1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9.exe
Size 764KB
Sample260522-selg8aey9m
SHA256 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9
MD5 cd59d54a7af500f96aa0347bb5daf077
SHA1 16db153aa28621c310df709d15dc408221411789
SHA512 265f7d0528f1376e708c2498f96fcd505f4f7b5334c151f5a48e28c203178e088861e0ec7dc661618c3770435a1f74c141913ffc7a6ac4cb42a265476709d7af
SSDEEP 12288:pF5u17i0GzjcqgRQHDPPjTUeD+/wli6YQioJ+CmGrkICeMV/IvByNu08YN2ghSU2:pFI17i0GzjRgRQHDPPjTUeD+/wli6YQv
TLSH
T183F4C48A1394D0D1F676327E8015ABDD7A37AFF515B0528E2F723638A93844A7C1633E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4408	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239358308726607"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EDB7BFD6-D21B-4F18-AA59-1DBE45CA8D35}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4944	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4944	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4944	vlc.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	vlc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4968	4948	chrome.exe	109
PID 4948 wrote to memory of 2368	4948	chrome.exe	110
PID 4948 wrote to memory of 4408	4948	chrome.exe	111
PID 4948 wrote to memory of 2368	4948	chrome.exe	110
PID 4948 wrote to memory of 4048	4948	chrome.exe	112
PID 4948 wrote to memory of 4048	4948	chrome.exe	112
PID 4948 wrote to memory of 624	4948	chrome.exe	114
PID 4948 wrote to memory of 624	4948	chrome.exe	114
PID 4948 wrote to memory of 3792	4948	chrome.exe	115
PID 4948 wrote to memory of 3792	4948	chrome.exe	115
PID 4948 wrote to memory of 4544	4948	chrome.exe	116
PID 4948 wrote to memory of 4544	4948	chrome.exe	116
PID 4948 wrote to memory of 2712	4948	chrome.exe	117
PID 4948 wrote to memory of 2712	4948	chrome.exe	117
PID 4948 wrote to memory of 4488	4948	chrome.exe	119
PID 4948 wrote to memory of 3700	4948	chrome.exe	126
PID 4948 wrote to memory of 3700	4948	chrome.exe	126
PID 4948 wrote to memory of 1424	4948	chrome.exe	127
PID 4948 wrote to memory of 1424	4948	chrome.exe	127
PID 4948 wrote to memory of 4592	4948	chrome.exe	128
PID 4948 wrote to memory of 4592	4948	chrome.exe	128
PID 4948 wrote to memory of 3380	4948	chrome.exe	130
PID 4948 wrote to memory of 4480	4948	chrome.exe	131
PID 4948 wrote to memory of 4480	4948	chrome.exe	131
PID 4948 wrote to memory of 784	4948	chrome.exe	134
PID 4948 wrote to memory of 696	4948	chrome.exe	135
PID 4948 wrote to memory of 2620	4948	chrome.exe	136
PID 4948 wrote to memory of 5576	4948	chrome.exe	140

C:\Users\Admin\AppData\Local\Temp\1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9.exe
"C:\Users\Admin\AppData\Local\Temp\1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9.exe"
1⤵
PID:1068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3952

