hxxps://wetransfer[.]com/downloads/a02e79dbfe45e4a6791307b3148dde4720260511163308/efac45747e9fa9addc2470608c1e064b20260511163339/a10662

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/a02e79dbfe45e4a6791307b3148dde4720260511163308/efac45747e9fa9addc2470608c1e064b20260511163339/a10662
Sample260511-wknfjsbv3l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229960196687956"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
4272	chrome.exe
4272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe
Token: SeShutdownPrivilege	3768	chrome.exe
Token: SeCreatePagefilePrivilege	3768	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe
3768	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 5060	3768	chrome.exe	85
PID 3768 wrote to memory of 4560	3768	chrome.exe	86
PID 3768 wrote to memory of 4712	3768	chrome.exe	87
PID 3768 wrote to memory of 4560	3768	chrome.exe	86
PID 3768 wrote to memory of 5036	3768	chrome.exe	89
PID 3768 wrote to memory of 5036	3768	chrome.exe	89
PID 3768 wrote to memory of 4864	3768	chrome.exe	90
PID 3768 wrote to memory of 4864	3768	chrome.exe	90
PID 3768 wrote to memory of 2424	3768	chrome.exe	91
PID 3768 wrote to memory of 2424	3768	chrome.exe	91
PID 3768 wrote to memory of 4432	3768	chrome.exe	92
PID 3768 wrote to memory of 4432	3768	chrome.exe	92
PID 3768 wrote to memory of 5044	3768	chrome.exe	93
PID 3768 wrote to memory of 5044	3768	chrome.exe	93
PID 3768 wrote to memory of 1712	3768	chrome.exe	94
PID 3768 wrote to memory of 1712	3768	chrome.exe	94
PID 3768 wrote to memory of 4540	3768	chrome.exe	95
PID 3768 wrote to memory of 4540	3768	chrome.exe	95
PID 3768 wrote to memory of 4596	3768	chrome.exe	96
PID 3768 wrote to memory of 4596	3768	chrome.exe	96
PID 3768 wrote to memory of 436	3768	chrome.exe	97
PID 3768 wrote to memory of 436	3768	chrome.exe	97
PID 3768 wrote to memory of 5020	3768	chrome.exe	98
PID 3768 wrote to memory of 5020	3768	chrome.exe	98
PID 3768 wrote to memory of 204	3768	chrome.exe	99
PID 3768 wrote to memory of 204	3768	chrome.exe	99
PID 3768 wrote to memory of 4364	3768	chrome.exe	100
PID 3768 wrote to memory of 4364	3768	chrome.exe	100
PID 3768 wrote to memory of 440	3768	chrome.exe	101
PID 3768 wrote to memory of 4856	3768	chrome.exe	106
PID 3768 wrote to memory of 4056	3768	chrome.exe	107
PID 3768 wrote to memory of 1648	3768	chrome.exe	108
PID 3768 wrote to memory of 4272	3768	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/a02e79dbfe45e4a6791307b3148dde4720260511163308/efac45747e9fa9addc2470608c1e064b20260511163339/a10662
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9b8c0c728,0x7ff9b8c0c734,0x7ff9b8c0c740
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,10342075129888578617,17225211245530162249,262144 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,18233613798498285512,8888794127324176532,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,66979382954214568,3214240433166032471,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,15100898670005116740,18291219956690295640,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,7145424437783267724,12724180708247015158,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,10241150045829512794,11984666572767162156,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,15824221126180798820,3351829884935260209,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3576,i,18143643592859501345,9849545254095095684,