36d2f7b71f0eed6459699fdd8e959746f11deb7d99b2c5291ec21619fa5b6cf0

Resubmissions

29/05/2026, 18:52

260529-xh85xae18q8

29/05/2026, 18:46

260529-xen1kacz8z5

Analysis

user interaction
yes
max time kernel
900s
max time network
440s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Belatstrap.exe
Size 30.1MB
Sample260529-xh85xae18q
SHA256 36d2f7b71f0eed6459699fdd8e959746f11deb7d99b2c5291ec21619fa5b6cf0
MD5 30545a1ec21b118cea7ebcf7115a6da4
SHA1 6ad7a56a666b45da0306cad21ef765bf2d461210
SHA512 10df5835c193024f1865e68bf4b1e893dda7633f6e566a9900e4d786d261a969ab560bb5d095c94c1bb7bdd81fde0459e76b5bbebe079280c3503b862d28bc05
SSDEEP 393216:ZvPQosMZukJKQd7fDPIPQpD89ZtgKm5XCzVGQ6oQOAd+uIwbnpMfZEW:xRRdfkDpJ4Q6fku5LYZ3
TLSH
T1646723A696EAA3D4DBC24990264D11DB32C179BF85FE95283BCB6C027430DEB054DE73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
99	5024	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	Belatstrap.exe
1032	Belatstrap.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
85	raw.githubusercontent.com
87	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3848	Belatstrap.exe
3848	Belatstrap.exe
1524	Belatstrap.exe
1524	Belatstrap.exe
1032	Belatstrap.exe
1032	Belatstrap.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245543857324100"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	Belatstrap.exe
1032	Belatstrap.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1440	5100	chrome.exe	100
PID 5100 wrote to memory of 1532	5100	chrome.exe	101
PID 5100 wrote to memory of 1532	5100	chrome.exe	101
PID 5100 wrote to memory of 5024	5100	chrome.exe	102
PID 5100 wrote to memory of 4776	5100	chrome.exe	103
PID 5100 wrote to memory of 4776	5100	chrome.exe	103
PID 5100 wrote to memory of 2348	5100	chrome.exe	105
PID 5100 wrote to memory of 2348	5100	chrome.exe	105
PID 5100 wrote to memory of 4600	5100	chrome.exe	106
PID 5100 wrote to memory of 4600	5100	chrome.exe	106
PID 5100 wrote to memory of 2968	5100	chrome.exe	107
PID 5100 wrote to memory of 2968	5100	chrome.exe	107
PID 5100 wrote to memory of 3224	5100	chrome.exe	108
PID 5100 wrote to memory of 3224	5100	chrome.exe	108
PID 5100 wrote to memory of 1664	5100	chrome.exe	111
PID 5100 wrote to memory of 4308	5100	chrome.exe	116
PID 5100 wrote to memory of 4308	5100	chrome.exe	116
PID 5100 wrote to memory of 1224	5100	chrome.exe	117
PID 5100 wrote to memory of 1224	5100	chrome.exe	117
PID 5100 wrote to memory of 1156	5100	chrome.exe	118
PID 5100 wrote to memory of 1156	5100	chrome.exe	118
PID 5100 wrote to memory of 2348	5100	chrome.exe	121
PID 5100 wrote to memory of 2348	5100	chrome.exe	121
PID 5100 wrote to memory of 3808	5100	chrome.exe	123
PID 5100 wrote to memory of 3252	5100	chrome.exe	124
PID 5100 wrote to memory of 4100	5100	chrome.exe	125
PID 5100 wrote to memory of 3904	5100	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\Belatstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Belatstrap.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb88d2c728,0x7ffb88d2c734,0x7ffb88d2c740
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17446858864516368608,11598582787105090498,262144 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,10528170392937934351,13879324286842355325,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,3856198763350127014,6909301082600814900,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,363612922155856890,10256281797043770459,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,14451722537264636582,3973449806516400837,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,1431001102738442621,389217560605302418,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,2861003660262997199,3739011159084120413,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,1218921443290976251,493594363016212769,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,15323104886571865616,6672203294008735693,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4848,i,16057088883324900702,11427407684411566215,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5952,i,10431933438182681293,8174534697382828244,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3300,i,9990237651421351539,16744747225207405853,2097152 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,8481365791626032476,13917054792512134470,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,8342711501454148590,13585186201036207963,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,14395170438479403825,8601213468672041760,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,12139480605960866118,8190209129553314117,524288 --field-trial-handle=1952,i,9683630187311344030,10950226840692625879,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3348

