a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a

Resubmissions

22/05/2026, 18:01

260522-wl91yact4m7

22/05/2026, 17:29

260522-v2zdpsdz3w3

22/05/2026, 15:49

260522-s9rygsay3s7

22/05/2026, 15:13

260522-sls6mshw3y7

Analysis

user interaction
yes
max time kernel
59s
max time network
62s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Forza Horizon 6 Luna Version 1.3.3.exe
Size 686KB
Sample260522-wl91yact4m
SHA256 a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a
MD5 6a8d11ad62dbf20e3b11eea0347334a7
SHA1 3851c460bf1f11fbcf4c8012872e1d6550120b17
SHA512 7a2db203f56c5730360cc151d140270cd44ef31d2d19064713e1283f045e62cdb5dc24fdce459fac6807e1de03fec7595d44cd1b9e743ff54b182ff5e70f44f7
SSDEEP 12288:GP7SU826CTqJAp413Fl11nmwzKA1TpE6uMOYxfZhn6WmSYE+lasv5:6w2WJ313Fl11me29MHfZhiE+lZ5
TLSH
T118E4595533F84A15F2BFBBB4AEB0A5254B36BC66AA3AC78D095110DE0E71B40CD61733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	Forza Horizon 6 Luna Version 1.3.3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4904	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239465367137767"	chrome.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000ad5c1db112004170704461746100400009000400efbead5c1db1b65c42902e000000fd0501000000020000000000000000000000000000002b506b004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000ad5c5ab310004c6f63616c003c0009000400efbead5c1db1b65c42902e0000001006010000000200000000000000000000000000000011c01c004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e00310000000000b65c4290100054656d7000003a0009000400efbead5c1db1b65c42902e00000011060100000002000000000000000000000000000000d7bd2201540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ad5c1db11100557365727300640009000400efbe874f7748b65c42902e000000fd0100000000010000000000000000003a0000000000bb9d790055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ad5cd0bb100041646d696e003c0009000400efbead5c1db1b65c42902e000000f20501000000020000000000000000000000000000004a176100410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4660	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	Forza Horizon 6 Luna Version 1.3.3.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4660	explorer.exe
4660	explorer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4600	2852	Forza Horizon 6 Luna Version 1.3.3.exe	84
PID 3184 wrote to memory of 1300	3184	chrome.exe	90
PID 3184 wrote to memory of 4904	3184	chrome.exe	91
PID 3184 wrote to memory of 740	3184	chrome.exe	92
PID 3184 wrote to memory of 740	3184	chrome.exe	92
PID 3184 wrote to memory of 3476	3184	chrome.exe	93
PID 3184 wrote to memory of 3476	3184	chrome.exe	93
PID 3184 wrote to memory of 2656	3184	chrome.exe	94
PID 3184 wrote to memory of 2656	3184	chrome.exe	94
PID 3184 wrote to memory of 4488	3184	chrome.exe	95
PID 3184 wrote to memory of 4488	3184	chrome.exe	95
PID 3184 wrote to memory of 1108	3184	chrome.exe	96
PID 3184 wrote to memory of 1108	3184	chrome.exe	96
PID 3184 wrote to memory of 904	3184	chrome.exe	98
PID 3184 wrote to memory of 904	3184	chrome.exe	98
PID 3184 wrote to memory of 1244	3184	chrome.exe	99
PID 3184 wrote to memory of 928	3184	chrome.exe	109
PID 3184 wrote to memory of 2696	3184	chrome.exe	110
PID 3184 wrote to memory of 2156	3184	chrome.exe	111

