4a746c0f4cfd57c2d367b2cae5df897c4e54c5a44f1d3b20d1ad42e18f1f7693

Analysis

user interaction
yes
max time kernel
116s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
balenaEtcher.exe
Size 621KB
Sample260522-rdms8afw8s
SHA256 4a746c0f4cfd57c2d367b2cae5df897c4e54c5a44f1d3b20d1ad42e18f1f7693
MD5 4d00124839068969298fd7f974455a24
SHA1 5e924ff1eaf47f3c5938c8781cd71e0f0717e0f5
SHA512 5bd8e6dc655aff89a7c048642858130a78ec7c7e88bdd3fba62f104e94750252acb1cb353defc216fad003ec27b26bb9e6fdd0a8346ef92ffecd56af711978d4
SSDEEP 12288:OJ+2Z4nShVY5iAAGRcIMoAYdTko2doLmLOaycIMiqH45MOfcDAkV6jFVDW+l0lyQ:O4nRo3UG
TLSH
T144D46B77F583A07ED0223830D9A992BCBB29FC330A4E257736893B5D0AF61B45671671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	4768	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balenaEtcher.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5740	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239323287837048"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe
Token: SeShutdownPrivilege	1132	chrome.exe
Token: SeCreatePagefilePrivilege	1132	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe
1132	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 560	1132	chrome.exe	103
PID 1132 wrote to memory of 5740	1132	chrome.exe	104
PID 1132 wrote to memory of 5324	1132	chrome.exe	105
PID 1132 wrote to memory of 5324	1132	chrome.exe	105
PID 1132 wrote to memory of 1740	1132	chrome.exe	106
PID 1132 wrote to memory of 1740	1132	chrome.exe	106
PID 1132 wrote to memory of 4564	1132	chrome.exe	107
PID 1132 wrote to memory of 4564	1132	chrome.exe	107
PID 1132 wrote to memory of 5116	1132	chrome.exe	108
PID 1132 wrote to memory of 5116	1132	chrome.exe	108
PID 1132 wrote to memory of 5808	1132	chrome.exe	109
PID 1132 wrote to memory of 5808	1132	chrome.exe	109
PID 1132 wrote to memory of 240	1132	chrome.exe	111
PID 1132 wrote to memory of 240	1132	chrome.exe	111
PID 1132 wrote to memory of 1564	1132	chrome.exe	112
PID 1132 wrote to memory of 5028	1132	chrome.exe	117
PID 1132 wrote to memory of 5028	1132	chrome.exe	117
PID 1132 wrote to memory of 2756	1132	chrome.exe	118
PID 1132 wrote to memory of 2756	1132	chrome.exe	118
PID 1132 wrote to memory of 456	1132	chrome.exe	119
PID 1132 wrote to memory of 456	1132	chrome.exe	119
PID 1132 wrote to memory of 5644	1132	chrome.exe	120
PID 1132 wrote to memory of 5644	1132	chrome.exe	120
PID 1132 wrote to memory of 2636	1132	chrome.exe	121
PID 1132 wrote to memory of 5656	1132	chrome.exe	122
PID 1132 wrote to memory of 1696	1132	chrome.exe	123
PID 1132 wrote to memory of 6020	1132	chrome.exe	128
PID 1132 wrote to memory of 6020	1132	chrome.exe	128
PID 1132 wrote to memory of 4320	1132	chrome.exe	129
PID 1132 wrote to memory of 4320	1132	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\balenaEtcher.exe
"C:\Users\Admin\AppData\Local\Temp\balenaEtcher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 244
  2⤵
  - Program crash
  PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff09f2c728,0x7fff09f2c734,0x7fff09f2c740
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,9196210147145061885,13773072183852816570,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1816,i,1384265031220787671,13251358854961184604,262144 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1656 /prefetch:2