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PushRead.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff6b90c728,0x7fff6b90c734,0x7fff6b90c740
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,2280221153579475758,7391441596519344581,262144 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,1619719711963612981,14588390906404723893,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,4028670309180528745,391912759334074402,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9105896403704483103,8472271850755589534,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,10131100561991328656,13314729244497899169,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,505959249921402143,8855552387648803771,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,16837781486590743558,117090677719009266,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,10142975528630080472,8353644636764731027,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,12919696988301285608,15965745642891668133,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3412,i,14156044473182768024,9679362762067185845,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4892,i,12896714756923176972,13730924695334660549,2097152 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,8384744519255743209,4841872498392718155,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,843926803791354866,7995527821853566137,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,296137018099081968,2607009854892663448,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,7834423682129558620,10710088625557070756,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,6497635496143779378,15161761895140520554,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3400,i,6325650996435840176,16981339072734781428,524288 --field-trial-handle=2016,i,13693142933928744435,10866803224551974403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:5576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 971f983afd03d324c7a4e5a1d0748f931e91e8c0f337a7213e859d48acece3d9
MD5 87e9ee34d7e37a76ba238c8111b9f462
SHA1 f1ab3b9482d2ab3e533b03e27635801a04073159
SHA512 797584eb83278f15bbd5eeb0f98ce7cd90b3025b1a0a81c1bb711235334495dcff869f9527fd86f2f287788f66e7bc2014cfeb658fdc2bd123dc083d0ed38ada
TLSH
T1DBF02DA6C821EC371CFD0B2D20A54B4AEB50136B2750845B7B3C520C8FF167B4685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 f07cb8254281cfeea586d997702448c0702223db977d7c28df363014b43dab04
MD5 90669131ac235aeb77e5fa0ccc3b1dd5
SHA1 f6d97fc85134e44647accd84411e73c5dc37302b
SHA512 1ffea8719cf61ecfec8279d808ff30470d7f90b0b76c5bcd719f36ca0956366994d550272ac6b4289441d945dfdfc65a033a16927f6920315dd43d4f47cfefbb
TLSH
T115119EF61262DDEDEFF0E63886E20A3525DC5E8A92117B5E3241D1E0B25323C2153914
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8fb1733e2252c59955eb5008264b24be1af84b400ce2bb278ba437bc6110d23f
MD5 914c8aac05fda8358c2f614e710fd95c
SHA1 b068cdff01e31d5901b593831512dea3e00c98ce
SHA512 1e9915b79d7bacc9ccd133b3340b9f479264aa2f27f1afa432b2fef01f5e2690f824af07f277b9c7648b74cb8229637784065a72fd9e2bc3f8332481f7bbbf17
SSDEEP 192:aR5gxNtk58cK3v7ApAPRp2l9qHsb+WNnnt0oqeG229VyIsnAUgtaJ:aR5gXffkUXmkwt0L2u8
TLSH
T11F42962EEE116D3B9CCAC21AFA667757D7F5203521D42DC0EAF88A1C24D75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 73e7bcac3cf63ae8d27ca3d9361481a0bd7a8400a74daef8ec8efda549b722ed
MD5 317260cbd77e4c9e25e896ea364ff1e3
SHA1 1cb01b03f143bc0c28203f0a1fc010fa5c0bc3eb
SHA512 f5a1fde4115fa0ddefbd27ecbb4187eccb4ce7378b352193d6080ad053ab0dd0ae629068331490f9c1c6ef5bc89dda6580102aea0240ca6a8b30faf2ce624f70