C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe
"C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:4600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffa6809c728,0x7ffa6809c734,0x7ffa6809c740
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,5947030392416001436,12830317046129119907,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,8366760388518102864,16223052376189527241,262144 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,16040023777953684121,15324256068894782072,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,3312218446177028916,1596320456559665834,2097152 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,16977350029618294173,7404993996309588115,2097152 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,1217735471245345184,7280871436145506478,2097152 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,2340102949369529488,15804249824891443372,2097152 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,11788578076213768874,17791101265198614323,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,14609721884895816981,6067613370501008080,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,5970474370593332920,17694758703929259104,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,51479046987022174,7302072448459595531,524288 --field-trial-handle=2112,i,6860470584812082482,10961542942214419116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ca495ef5448a61e22129bd66bff6abd90b824446680a8ce74d647e20f55631d0
MD5 6a54aa33ba3869a80aacb3d953079e76
SHA1 b40f2b667bd547b1af148f52d091e37a7b3d00c3
SHA512 7ab432e00972524379f1639c33f170be848053dc8f77c22a11310cf0fe03d9cd6124b820dec0f2a9d27e01a3abe886abe5db271997979e9dcfbfdd51f7b9d64c
TLSH
T1A3F028B6C831EC3B18FC0B2960585B47E751132B2780994B7E3C930C8FB573B455A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cff0c37a54f656413ccd09a9f0eb88c63dc465b316ec009e0c41138ebb9ac712
MD5 ed359376dc6d753bd48e7a2ca555d2c9
SHA1 3eae66bbcb7d62035b9daa42c615500cb0260c8b
SHA512 8fd7ae404bf7bf4e0f66f9b43777abbe6784d0afa2cb8c786e61242b97db7c4f92f2b7507a441d2cede99019d15cf9377341f133af657bbb772eced285dc17f6
SSDEEP 192:pRK0x6zHvgK7X0rv7PpAPRp2r9YHsb+WNnpIOd5me+2qCVyIsnAUgtaJ:pRK0IoKoTjUXIWwp5d02/8
TLSH
T1F542B72EA919653B5CCBD25AFA627757D7F5103222942D80E6FC8B2C14EF6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ec56e3ef16ea7e62c307ae2116ed8a934694e8b49806fc483ac6b0fa2b418754
MD5 64f7d237fec543172eb7f7769c49b2c5
SHA1 17d714fdf9c59fa5f67d27800574c498af8547d5
SHA512 50dfc79a63daff34a5d67fc84bb81e213f29455d7a6aaa224f3a6befe4992c4413a34fb73a151dd6e5889aff13763d462ef62d02f68e7ba1ed50e52d0a7969aa
SSDEEP 192:pRK0x6zHvgK7X0e2v7PpAPRp2r9YHsb+WNnpIOd5me+2qIVyIsnAUgraJ:pRK0IoKoeCjUXIWwp5d02Je
TLSH
T1EF42C72EA919653B5CCBD25AFA227757D7F5103222942E80E6FC8F2C15EF6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a053e3305799e3247048c2c9aa43529f88553acdcd5fc48b3a6db9bbad1ec8bd
MD5 7f6070d7374b876eb2e45f55730bba5d
SHA1 d37c188e64865ed024b89c2c0481d34c4d9d8eae
SHA512 1dffc29db1801b963167afa01ee49b0a758a0452ed5677485fe9fdbbe05736170e67bf70e12cc1796a1a9719edf2659f19941939fcb6183e89969f2014a70c2c
TLSH
T1A6B0123084016501C04602F011432898B2186F11DA0A1721C3E06926DC355698424260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a795.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a795.TMP
Size 96B
SHA256 43a1952e180d1361816634e51b1b2acfc69feba9cc4b0e87b41b7590e7c13be6
MD5 279acca72f9ad04d6ec4775a7e8cb2bf
SHA1 7e6df7f5505e68dbb68f3ae74f6bb64cc09766c5
SHA512 11e0768481fb132eeab966080b42538e1c18e186425e7e2098ea586f1ef612a08d749bbc3a2d6979e670d65ec9762d2ace3dcbcc5d01fc09f16b211a4ba424ca
TLSH
T132B02280F00A2223C00203F0288A80EA3220EF2BCB03020282F00BEAEC282B00828030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 921907759cb434b1ac6fa65dcb13d855cf3856d249e0f9355fb6e22fbb7c4a40
MD5 0145a10e30d1342949cdf284d708aa91
SHA1 206f2b1d6939d6aeef0039c07bee43ef258fcb6a
SHA512 a325e60aac4f989c9e4af5c0aba88988d8b2202aa102c7635c43ed900f9fbffcb378da2a35fbcca01bd1b76da21efb2fe659774f50cc3a9cbc8f88a211d978bd
SSDEEP 6144:tWdhFJe11/oaR4E9v4V8p35GnoEDQVm7Rkm1tYpBeh2BAoQ:45E11nSImpDQc9oBGcAoQ
TLSH
T11734133E2CAAAD726875EB1B50CF0B1D5EF1C633C029CA68C5E8870467F97DA1508E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 68c0854c946c749a9c194237e1ff8e7d563eea60884209cff6f0aa7625c51a61
MD5 1794ba0dd623359517e112a8e82bbb8c
SHA1 de9a3798169255d8c1662293584a925e5cfcc34b
SHA512 def09f8efa71c2b0ecdbfa52f91e5399a2d4bcc07fd8a88d434732dd6166f3082530a7d2f9219301273c7c2c21aff3c488164af3b6ed1f5825bc0bd909bbe8fe
SSDEEP 3072:2iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2Vm7Rkm1tYpBeh2BAoa
TLSH
T107C3123B5D75E8375978AB4EB08E0B1E1EF149A6D930DE92C8D85B0437EA7CC0A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 ebeba08dbf7cc7a4bf027c83ddf98b3d855c24f45b97ec80507ccd4cb1edc405
MD5 91ca0fac6c14a995d47d9bc23d642b2b
SHA1 e4997fc4c4f4871b3c74a5bbc109bbca401709da
SHA512 b4d3a219d829078d043562016a70b5721dc148ec56aaeae021b5ab07f94fd35ed13b6c8ab587e308b5d11dea498e8d923271278bbeb297da6dfb7264c21b3f87
SSDEEP 6144:eWdhFJe11/oaR4E9v4V8p35GnoEDQVm7Rkm1tYpBeh2BAoQ:j5E11nSImpDQc9oBGcAoQ
TLSH
T1B534133E2CAAAD726865EB1B50CB0B1D5EF1C633C0298A68C5E8870467F97DE1508E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-0-0x00000000008B0000-0x0000000000960000-memory.dmp

Download

memory/2852-12-0x000000001D160000-0x000000001D170000-memory.dmp

Download

memory/2852-11-0x000000001D160000-0x000000001D170000-memory.dmp

Download

memory/2852-10-0x000000001D160000-0x000000001D170000-memory.dmp

Download

memory/2852-9-0x000000001D160000-0x000000001D170000-memory.dmp

Download

memory/2852-2-0x000000001D160000-0x000000001D170000-memory.dmp

Download

memory/2852-1-0x000000001D160000-0x000000001D170000-memory.dmp

Download