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4908,i,15375425042746207952,4822510742556109853,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5052,i,13891155233575664046,12681067361888703357,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5268,i,9616394510995709174,3092151874853046633,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5260,i,3280839202021065643,3977027530187709027,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5540,i,997874974414797301,18058055713077410777,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5692,i,6278945636656767043,10340385887058896828,2097152 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6932,i,15110783684302940895,16358938401237652868,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,16830480912346262261,10402643416895671670,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,10529156564336427675,5805556421893579747,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,16390127614100863129,2878015736767498782,524288 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4336,i,189231780109771442,12712207459400802593,262144 --field-trial-handle=2088,i,14977773689694469208,944384813287254663,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b272c7b0d751daa579f3fa6d3d69ef9727375a995dbf38531abbe83b01c8f49
MD5 acd1076231417c663be75c0d11e8aa88
SHA1 30631a7918572b24a095d74daa736fef35e41f98
SHA512 252ab8f8ede96eb53ef88c102979e8249006ee8cc133c2bc6b90e6e847831dd018206970f31cc6aeeee720083fa4cfa8d45e96225f7e78243703ce148c47524e
TLSH
T1BCE0619BC861EC370CFD075960D45B8AE74613D72751550F3A3D820D8FB023A5196C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 8801da086f2480ccf8acd19ca8193d8ea582ee22e799a48cc6e07eed66eed890
MD5 0fc7d22ab0c42f1e513fb2cc00369c2d
SHA1 6f73edb97b825304eedd0e73d2db0786f6f2b3b7
SHA512 6a882f076f602ca189196d0c12c31f272f81e9eac29081aea2ad292a690c9d8252cbb43cac93cb06871c3669c64d79917834861856267a9c6daa8ff5a6ba09e8
TLSH
T1E8313C138CCC332ACBA911B1E7925C813830164555677BEF68CA67B8A7F3FE10E8A1D5
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 77ae1034c076723e4fbe6d6fc8bb326c64181ca6ac6ed1da497aaec610ac746a
MD5 b9ec5e1425cba2a3ee77b46b9cfeeb1a
SHA1 93c34375d4d79b934d0e3f197a7c66c22f75c703
SHA512 1f915f45982cf3b035d7b8f795bbbf47a9d1fa20c39cbb68377453560bfb9527ba1412df87864f6005f401dfd5e0f54ddbc80fada8590bd4460639575ba9f933
TLSH
T1A8E0D82D58CD855F115482E71674BF4FDEEE9908A6DDAD460F45E40070C640850AC377
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 eeaa1816adbf1d29aa657eac03ec21a2e4dae6a8df1b53c901ebb05ba3346191
MD5 fe90300cf0b523834df104ada9b21b67
SHA1 f43f18418208559d75a9f64215da637bdfc0dd92
SHA512 f47638dfabe7d81274b8a998bee283bbe549abede4abbe5fdb4f61c3efacb9093d296de6bf8b5bbe0f8bd41b575a76a9355f574a62893b6cb834048d5c4eceb7
SSDEEP 384:Du7cI5DGaBerr3RJHMJEaIaEg7FsKWWsiIbpu417Hd8crxu94FuGF9qplVOltCNy:VC+nvecwK
TLSH
T15342CFF7C3E4873DC41552F06B142E1BCD6E0428636D3C6789E9EE4AE3E64A7D28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06f4463b52094dab1cf7524a0fff4e85e23618e4a038f3c70b3fbe090ff9ae91
MD5 b557b7f07dfc70836cbc0798d32d08ff
SHA1 cfcfbfa1021f9255cfd2a03c05b51c43847f50e9
SHA512 d4f298805267a39684d34bfcbb6371d04d07ccb71bb4a2d59f385787fca6264bfb6faba45c72007b7d88176b5c8b0aa29b24317ce98c657309d09aa8de8b6a24
SSDEEP 192:WRjvh5X/Qv7rpAPRp2YC9+Hsb+WNnsGFcdh2xJkkwUaejFVyIsnAUge:WRjvrMfUXGEw5S2o0a4e
TLSH