SSDEEP 192:aRlcBz0xNtk58cf3v74p7PRpfGZSi9qHsb+WNcLntZLxg7p2eqeG22PVyIsnAUge:aRlmz0XafslXKkw4/i2x26e
TLSH
T1AB52B66EED205D7B9CDAC21AFA56776BD7F5203522D02D84EAFC8A1C24D75CC2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e4b64734e6d72a2fdc6b858f16f32cd1712b44d0f6ac5e970e6bf188e4ae4cb1
MD5 d60d92eaca1b233acb06bcb005529de0
SHA1 47d87d6d477325720945124a69bda1e76650de36
SHA512 53219f29abdcf2bcff23845c8ab9cdc6da59790ce969fcf1d3c97fcf523098d0d6fd5965aa9eae47f615bd7550b7fe99f94be226d54b865d59e090eef22d678a
SSDEEP 192:aRlcBzgxNtk58cf3v74pAPRp2GZai9qHsb+WNcLnt47p2IqeG229VyIsnAUgtaJ:aRlmzgXafsUXnkw4a2r2u8
TLSH
T18052B56EEE206D3B9CDBC21AFA657767D7F5203521D42D80EAF88A1C24D75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 40880be6037cbf52eb82dc6e7d1c7edf4cfca4c9ad28403a6ef24debe398a0a4
MD5 7d2fa19cbe47629defb7835a9469fa37
SHA1 c8c4d00da1b6665e8b627f2ba2c7feeaa9d1eaf6
SHA512 66f4810528ac58b43ac07565433f77e3aae9cdf304df6c71fedb20251927c74541a1430514fb770e9b4ef88c56a03ee8cab5d2119d4601da92a227ebb9897197
TLSH
T1EBB0124180015A41C00202F4114294D875549F54A60B1B0253E07B279C25151C519050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f7a5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f7a5.TMP
Size 96B
SHA256 79f368b5a580241aa5ac21da05fe787bc4d0e3e1dec6ee5920df611b1ddad85f
MD5 6d59e000ce3ad099ea7e163940b4d2a9
SHA1 be4048cbde15a96595d0a654b81e6d45dda71512
SHA512 9d17bf075912736cba25a3e5e31e026eb9a07c48c4fb748326632f21495c6774fb668d5189989de58307e826fd710db34a4faffad71184b2b198bc8ca4396490
TLSH
T1A0B02220C002E302C08203B0A88280EC30A0CF22C3033202E2E02B22CC20230003A830
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 2da52836b5b2cce132da9e81186cc429f5cf2cb90701ca7e859fcf472dbcc645
MD5 3a88fa4d8ced07454be5f692e5028ae0
SHA1 2c8a10082bf0d22d8aa2151e2da648ff1ab1bf45
SHA512 005f67429094cf9ffbeb345768da4f752b5066f1b3cfd0228310a1c91644d8ac3015c795fc8974b7f16cdb760121da3d53206693d6fcecf2e38b39c8204d3776
SSDEEP 6144:CbG6/vkx6N4WXiyF0iWx8em7Rkm1tYpBeh2BAof:ykxsre859oBGcAof
TLSH
T1EF34237B8D9674FB3895B72F618F1E1A2FF15E22C544D882C0C09F443BDA5C96609E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 6f0658c4139f33fcc29d56bce1026e14cbfa178a79f793d98456e66956c489aa
MD5 3f99864705ee9ce5551c151b98a4631d
SHA1 abfc086f8da0b7eb5faf7011d73060ec3a9db2fe
SHA512 364d99203892494a9151c5be1c7c9b135703ff52eaebf3842a0d8b5b53c7f4e8bde2b4449bdbf0d78d3cc7e7ca88f8ebf2bce285c31c6e6e691c1e2170ddee82
SSDEEP 6144:/bG6/vkx6N4WXiyF0iWx8em7Rkm1tYpBeh2BAof:xkxsre859oBGcAof
TLSH
T1DE34237B8D5674FB3495B72F618F1E1A2FF15E22C544D882C0C09F443BDA5C96609E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9938ce373c0080ee7cb282e1256ca06c9fcbb25009a3d72c9f05e7f8defd68a9
MD5 5ae37261179197c7b39c11d28f746170
SHA1 d948f5af78ee8db0d1682313bb793cd792282c9e
SHA512 ae5efa6f126b8ccd52cbf4ca7b60d58bbb0d65b1b6485f075baf5311e8fb85aca8e72ef384b9271a551b4188bddf6cd658c975944f8dad0bbb074cf4d316ef45
SSDEEP 3072:A6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:mm7Rkm1tYpBeh2BAog
TLSH
T190C3023B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE9288D85A0437F97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 76B
SHA256 53f6c5b594ece6b59a355d98ca7e753ff9c0da697e704689fbf251175acc2dd9
MD5 c5340f33779aab7b42ac8fc9f8052ae2
SHA1 243b75a9a61d11a260a732a1e7952c243526ec22
SHA512 1d437d185897d2326243078855fa055579e1e5b59c6a818198e60fa0fa75208d6a9ddc7394f36a077f17cc99db4166959a68b89866bbccc5c7c64ded86d37683
TLSH
T101A024000045C517C1D000C3111C014F10F1F0005C047050DF55544CD110C7F43C0037
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-11-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/1068-84-0x0000024DC0320000-0x0000024DC0325000-memory.dmp