C:\Users\Admin\Downloads\Belatstrap.exe
"C:\Users\Admin\Downloads\Belatstrap.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Users\Admin\Downloads\Belatstrap.exe
"C:\Users\Admin\Downloads\Belatstrap.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dd6a1074209dcb8978f9cf27b7150ce38d45bc957271c63aa3962dc6452f8451
MD5 4df9cb4ce40a4a84df338642634c39fe
SHA1 aa81f22d0610aee7553d586168a2f75597b98001
SHA512 7ffb436c89427da1c8e1745ce33722b4df92e9fd4a3b873786451e261c46fb5e6099a0677d4979005eff06a0a37e2e80a650041e2cb74c18ea6b1f5869c21daf
TLSH
T18AF0F9B6CC21EC3718FC4B2920A40B4AFB5013672750845F3B3C920C8FB167B458581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 34673aaad246ee9d4bf48d93aee4839f48cf8c457e34fe6bfb1a3b975ab229e7
MD5 630ee6b32ae68aa619f4deb3f85d8bdb
SHA1 1150f142e60e9753212f02194baa9040774afbca
SHA512 72e1e78ecb35fa72b90d47f1c3d99c19a14559e5048e23477eaed1515cb6432ed5fd95b86f3eddbe50d74b50e4ed479ae90b6da01c779f7986a5bcc1ef0de58d
TLSH
T1FBB012A100C38182DF404B77323518C16E40181C00654373478000C85913BE2D4C60F3
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 0967858968013d4042e1a269c6eea0e7e0379406cd174d8dc3c3ba607313aa39
MD5 5d8fb4e968531f146fe8bb119157be1d
SHA1 2c291b00a22e45b82d9766c7179dd43f15350dd7
SHA512 565d3e0f8f563eac33d4011d45452f5e76f89589b6c0eb97aa3671a5049d1733bfc9a77873445335eb581ee2c32d9f3d0661cd061e42a030abe208b60ef7b4ea
SSDEEP 3:MsEllllkEthXllkl2zEkl4Sl/:/M/xT02zn4Sl
TLSH
T1BE4404047FC0040FC5101030C053D35003FCD410171557C3355144135DC75401C40140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 76c1fe4bb37738eef74aaac81fc0a8b79b1d2f5b12fa1869e37c23f6edff2e36
MD5 d05c8ae0511b37b8cd2075c2a2164cef
SHA1 55d1a38edcc341f1b57b0792c4d8d24a1797e374
SHA512 e9344da4b29cc3c8dbe619faf7d655acc799eea5d7dd23ec7b1d7da0a53d1627aba04bf6b3dd79a1c8f69982d57269e79ae581b6e9adcb4c2c3468892cbb3a77
SSDEEP 48:YALlq4Iq4Pq1hSoCYsPWRsUWXLsHWfoKsv4segmzsFfsUosnKsoDgTHzsEKsdjJY:DVIVP8JfIvoei9X2UT5TjVtvmtEK
TLSH
T13CA19EF787E4956DC91156F1AA146E1BCD2D0964432C3D6AC8E4AE0B93E38B2E22074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 113f2001981ba87519f6a72ced51e13f2c0e856be2fa62665cdeb51e36609e01
MD5 9d89465451686583ac91b86e175d366d
SHA1 ffea99c82451a10fccb9b3529dc1781d426084e6
SHA512 d6bcb1d19a5298b8ab3fbff3e23412f290e70afd085489974def437bb471acac9203cf8a7d2e821c8edd791b187fd7cb09d268c7411eb423f2e04d2b78db8e8e
TLSH
T106315DDBC1BE705B91A948FB0E047C09597EA8350282B8F5CE97813CE0955F30F22476