T12742B62ABD187A3B9CDAC21FF9517763D7F5102271902E84E6F8CA2C15E75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e14cd3c743a6ca60f410aa8700368c2981c9bf90ef1d21affcbf2d350e1f75b5
MD5 b2c969ce9b9fd99e32b37afbb851f667
SHA1 a9c11dcc44c71aed49920ae8335d94e03e131f52
SHA512 1fa9ebed35d460714c6fb04e46a7a5f6a53183197607918196b5167e7b731a81e6d2f5db624d604ea9def61d3feb1f2628afdf6a5ee4dc22521003f86628d855
SSDEEP 192:WRjvh5X/iv7rpAPRp2YC9+Hsb+WNnsGFcdh2HJkkwUaejPVyIsnAUgE:WRjvrufUXGEw5S220a2E
TLSH
T1CC42B72ABD187A3BDCDAD21EF9517723D7F5102271902E84E6F8CA2C15E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 793776aaa3bb89e78b2905c82e60144d81ea05c256d12f59852afbf748017157
MD5 a953c3296e9b92ca93511059686e06ca
SHA1 fdac659f4309a47e3838dbacc23f3ccd69b18919
SHA512 a658acdcae153281587d3fc958bb281bdbec4588f0d937fcd64fd3fe612d66df3fd52910c2b334ac477a20a517f07cbf8e8218ee044f01c89e8ebf33833b03ee
SSDEEP 192:WRjvh5X/Gv7rp6PRpYYC9+Hsb+WNnsGFcdh2zJkkwUaejhVyIsnAUgE:WRjvryfGXIEw5S2a0aCE
TLSH
T1D152B72EBD187A3B9CDAC21AF9517B23D7F5202271902E44E6FCCA1C15E79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\a32660ef-8126-4bbd-b5cc-bb5cf41e2d0d\index-dir\the-real-index
Size 72B
SHA256 8b7d6d36e0afb78adc1ab0af23fd582bab295c62f8391f57e6130fe8624dde0d
MD5 e4097999ad6fe65cd4d881c3c4d76f99
SHA1 6b137d83ce873971cb38bd51273543ec0e92218b
SHA512 69a83f0ee6a74604096b605bb347a88303c24a30b9ed852b32f4c79e62baeae59f502087e94c9d3eb036840f5f8997bd39c6615bf31dbb535385367c55cb6681
TLSH
T161A002928940E342D11443F55C42C5B432A04C3132965316B1D00854985E1F45105021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589352.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\a32660ef-8126-4bbd-b5cc-bb5cf41e2d0d\index-dir\the-real-index~RFe589352.TMP
Size 48B
SHA256 fbc1e144d5c83797debc22bf0c596e54df512da3d520da00cdc8e45eefa74f8e
MD5 375e73e916bf073c6d788edb98bcb7fb
SHA1 8260b64d90fe21498125e9d5d7152e51d1810d2c
SHA512 0c2d6e568a2de5237962477a082277b8fc32635b3db9c95b78d3f02e78bdf78a8c7531b65c88307342d6dfe14db3b20d6579267873d53ab73e3d0eecdb051daf
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt
Size 216B
SHA256 ae6527918af158800e1be0e3299a419f1cdece96dde9c2d24dda811afc6f7343
MD5 a07794db40e40968c8c5cffd6360de92
SHA1 4b7aa8c6bbc17d2b4f83614c741c05e171a9543d
SHA512 d0a1b40cba42f319e1079c4895cce17290833b4a3edc063ffe11fe2c9c788538517c5ce8a7d3b905b35f63553b5bb60d606e424b38cbe21d5a431377dfde8682
TLSH
T16CD0A72B5B2431042E66618330B1A82A596FEF05D8E4CCC8495071A871B150A700276A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt
Size 210B
SHA256 e750c0f57f39b8deb9d3396f44e1018e76033d87608b08ae4fc738419b30115e
MD5 cca994037a000332a601c5cd96aa9206
SHA1 c8e90a318f92186d36c2184e91e7aa8e9f6e6049
SHA512 9cf6b6be7a3f22f8e4324149a11efa4bc28415d2dfefa0329c2cf47ac545b44952b5d52e846912c19e99005231d986ed9dbea5883a5fb4dd5b805739a26f84cd
TLSH
T153D0A72F5E6830042A65A58370F1A82A986BEB05D4E5DCC8499044A965B054E300276B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5844d4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt~RFe5844d4.TMP
Size 138B
SHA256 2a1b4f6dee1d108e6fcf355535603b5ce3fd3fde9bd4463c3a0a478e35b01548
MD5 75b3dd97e83d91570ab9251fe92288ae
SHA1 b26cbb0f544bc741e5a07af93e26e1fe83750dac
SHA512 4fe00a1927c9f581881d49cfbd0a8525612b0f2d92413ba9817d41aaef53c73eb342a792d92055c419eb9c48eeed7ba7400da543cfe73e32243d68137b635b9c
TLSH
T197C04C678A2831046A1065C134B0E82DA56FEE54DC95CC48562071A5F2B511A619676B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 216B