Download

memory/1068-19-0x0000024DC0380000-0x0000024DC03E5000-memory.dmp

Download

memory/1068-16-0x0000024DC0320000-0x0000024DC0325000-memory.dmp

Download

memory/1068-15-0x0000024DC0380000-0x0000024DC03E5000-memory.dmp

Download

memory/1068-13-0x0000024DC0320000-0x0000024DC0379000-memory.dmp

Download

memory/1068-0-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/4944-44-0x00007FFF680B0000-0x00007FFF68198000-memory.dmp

Download

memory/4944-51-0x00007FFF67EA0000-0x00007FFF67EBA000-memory.dmp

Download

memory/4944-33-0x00007FFF69390000-0x00007FFF693C4000-memory.dmp

Download

memory/4944-37-0x00007FFF68920000-0x00007FFF68942000-memory.dmp

Download

memory/4944-36-0x00007FFF68950000-0x00007FFF68969000-memory.dmp

Download

memory/4944-35-0x00007FFF77EB0000-0x00007FFF77EC1000-memory.dmp

Download

memory/4944-41-0x00007FFF68520000-0x00007FFF68531000-memory.dmp

Download

memory/4944-40-0x00007FFF68540000-0x00007FFF68554000-memory.dmp

Download

memory/4944-42-0x00007FFF68440000-0x00007FFF68512000-memory.dmp

Download

memory/4944-39-0x00007FFF68560000-0x00007FFF688F0000-memory.dmp

Download

memory/4944-38-0x00007FFF688F0000-0x00007FFF6891B000-memory.dmp

Download

memory/4944-43-0x00007FFF681A0000-0x00007FFF68436000-memory.dmp

Download

memory/4944-31-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-53-0x00007FFF67E60000-0x00007FFF67E71000-memory.dmp

Download

memory/4944-54-0x00007FFF67C50000-0x00007FFF67E5B000-memory.dmp

Download

memory/4944-60-0x00007FFF67A40000-0x00007FFF67A52000-memory.dmp

Download

memory/4944-61-0x0000020417BE0000-0x0000020417E21000-memory.dmp

Download

memory/4944-59-0x00007FFF67A60000-0x00007FFF67A7B000-memory.dmp

Download

memory/4944-58-0x00007FFF67A80000-0x00007FFF67B2B000-memory.dmp

Download

memory/4944-57-0x00007FFF67B30000-0x00007FFF67B55000-memory.dmp

Download

memory/4944-56-0x00007FFF67B60000-0x00007FFF67BAF000-memory.dmp

Download

memory/4944-55-0x00007FFF67BB0000-0x00007FFF67C48000-memory.dmp

Download

memory/4944-52-0x00007FFF67E80000-0x00007FFF67E91000-memory.dmp

Download

memory/4944-32-0x00007FF734EC0000-0x00007FF734FB8000-memory.dmp

Download

memory/4944-50-0x00007FFF67EC0000-0x00007FFF67EED000-memory.dmp

Download

memory/4944-67-0x00007FFF5D920000-0x00007FFF5DB65000-memory.dmp

Download

memory/4944-49-0x00007FFF67EF0000-0x00007FFF67F16000-memory.dmp

Download

memory/4944-48-0x00007FFF67F20000-0x00007FFF67F38000-memory.dmp

Download

memory/4944-62-0x0000020417E30000-0x000002041969F000-memory.dmp

Download

memory/4944-47-0x00007FFF67F40000-0x00007FFF67F6F000-memory.dmp

Download

memory/4944-46-0x00007FFF67F70000-0x00007FFF67FB1000-memory.dmp

Download

memory/4944-45-0x00007FFF67FC0000-0x00007FFF680A3000-memory.dmp

Download

memory/4944-72-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-30-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-29-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-28-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-27-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-26-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-24-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-25-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-23-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-22-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-21-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-20-0x00007FFF6937D000-0x00007FFF6937F000-memory.dmp

Download

memory/4944-77-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download

memory/4944-81-0x00007FFF69390000-0x00007FFF693C4000-memory.dmp

Download

memory/4944-80-0x00007FF734EC0000-0x00007FF734FB8000-memory.dmp

Download

memory/4944-83-0x00007FFF690D0000-0x00007FFF69386000-memory.dmp

Download