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,12271747144499094635,7393647275796393053,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,17326241232303057214,911959741437395063,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,1764434109302773221,14021873048233429879,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,11453652264922074830,443982296439619614,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,1085298960011217379,8606156966878290396,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,152707610499239761,16859900545151931822,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5868,i,2620622904247613264,7137261219786104809,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4908,i,7838521164702833134,14151228313149018065,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3356,i,15316847930374803490,3310347674118266471,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6028,i,17006528138504586007,1022675543017411019,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,18408512784541108330,14161497394474927605,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,91668794209752657,11299113834911771283,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,3714044199774881838,3779255818228906237,524288 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5944,i,13077230919039946012,6228392657865722036,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5772,i,14861699344319693954,11553619256703099237,2097152 --field-trial-handle=2116,i,15517775201088566092,16872836333175942192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d148bb363d04d5994fd311414c5d6521d23428f5699d4fa8ad3b343648942ccd
MD5 b8db513b4819096bbfa9f33dfb04010d
SHA1 90a57c99b38cf8d21cba0fe48b2ec85ff84a4752
SHA512 7bc57da7b7b1cdaad88c3883c409e50795964b2a37572e446b34794b8c58107e65d17fe41e901b7712d26afcbaa0b16700789dce8cad5fb1a698bee8d2734585
TLSH
T166F0F4AAC922DC3719FC0B2970640B4AEB54131B3B80898B3E3C8A0D4FB563B469681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 9e974b15b255188d8a14013870b6948fd1e2b2b960c39bfb43d99f8bdd90b86d
MD5 9bec1f8f3069532241f754db5add439b
SHA1 33795c3e7de928ddc755fee0bc2ee91bfd5ae8b9
SHA512 eb5a05812ec2aa51ce87d345db3891ff84f7dce556dcebca49524d6f47449bf51a83f11abf6bdf1fa4d2a66618e30f77e9ac27567c13dcd956a17093fe4a03cb
TLSH
T135E017B10BD825FEEF04037804C2AD4727E88E9680C6332B88943698A132EF5C01575A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2e9e4f3e6a1c6474d830648caf6f8e6526b5eaa6b0ed86dae320664c26d10655
MD5 4a8cb5b98a237d2b96379a3e018bd51c
SHA1 17a272bf966df4292c584e2e2c205e37b4441ee5
SHA512 9ec42105095d9a102561ba6c2a705a598e56b6dcfc18ee8bbefb776d1afba654cd106928af17c5394ff32d5cfe03cbb87795889af70b9289359df47a03d878ba
TLSH
T1DB719EF7C3E8C67E891156F4BB152E2BCD2D0A24536C3C5AC8D4AF4B57E2972D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e73b03395a72de853b9f9f918eb1cfb62371e5f091bb65d57c7f4613fdceefd0
MD5 95b430d83a441cd86bca650274146b74
SHA1 f92af57e76b310adbbb878e711ac44ec154b3591
SHA512 aa7e5bf3501be7495e69e3dbd911798dcdf3015089ccee5b74ca48e4635f1cb47094fd4d326cf3738442880b3f083f6d5d171cbf75f4b9b8dde2db9e12bca962
SSDEEP 192:AR43xzLSPwxShcmv71hpAPRp2y192H5Tb+WNnhadtVe09VyIsnAUgtaJ:AR43RLSPwscSBhUXlQvwdr8
TLSH
T16142D76FAA10A5BB6DD7D21AFE617747D7F0103561E01E80EAFC8A1C14D76CC222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 abe3ddf8338d031e70cd1ee076acd58639dc3a282b75cba0bfe8a5f8277ed335
MD5 b1ba52478a8ab0123684ce3e769a0b4d
SHA1 698c8172c9f0c1d140aa0ee47bc60b3267e5d6c4
SHA512 4e6beb99bc40836eee76b3982b46343a648c578a0d5a13f06fd5d1a0ab64279fcc7f009b93597b069c5074946d969b37c0b0e40e84f2736d976347488bbc4403
SSDEEP 192:AR43xzLSPwxSh5mv71hpAPRp2g92Hsb+WNnhadtVe09VyIsnAUgtaJ:AR43RLSPws5SBhUXDQwwdr8