SHA256 10bd564442e99063e85393d37291ee8d391659cba6bf1a1082170d893a1ec66c
MD5 1b6016e17d109b8e47610c0e96b19d57
SHA1 6c9c44c4597c5e5697679050e07963aefe726767
SHA512 84f47624beab301a9e924109f7a95247f8302e23f67101c4063e80d5d7532766ea7f8fd41e56be3d24bf18b72d28a5c15d3417dfdc56037ddf3ca732fe1dc2aa
TLSH
T12DD08C1284401285C15A03B8014A48DCB230ABA5D74D030492A0B936AC7A2B2223A226
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892f4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5892f4.TMP
Size 96B
SHA256 ee997b4c0d8030c9df7ad57b6c05cfdfe08a8271c7b299e9bd86fd6efb57962f
MD5 5d57e180e10cd1e4aaeb9dfd5b279773
SHA1 b60cd8219849be1b60a9976449ae4f8fca998bdf
SHA512 c9354d02fe0bf849e3d63423af4c972d5f6edbf999008622f2ae655371cac47ca8d008eafb53b6773bab048e8fce092e12b544e338a51f4d7cb461bb406c62ac
TLSH
T15EB00297C5077A16C04603B0A595D5D8B161DF25C743235292E01AB7ED2577186653F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3f4349806ad71ba9f294cbf0909be929cfe973cb3a74d84a354dcb02158d2a7b
MD5 198c9b017d37eabb05fa5a6048c45a6a
SHA1 c4de6ff2dc8fa6849617239b3f9c34c0e956cf8d
SHA512 1a51893372b2a21e6081015b466df5ea89d75f7dcd9d9937941ea74f86308d962441f9b152435424a6525e0e775a12b0cd7a21fc29addeae6579fe8438a73ba8
TLSH
T12EA0021005E52042C94926F06AD3024933318928430A120A40D42884C85C3424605341
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ab51bd70a2bce85401924a53714abd2172bbb48062cfcba4458b8ccb783b1846
MD5 c83b3b8ec63ade59e050744e6be51814
SHA1 83718fd0f0cfb7ad950b87eaa76a8f0cd9bc41aa
SHA512 ba082d5dfb0430cc6c2b931397a9b4daeba74a6da3332e2c937bfe3613c3e3df3915ac550ef90b7ddf0d97d26462b489446214fd03bd960f3b3d4f27b2e78286
SSDEEP 1536:jVAcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xA3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T12B9302BA5E174AE7957D4A9176AA7809CE12630D70AFA8CC315CA38C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e18778aa117ef4ab838954f027e5ef0521c6cc979c36fc36d3fcf360940979e3
MD5 157b3fcb15fd22e0a123781df5542a5e
SHA1 1e01589a4656359d6666f62dec7ba39bb42b162e
SHA512 492b9ca73c6177942a090fb4cab4edc50ba7766207a48e09d4b38b654cdfc928c3915f151c2e69f22625658072580ebb718a719de88f9331b63c734fd2e6db5b
SSDEEP 1536:wV8cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:C83Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1059312BA9E1655F7997D46D2729E780ACD12134E309FA98C719C534C21D42C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 0f781a7bd6a2c40ef1aa8af72ce7c605118abae3c5ea27f0345a62538eaea21a
MD5 0e73950f86abebed01e0762ac2338eab
SHA1 895f2f88cdd3b00f2f840efcd80b9e1d34f497eb
SHA512 dc0df3ef2fe62d86ee96a9ba9583e59bae5ea4ab4fc8ef805ded4b530a1766a839684b3165dec9ae9b1106d2fe2c55f2d1b11f5431b9fe247a170ab096146323
SSDEEP 1536:7V8McYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:p8M3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1079302BA9E165AF795BD5A92729E7809CD12130E70AF688C7198934C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 16e2b796d880c6a481d3420970ee59d5a96df88efa57d4cd3fd9ac5f9df09075
MD5 fb4240dcd88fa7fd2ee970e11f5e1842
SHA1 168118acb60e33e826569f66b737f9cd376e37e8
SHA512 e2a7ed9b5b615b4eb094872fe578693e769167ef6debd6045e4da807ba10888cf3aae05b5036ce782ee2335091de1b0292ea17110298f897d0018f335e214511
SSDEEP 1536:7V8cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:p83Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1BB9312BA9E1655F7997D46D2729E780ACD12130E309F698C719C534C21D42C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download