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4c47dc02475ec02042e1e0c824681a3b26f9525c69a5437e33415195a188bfb
MD5 7587eecc5cc084b69bfebceffad83469
SHA1 5aded914ce120d597cb1e26232d513aa4b994818
SHA512 c34acd10d2659bc938d0b8ce9246b71af0ac32130074c7fbf3caa95ee4bf99800dc24eff6e2a288a6f7edb9f91a5939a6fdb22414388681b3a7d475daa8c73d4
SSDEEP 192:SRrziZCTAl8Eutv7AhAPRp2/d9qHsb+WNn+slRf2TX2ye0FbVyIsnAUgraJ:SRrzi0TDNk8Xqkw9H2j2Kde
TLSH
T1BD42A62EED10693B9CDBD219FA657B67E7F5203561802E80EAFC8B1C25EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b49a06f3e13078c06f3de899c0354bc9b33d76c59bf76dbd2162985c6129ba71
MD5 761fae12fd263f93dd461f4a9e3a36e1
SHA1 8f845284166b4d1fe0a728d59f47ac271cfcbdee
SHA512 7215913236314c8ff01a6ada61e74542ab1ee7c62343eab947c1b6c3e2168258fffa5f77211f70bcfea52c01d36da67fe7b84012e9f3e0f61bd50ef1c1d6768f
SSDEEP 192:SRrzaZCTAl8EPtv7AhAPRp2l9qHsb+WNn+s06X2ye0FeVyIsnAUgtaJ:SRrza0TcNk8Xmkw90w2KW8
TLSH
T1DD42962EEE10693B9CDBC229FA657767D7F5203561842E80EAFC8B2C15DB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd4efdc0f564bdb4ac5515f4b88b3d663892a67af4c9a3af98d512741b0115c8
MD5 d1df8de496eb69f0985a348892e9e654
SHA1 1ae3779debcf22208aae05cc99e4ec0d0799db44
SHA512 357f19645012ac9852efc7e40b10c8f87fcbb8733cc0fda51c7d011c5b3607c9f906aae22296f1a1ef3b4374037b72c937ef9d695290e6c797b5b95840bc0368
SSDEEP 192:SRrzaZCTAl8Eutv7AhAPRp2/d9qHsb+WNn+slRf2PX2ye0FeVyIsnAUgtaJ:SRrza0TDNk8Xqkw9H2v2KW8
TLSH
T17142962EEE20693B9CDBC219FA657767D7F5203561842E80EAFC8B1C25DB5CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e85b81145d87f95551d3cfc85d2d9ec765c0d2bf2cff4da890e2011a62c68409
MD5 ccd0984d2fda7d9aea37ac017b0ddba6
SHA1 dc837200d70fd7cf00b253e6ce2cec0bb962f956
SHA512 683c1d137e2c4c9005f3cea3155956dd775ba43d18fbfd81073b784fbfde8e5dbe5f61e25e55d660f5b99e83deeb05e915dc5f597b287c01d33ee7619f71862f
TLSH
T127B0125184019502C44217BC1142248873149F149A4B270743E46D62CD2A561811D051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589ac4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589ac4.TMP
Size 96B
SHA256 fe63910f6dce6c48a734ad3d198bfdfa499371aa7e99fe61a00af2c08d487d1a
MD5 e547a0ca7f39d41126ccc8865e96a46b
SHA1 635ae53771210c75a0ab30e49a7b0b66d97f4917
SHA512 5a65eb1d395652ce492d74a5b623938d90bca7795cc9bd37ecd85f801813fedbfc3a3e567006e7006f890fad232f5914b2e2af5400f63d4d23dc6c4f85c436d0
TLSH
T191B02200C0032A02C00303B03880ABC83230EF20CB03020283F00EE3EC28AF20020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a174ca90fa3e683b2ee34c97c3d4af0b55d2ac3d17358068a960b3277988c2d1
