a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a

Resubmissions

22/05/2026, 18:01

260522-wl91yact4m7

22/05/2026, 17:29

260522-v2zdpsdz3w3

22/05/2026, 15:49

260522-s9rygsay3s7

22/05/2026, 15:13

260522-sls6mshw3y7

Analysis

user interaction
yes
max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Forza Horizon 6 Luna Version 1.3.3.exe
Size 686KB
Sample260522-wl91yact4m
SHA256 a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a
MD5 6a8d11ad62dbf20e3b11eea0347334a7
SHA1 3851c460bf1f11fbcf4c8012872e1d6550120b17
SHA512 7a2db203f56c5730360cc151d140270cd44ef31d2d19064713e1283f045e62cdb5dc24fdce459fac6807e1de03fec7595d44cd1b9e743ff54b182ff5e70f44f7
SSDEEP 12288:GP7SU826CTqJAp413Fl11nmwzKA1TpE6uMOYxfZhn6WmSYE+lasv5:6w2WJ313Fl11me29MHfZhiE+lZ5
TLSH
T118E4595533F84A15F2BFBBB4AEB0A5254B36BC66AA3AC78D095110DE0E71B40CD61733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239465488732302"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F1B9B77C-23EC-4B72-947B-B736657D54CF}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	Forza Horizon 6 Luna Version 1.3.3.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 5064	1540	chrome.exe	98
PID 1540 wrote to memory of 4080	1540	chrome.exe	99
PID 1540 wrote to memory of 4080	1540	chrome.exe	99
PID 1540 wrote to memory of 4212	1540	chrome.exe	100
PID 1540 wrote to memory of 4836	1540	chrome.exe	101
PID 1540 wrote to memory of 4836	1540	chrome.exe	101
PID 1540 wrote to memory of 912	1540	chrome.exe	103
PID 1540 wrote to memory of 912	1540	chrome.exe	103
PID 1540 wrote to memory of 3004	1540	chrome.exe	104
PID 1540 wrote to memory of 3004	1540	chrome.exe	104
PID 1540 wrote to memory of 3848	1540	chrome.exe	105
PID 1540 wrote to memory of 3848	1540	chrome.exe	105
PID 1540 wrote to memory of 4472	1540	chrome.exe	106
PID 1540 wrote to memory of 4472	1540	chrome.exe	106
PID 1540 wrote to memory of 3756	1540	chrome.exe	107
PID 1540 wrote to memory of 4328	1540	chrome.exe	110
PID 1540 wrote to memory of 4328	1540	chrome.exe	110
PID 1540 wrote to memory of 4916	1540	chrome.exe	114
PID 1540 wrote to memory of 4916	1540	chrome.exe	114
PID 1540 wrote to memory of 4436	1540	chrome.exe	115
PID 1540 wrote to memory of 4436	1540	chrome.exe	115
PID 1540 wrote to memory of 3808	1540	chrome.exe	116
PID 1540 wrote to memory of 4756	1540	chrome.exe	117
PID 1540 wrote to memory of 3808	1540	chrome.exe	116
PID 1540 wrote to memory of 4260	1540	chrome.exe	119
PID 1540 wrote to memory of 4392	1540	chrome.exe	120
PID 1540 wrote to memory of 3684	1540	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe
"C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbedaec728,0x7ffbedaec734,0x7ffbedaec740
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,12067249542726417224,5282387579545911008,262144 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,8758258290440953117,5151953093622843202,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3492965870486042771,5251470137786376001,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2854560334067027305,4078983109796590641,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,3611263155727062566,1216417418798580809,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,14241320195901197498,6929422769370738525,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,17732451602046055482,7441837609997580407,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3849358447090694152,10565729116433157784,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,6948468528055883486,17413593274489966896,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3688,i,1846212923916380572,944622518389989026,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6104,i,1700384653463630565,1810095674964931822,2097152 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1712,i,15266229053369260969,2494023320372660639,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,13297857455789790567,7951125708789160593,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,199557316897314193,2542897115301263919,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,8634492258444064357,14242774289872099286,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,16996084259251762606,15298865545079083520,524288 --field-trial-handle=1904,i,18381879874079002601,9451186746145705072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:3684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a41c23fdb094b4e68b32df858b8b4483ee66c3a745bbbbad6d9f35843a0182a1
MD5 82f5f5133136fda13aae4e4a924a039e
