	chrome.exe	90
PID 2100 wrote to memory of 3408	2100	chrome.exe	91
PID 2100 wrote to memory of 3408	2100	chrome.exe	91
PID 2100 wrote to memory of 3352	2100	chrome.exe	92
PID 2100 wrote to memory of 3504	2100	chrome.exe	93
PID 2100 wrote to memory of 3504	2100	chrome.exe	93
PID 2100 wrote to memory of 64	2100	chrome.exe	94
PID 2100 wrote to memory of 5092	2100	chrome.exe	95
PID 2100 wrote to memory of 64	2100	chrome.exe	94
PID 2100 wrote to memory of 5092	2100	chrome.exe	95
PID 2100 wrote to memory of 5428	2100	chrome.exe	97
PID 2100 wrote to memory of 5428	2100	chrome.exe	97
PID 2100 wrote to memory of 5544	2100	chrome.exe	98
PID 2100 wrote to memory of 5544	2100	chrome.exe	98
PID 2100 wrote to memory of 4492	2100	chrome.exe	99
PID 2100 wrote to memory of 3436	2100	chrome.exe	110
PID 2100 wrote to memory of 5404	2100	chrome.exe	111
PID 2100 wrote to memory of 4232	2100	chrome.exe	112
PID 2100 wrote to memory of 3592	2100	chrome.exe	113
PID 2100 wrote to memory of 3480	2100	chrome.exe	114
PID 2100 wrote to memory of 3480	2100	chrome.exe	114