MD5 6528b86d572fa500986adad526a4d3ec
SHA1 caa9bb4177cdd90acb612534ee6812edc7e65b2e
SHA512 b1b3aff94cd3102895b812416cf7f1f1cf1616cdbd10958b8af36b0f5b0981ab8cd9f9dd1933642572609899f344ab1e79f92710087f4bcf24f10cc6646fd51b
SSDEEP 6144:ciqa6/MINtn7FQg2m7Rkm1tYpBeh2BAoa:1qatIl1B9oBGcAoa
TLSH
T1CF34126A5DE2E97E0DF5E316E80E1F1F2FF0C6729A19E991C8C42B0472CD389098D975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4e9aee533d120235fcc2e8d428be045230ea36b0a9d3594199ed67b3a4cda7bd
MD5 8ded6aeeab175cdda6cf57f805549cde
SHA1 7e8db939aa5a066b78659768ad13677d2c0a92f0
SHA512 6494a977093131f4467a753aacb3cf860786c6f45f2841d7e6addcd4d682c4397c962f750211f798a899cc0cf5ba5957b838286d76a012a82790ccb9df6baf81
SSDEEP 3072:AfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Rm7Rkm1tYpBeh2BAog
TLSH
T166C3022B5D75E83B5CB5A74EB08E0B1E2EF249A6C920DE9288D85B0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f4d16aed0d6583422e17cb0bc5308914dc18f110e021a196b8a7162e8fbb53d2
MD5 b5d65187d948db24616bf67e1e774a48
SHA1 74047d0817faa546f49a6676baae49c1886f7b6c
SHA512 c86f446e8f440d06e88f79ee7f0fd8989a6afc50f58eaf4d0ba9c6acb973df17cb8d7b14b83a046d16b884f56c4a939c589d4fcabd7cdd7f0dd13b547f529ae6
SSDEEP 6144:3iqa6/MINtn7FQg2m7Rkm1tYpBeh2BAoa:SqatIl1B9oBGcAoa
TLSH
T1E534126A5DE2E97E0DF5E316E80E1F1F2FF0C6729919E991C8C42B0472CD389098D975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 3d5a7df823e38518ee6f0e4b30d58043116bde31f54b4f1631c3c01aab761c69
MD5 f4e49bcaeaab84ed19d32e65b31ace86
SHA1 de5489b31f349bfdf2734c241d09c00f1ce3dbf3
SHA512 07b7154ca06e8cbe8d350620f03af5827213eb8733da48b62064a613f44c41258349ebca6b8c0e123aa96b9d96c4c44424b5775f1dc1f9987d6de6c549780dd3
SSDEEP 6144:2iqa6/MINtn7FQg2m7Rkm1tYpBeh2BAoa:3qatIl1B9oBGcAoa
TLSH
T1BA34126A5DE2E97E0DF5E316E80E1F1F2FF0C6729A19E991C8C42B0472CD389098D975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Belatstrap.exe

Path C:\Users\Admin\Downloads\Belatstrap.exe
Size 30.1MB
SHA256 36d2f7b71f0eed6459699fdd8e959746f11deb7d99b2c5291ec21619fa5b6cf0
MD5 30545a1ec21b118cea7ebcf7115a6da4
SHA1 6ad7a56a666b45da0306cad21ef765bf2d461210
SHA512 10df5835c193024f1865e68bf4b1e893dda7633f6e566a9900e4d786d261a969ab560bb5d095c94c1bb7bdd81fde0459e76b5bbebe079280c3503b862d28bc05
SSDEEP 393216:ZvPQosMZukJKQd7fDPIPQpD89ZtgKm5XCzVGQ6oQOAd+uIwbnpMfZEW:xRRdfkDpJ4Q6fku5LYZ3
TLSH
T1646723A696EAA3D4DBC24990264D11DB32C179BF85FE95283BCB6C027430DEB054DE73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-0-0x00007FF6103B9000-0x00007FF611707000-memory.dmp

Download