SHA1 6a53d3ed395f5d0b8811f3351b2fd7a7cb42eb5e
SHA512 60102e5a57b4bdee172dced1889c420a367b310082eefebb2fd0629068f839a490cb511b3a633f6a144b8780af584dd99142cecf128e0189d5e74ee752810a00
TLSH
T131F078A6C821AC7B28FD0B2960A50B06FB51136B2B80881F3A3C830C4FB063B8586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c9b02c5712cb16a687829a83d06c6f3d4e2a49efb7787f8dcdcd663b120ddad
MD5 9536776a695d267365a3b1e4a854bc28
SHA1 a064ddb98a32835ec181517d611c61d42561df4e
SHA512 c9dc96bff669ab8324091e41111346ce5c6a758a0b167e37365ff2a0d8e74bd839301a3f2cd928302eb3a33efa537cf9dd73591c888a36382ce80e09665881b3
SSDEEP 384:WNR8mKmzDmhaurcjMc79UX9rw8TcM2fz25o38:WEmKmzDmhaurcjMcxKrw8TGfz25oM
TLSH
T1CB42D72FB920653B5CDBC21AF9253B17D7F6147125942E84EBFC8A5C04EB5CC221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0868387834a5223a45eed84ac01b28a4f107c9d6e598ff9921cb4daac7e90779
MD5 5d0ddea5e2422fe9fba186b3675ad3d2
SHA1 66f6b07405eed10f26727e088a61e4d7048b2f4c
SHA512 f26adab510de4215617a1f156089dd6aa7dc03193f10624dace01074a81340e5013f61e44d294e79c0576bc96c92086d63f922d0e79dc99f8d24a58ae31cea7f
SSDEEP 384:WNR8mKmzD2zhaurcjMc79UX9rw8Tcseqz25o38:WEmKmzD2zhaurcjMcxKrw8Tuqz25oM
TLSH
T12E52D52EB924A53B9CD6C22AFA657F23D7F7147226942D44EAFC851C04EB9CC3217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fc712ab3235bc5f23cae680d7458ad2c5887928ce777e4dbdebb1203914461c2
MD5 18270ce933571c40ce30efd54cd299e6
SHA1 ee1bc81c87304f770ca5487ecb1d051c4bfd0c22
SHA512 352983ae0f67a22a3b7ce9382fb5c79212ba9d17d7d06ddd6c9eadc8cddbac71fcc2188e029d6fe8f211a2f66d89cfb29d8584f862259eca776d3433d1c83085
TLSH
T118B01200C0019102C4420BB012C224CCF1185F15DB0E170653E47963CC25262C515091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc54.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cc54.TMP
Size 96B
SHA256 f459a19fe109a233ec6a7e520c3ff3ba6475139ded7911eb1ced5f009a9274f2
MD5 fd38da5d8fdedd87933f0a52c77146f3
SHA1 7729ac34dc89b9ff44bd2cb3e440ca42727748c0
SHA512 49abcdf73e5ca2f059892ffacfeef91f535fece6db03f0e356c09b0bc19b775b36ed25a696b70745190c6eac4dfc6abde9cb1a323035577321db85998bb202fb
TLSH
T10CB004D5D1075715C14343F0355555DD7150DF15C543531151F45555DC155714535154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6d6af6d5f8eb1c10b6516142fbe7fd929804d394ddffc2d35002da704448971b
MD5 1c68aaba053edbe1b22a49e26226aa9b
SHA1 1cb31c3a76bcb269f20b3dd3e8d5826d8ec11e05
SHA512 0baebdf8fbaaabd209d42516c6a657de1ffe975c231e96bf12ced989aa7c42c653f2f8590804a2b2bf90d6cd4bb3936d510ba40750b9717a641dcae148362a33
TLSH
T18EA0025005D04C09CB10DB71628651EC23558E24438283274191005499621435509244
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 e61cd7cc544dd4b7988afa446ce5fdbcf1a8699fd7a085569d957bba31a6c8c9
MD5 9d3424fa4c8814ac23c6056c286f84f1
SHA1 45f9d9aef3b672f9cfb7c62c0aa7ba9fbdf2966e
SHA512 a08b8819922dcd915f4606a57ac00186f2b04dcec414b1966b0f678eff902d7e7a1b89b96f9cb1d45d8cac64884c6d94c9d5f63fcb5138c799491318c5df561f
SSDEEP 6144:phFJe11/oaR4E9v4V8p35GnoEDQ1qZ/ZLW3Exu:lE11nSImpDQ1qZ/piQu
TLSH
T16A34227E7ECB1E33AD92CF3565A30F49A3F9C16680788308977D577B68935A270408AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 74a6026dd7ff5d1770cb94ec48c009d8c90f44489fceaa646bc51ff8d673affb
MD5 4319f82e0d52b5170e62c69d1ae9f714
SHA1 a9820eb927133d533cc982ac252072adc8c57414
SHA512 6cc6a83576db54ef27b0974ff2e82ed994dbeac09114b79ccf8819dd2f257505ecd84285937121b1b70b36d6779b8c711540060913ead70f49e3e513f3c43a30
SSDEEP 1536:6PSdnyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICS:1qfd7NtZL8cHQRZEQ6Sps9
TLSH
T108C30237EBC25F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 1cf11026f13fdd0c702c0a15feccd34adcc49f74ba1ec5006045c2383a4e65c1
MD5 190b41f78b1398d2323343bc763c395e
SHA1 ccc196c5084a0c3530bf791f1642994617d1ff25
SHA512 df2e34dad591154b5c978abeca10a820df0c290e657833fe04e861c33f71c6b1252ec8d3794a28ec3508ea87a02f71e8e7a7b3ad2884109d93d6a6cf1cf20967
SSDEEP 6144:ShFJe11/oaR4E9v4V8p35GnoEDQ1qZ/ZLW3Exu:WE11nSImpDQ1qZ/piQu
TLSH
T15034227E7ECB5E33AD92CF3165A30F49A3F9C1668078C308977D577B68925A270408AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-11-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3264-0-0x0000000000DB0000-0x0000000000E60000-memory.dmp

Download

memory/3264-7-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3264-9-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3264-10-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3264-12-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3264-1-0x0000000001840000-0x0000000001850000-memory.dmp

Download