C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
"C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F4D.tmp\F4E.bat C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff3b36c728,0x7fff3b36c734,0x7fff3b36c740
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,4904145812848447801,4163683999968472745,262144 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,17150889656782670368,8802450879892769880,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,11352052020323919525,11083935213990299085,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,12541458938901931499,13501132830700724583,2097152 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,11959709615535942736,2789253151283225126,2097152 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,5674143563262967844,15466786893600351306,2097152 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,14724646867430171256,1513367719172061168,2097152 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,17339275600196447248,6102471529389208667,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,5782637996215438065,10553180160946309166,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,15685765296244548302,4850805515304428502,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,7535598301487774382,12447898309871722814,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5740,i,4418066099603990670,147617605119483006,262144 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,7078395041314668029,16692503406813589513,524288 --field-trial-handle=2036,i,11560219604176234691,5348230720573771378,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1344 /prefetch:8
  2⤵
  PID:3480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cca19abffd9b2284125141db50a6d89b372a45c8c13368f5cc29159fa10bef83
MD5 27114c6e634d08688198aa355d358cb5
SHA1 62aefa65abf6dc7026312e18fab6cca6613510d4
SHA512 5b810a31e478ac13f272ffff30fb83f486ccec00c2f599e0689fd6e685fea8aaa2d6abdc54ee57576c1360b15bcc58e8ffd1971a633b03fba153f73815ed244a
TLSH
T11AE02BAAC862DC2B19FD071964604646E75113572BA0894B773DD30C8FB063F4986C9C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3b7a0d2fcf7992962ead418ad9bb27f4824107a757b5ede784b9fe4e1a5448ca
MD5 c00e840b3eb4238163b97439e8372dd1
SHA1 dfbc033d483e8bc3ddc121ddcab581f3b7c6541c
SHA512 64b8394b38402736f1a0c93b7f38e6affddb90e5cdf65aec42c91c5956ad58bf23384f20595ea6ba0fa2e30efaed94fa75253c78f430af7d07a5d4f394b9dbc3
TLSH
T108518CF3D7E8897E851156F4AB15AE2FCD6D0A24131C3C6688D4AE0B57F2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e3ce3519a761e6f9d27cd93b4fcd61ff172465e7255c4748fcb9612cd802cbda
MD5 250b2aac83d5eb1eb4829439f642c4e0
SHA1 c119a90289e836e073e38055a0feaa3a4320782c
SHA512 24a2d4ca162171bfbd585b8546e1b34cc45e5404dc3dffb39b460f37b584ebe2f9a4a97ce7e6f8b09d309ef0975888c0ae253b4f2a69ac1aa82a4cc7c2fb9301
TLSH
T182517DF7D7E4897E851156F49B15AE2FCD6D0A14131C3C6688D4AE0B57F2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 dc19aa65769306486aac08f28cfe2898d1b3a5a84c69952b5f8458bb71ad6104
MD5 05882885875348cde7ee304b02cf08bb
SHA1 3f7ed140ce52b23fec52971ee7c88551f567930d
SHA512 24e954327bf29d11cd51dd5f5f64151e173aaa9ac4e788a9cf5b91928ac38c9a2a38587348d3802c495371578b8c53164a3f0635681fbaba7069ba7fa1003555
TLSH
T10FF059E7A72E7497407A457A2E04BC0A18BAB830125129F8CE6B812CE0959F71F12007
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e4d920e19e44a42530a0b9cbc569f478e4fe2059026cde2de8450e37bf0a6572
MD5 ae7d1d2ecb9fe59bcfc643aeb5da2eca
SHA1 f2584d4288b745ef3fc459c2146030de6cf2b469
SHA512 b656967d96566e00d38c6fb0cb64ea3033f38bf4e9d896f0255ccd16bc919081990c3f1799de5fab9df4863474e1375e05728d50b7e09b1d42200abc78afb0e7
SSDEEP 192:tR3zhcLiz8Zvv7SpAPRp2s9QHsb+WNn5y0DLeW2aQ9+VyIsnAUgtaJ:tR3z/WneUXvWwQ0H2aK28
TLSH
T11142B76EBA54693B4CDAD21AF9227717D7F5102170D41E84EAFC8A3C18E75CD321B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4302a94b65ebb8ac2fd7ff6836a455d03fac8500d5fba9d56561ca941245192a
MD5 29ee40dac07a8b980b7a957d117d2a22
SHA1 0231f537394bdf186b2cdbb215b3e7a6cf37b0a5
SHA512 58e6b49a4f2acc4d6025de65e134d604a05bc1412fb82f3e4fc6904b195b48215e93da9529995808955263c4465777897cc5bc33c28a7bee8e1728a4191056e6
SSDEEP 192:tR3zdcLiz8ZOv7SppPRpNs9QHsb+WNn5y0zLeW2aQr+VyIsnAUgraJ:tR3z7WqezXCWwQ0X2aO2e
TLSH
T15C52C52EBA50693B5CDAD21AF9127B1BD7F5102171942E84E6FC8A3C28E75CD321B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24b5c71090cc70a911486a99ca6c737645853ba415fd0c0cf85e837ab202b9ef
MD5 2df610eacec88e5d965032791fb53da5
SHA1 f16872f9075d92e70b9853a3c849eb9704655b80
SHA512 53f0d39e8d3dc67e238aa1c78fcccbe544f1957e47b1359ef2b5c6e5ba59d5fc703662a64aec1bdb8e9bf0053ade62ceefb976a44fad55ee68389f68ad1577d3
SSDEEP 192:tR3zhcLiz8fvv7SpAPRp2s9QHsb+WNn5y0DLeW2aQ9+VyIsnAUgtaJ:tR3z/GneUXvWwQ0H2aK28
TLSH
T1AA42B66EBA54693B4CDAD21AF9227717D7F5102170942E84EAFC8A3C18E75CD322B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c95688736ced0bdf90e3e1e07c4564b0c0eb511090fa708045b8556dedc0c7e