TLSH
T1C042D76FAE11A57B6DD7D21AFE613B47D7F1102521E42E80EAFC8A1C14D76CC222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c44aff4c4c1dcf958987311f4abd3fd31041166175cad197d3a87ec761f6f812
MD5 fe86e51bca566a346718e5574bd29611
SHA1 5449ddbca450602f3b43f2968583992afbff2cb3
SHA512 a5c3ca6c7e8b361413b56c6330a77e38d9725b878cb5401e666f866c423c12aa712f678833a19d2406e55a3385660c1fbaa97a9a37add81981d50e227c1331a9
SSDEEP 192:AR43xzLSPwxShtmv71hpAPRp2yvU92H5Tb+WNnhatSv2mVe0rVyIsnAUgraJ:AR43RLSPwstSBhUXMQvwW2Oe
TLSH
T13D52D76FA910A9BB6DD7D216FE617B57D7F0102561E02E80EBFC8A1C14D76CC222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3fd8cdfb49391269c9ec90e43c888a5bda9a78180396853e16d7dbd44c75a535
MD5 8ce0340de5ae673a1937dc94a81194a8
SHA1 33a22e276bda6f9d968bc3028568beb4a0d654f5
SHA512 c05fb39174947fe333e3361c8fb024c5e8301be83187aff18f66789bb5a30f2e6c68ee7bbdda4c75b9a91e7bc2273e5cb89a858760bc782ef15de612dcfbd451
TLSH
T147B012118001A147C04202B01283548871545F14960B270543E169B2D82F5B1C129050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5896cc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5896cc.TMP
Size 96B
SHA256 4abb5e3ac74c8e3b36b4751e56873a0d4b306d147a2214edf4dcaa1023f4ae2e
MD5 6c5f4bf6d7f73157b15503c6380e3a77
SHA1 ae4c4ce69509ca6a16925691e5a28c0ef1d382fa
SHA512 e55215529905f1e5e78a7c1ec7ec5d764932c69bbbe995b1c7670e113694f62399540b026d78fb9bf1ecea8bc013941bf3208464d2b58d85de5479770f5a0ae0
TLSH
T17CB02288C002A232C08203F0B28082C830A0EF22CB03030AA2E00B22CC2323080302A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e6277cfd72f4fe08ec655bf3dc655581678365cf0903864ebc300b90615de54b
MD5 8f6b4635d245bf8d05aab755f653232b
SHA1 1f8f6238daadb1a6a0f79b50df090c1f9c761552
SHA512 7ae0199321ca00b5dbf004ad7b6836c46dbf4570d1ced77a23a7cbad786b6c9c7fdc02c1577c50bb14316ca4cce555beae844a556a9b8c2ad1dfee5bb43c1caa
SSDEEP 6144:5bG6/vkx6N4WXiyF0iWx8lm7Rkm1tYpBeh2BAol:bkxsre8M9oBGcAol
TLSH
T14734123B4D57B4FB35A6A72E618F1E0A2EB15B23C944CD42C1D49E046BDE5C86A09E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 51c8b10a392dfde1d5230ff9b9e37b5e4129d365db5661345dc45deddeba6963
MD5 d27be4ca5647b5ebcadc3cae53e83014
SHA1 7b83ff72fe1356127d6b0cab4981483a038e18b7
SHA512 1a1e007b8a5be6a26fa9e716c1b6239646ea610e54400a2a105d8885aab9c5787b71b38348a52726895c93ca48f31b22f3770346be1af7a8ac914e54ab792df4
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:3m7Rkm1tYpBeh2BAo3
TLSH
T1CEC312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437EA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 2073e25594301f3ec9a224b6185d4fac780342dde0233250917291a8f723f8ac
MD5 256f049aeefff3b51bf4d39d5c8f6090
SHA1 496ecebace9c16c54ce2f1e8fa7729f0621ccfdb
SHA512 325dae26e8cf0bb707bb1a85350d5e2755fc4f0354ab54dac21c5f006279e02646e741efb12353eb65143ab95cdabf898b3a81826458674a3e1bcafa64c4597c
SSDEEP 6144:hbG6/vkx6N4WXiyF0iWx8lm7Rkm1tYpBeh2BAol:jkxsre8M9oBGcAol
TLSH
T1C234233B4D9774FB3995B76E618F1E1A2FB15E22C984C982C0D09F443BDE5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 baede8db430d00a37b15f7d62b750aafad9c245eebb9f52ecdf6d05c68e4ebf3
MD5 cccebc40aead27442e2d5d865d8269b1
SHA1 008ba0be3d9ed8cd0d124e559453a46208543e25
SHA512 fc67cdb36e57a80ce99ef459e22bf85368aa5f17ff3d3f613edf72901e5feb0735891ef7a005cf89bb1a7f3a0961f7d5ce4a1750494ba26c86457b55a87d2b84
SSDEEP 6144:obG6/vkx6N4WXiyF0iWx8lm7Rkm1tYpBeh2BAol:wkxsre8M9oBGcAol
TLSH
T17334233B4D9774FB3995B76E618F1E1A2FB15E22C984C982C0D09F443BDE5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download