MD5 7980a863a6c9bfa30cd80869eee5c11a
SHA1 7ed4b4d4e41954a4114afb3d638751bbff4601ff
SHA512 c47bb0d753662e2f12fd1c653ca54a0239cb42779b379744fc96235d1bf2ebf31baabf34fc2b73673f11114e8cbfc1d4f9467084d30a3577cd51022cb31131dc
SSDEEP 192:tR3zhcLiz8ZOv7SpAPRp2s9QHsb+WNn5y0cLeW2aQX+VyIsnAUgraJ:tR3z/WqeUXvWwQ0u2a42e
TLSH
T15542D72EBA50693B5CDAD21AF9227B17D7F5102170D42E84E6FC8A3C29E75CD321B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d152b44c70cd8ab8f3485826c8d034a7201b39b40a6512c4951b2a33e8ad940f
MD5 94594025badfa3c55862ff7d68332158
SHA1 8bd356cdf90d94943e2cb0a52cec713e7e640024
SHA512 d426186117f6575c5581c72d5bf3ead2dc906ef08e730d0632a66f8b2380218386473c0dc885ed07b596028674eb781e1e5dcd76f91142a70f8010c4bb7fed64
TLSH
T145B012A180015556C14303F8128704D831249F12870D1301A3F06971D8271904038190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b447.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b447.TMP
Size 96B
SHA256 5ac7d17b201c097853eb5562770d3094ce3293439b017fe3a8d08c43f5059d25
MD5 c665e1231843a412f3498cd1ec20f4a1
SHA1 8fea07731aaba504c6d61d8ab5e3421f6b156cec
SHA512 bb9243483994aaf8580d50558b2c79ef18e6f91e21e898c34a8450a8134d15859653542541bb05d19baa420a2a572d494c8ff2e776f85a5c0803f3b2fbfbc111
TLSH
T1C3B00255C1026326C19203B229E599E871B0DF25CA036226D3E41A66EC696A04E67563
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 3c6a29968ccd451e16490f710cd6fa5d9fa5795165368e7d370089af00ab9ff2
MD5 6625cd05da05648fa9e66d1a8bd62ff4
SHA1 6cb42cdcbc291fca9cf3f36e4b5912920494dd73
SHA512 4b37255645d95859319cdb959e39733d0e14c125c834be1df74e181a131253609afbd18a92e72c9d54ce33bf3a3444e32172b2a0da4dabc225af93016477979d
SSDEEP 6144:H2IyIfzna+DALOQhYifjrOk0HOGm/SFyEEP:Tzna+w9KirrOjuGdF2P
TLSH
T1881412B71E1A02F7365EC69D767EBC05CD12950790ACAE8E8218935E39D90183F23F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 b5f6d7d7917e11c788fcfb1e02b52c9d5b7b95ebd9682e1c64c5e838f4f494e2
MD5 4070e4ee1fc1811a90194af9bea68f15
SHA1 61fdc8d80aa36e856fceb04ca9f7886673e99acd
SHA512 4bd42d1705c1e4b320175f6b8558f0c2f1f68ca22527e5cb9284735c2435d163b1f553ee90bf797ffb590552a1efd7c87919cba8a412d329cb5473e56bdc40b1
SSDEEP 6144:v2IyIfzna+DALOQhYifjrOk0HOGm/SFyEEP:bzna+w9KirrOjuGdF2P
TLSH
T1831412B71E1A01F7365EC69D767EBC05CD129107909CAE8E8218935E39D90183F63F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 74a50cd1c0c3dfdece9b67d52b239b80535ef434e97c0e5dd3bf8f6c11580a8f
MD5 2c52204f809bf7fc8f353552777d7417
SHA1 37edb5ec63e38c6b3c61a8e14e1f68c5272c11d8
SHA512 be4103719e7b00632c2f90aa04ec2b3e80eb3cf61293a269d98240a523916034c7e0a3293f872d3cd8dda4608d52b61c0790aa25814b3e2bc7a044b12f319f68
SSDEEP 6144:HLyIfzna+DALOQhYifjrOk0HOGm/SFyEEP:rzna+w9KirrOjuGdF2P
TLSH
T1781422B71E1A06FB335DC5AD777FAC05C913950290EDAE8A4218935D39D90083B73B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 6becb3be21f04ae3d41f93acb3723eaa08a025ada11634a242f0737ea422166b
MD5 e89e271eb6ae02c04d3542cbcce3c7be
SHA1 5345839ac79375c3a8fc3a3c2ee4c6ece67525a5
SHA512 1106fa97885fffdfd77a027bbd3fe761cbcf05955050583821399f731db0d6d19583d3e8e4a9535dee79c6bf207328c31756f79ac0c2a173517c9de814660625
SSDEEP 6144:6LyIfzna+DALOQhYifjrOk0HOGm/SFyEEP:Mzna+w9KirrOjuGdF2P
TLSH
T1881423B71E1A06FB335DC5AD777FAC05C913960290EDAE8A4218935D39D90083B73B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 b67bebf6f314b025c188ec5ce144ea312f51eb3f62eeacaa396f47533e3e899a
MD5 94760e8fd7b10c0a9f6670a880011851
SHA1 a182a4f9dcf923907a1a725ab153aae5886386e7
SHA512 f648b6931d3a901da707e43f4bc862f0c58e9858de50f77f3424e04ba8155899301ac4e66781dcd4ed833a21eea04d0522f341ec70a79a15a14925761c327e5c
SSDEEP 1536:s3j2rhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:Ssh3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1CF9312BA5E2646E7957D4AC176AE7808CE12130D70AFA9CC326C639C61D01CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4E.bat

Path C:\Users\Admin\AppData\Local\Temp\F4D.tmp\F4E.bat
Size 13KB
SHA256 73b1516cf233953836bd4c5964d8246da55fc49d1ec2706405330e9fe108581c
MD5 1932aefc82bd14764a6bcd89efd882bc
SHA1 7267331b12d1094ff2ebc53a8370ecedc8eb7b19
SHA512 75904e3de919417da2174a31ac3f1054a5b27c739f469bd16fa6d7d9bdcd318fb17c8ff06c54119ae79d1b844ace3f723799576b278d2450a80eed0135b49fd0
SSDEEP 192:BOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllzYv:BVODaDSHMql3yqlxy5L1xcjwrlzC
TLSH
T151528E3236754E13193326CB5C3AA246BCF4503F361A5E71A4138DFB50AAFD1319EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3908-182-0x0000016D4D870000-0x0000016D4D87C000-memory.dmp

Download

memory/4008-188-0x0000000002F80000-0x0000000003201000-memory.dmp

Download

memory/4008-189-0x0000000002F80000-0x0000000003201000-memory.dmp

Download

memory/4904-187-0x00000000009D0000-0x0000000000C51000-memory.dmp

Download

memory/4904-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download