69ab4b78b5ef1db9d07c72e60c3f20c2093eb4376623d91cfc0b0325a94b66d8

Resubmissions

31/05/2026, 04:17

260531-ewgzgaht8v

31/05/2026, 04:11

260531-esc64sht7t3

31/05/2026, 04:08

260531-eqraysbt9l3

31/05/2026, 04:06

260531-epd91aht6w3

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
new 3.txt
Size 293B
Sample260531-eqraysbt9l
SHA256 69ab4b78b5ef1db9d07c72e60c3f20c2093eb4376623d91cfc0b0325a94b66d8
MD5 65d4691fc6b441e32b3c115cd7b677bc
SHA1 5af490520c8caff5b0fa7fff07a710f390be09c4
SHA512 adc3b757085c7878ccfaa47d7c1e82542e0e341d8c2d906834583b84816da01445a9a5c57b2bbd0797da5465393014227badba78e0ae953aebba6f1aa1708b6b
TLSH
T1F3E0EB3B1C80800C24B38C78FC689384F017CC92FCC676EC8AF207068E130BF211169A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3920	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134246741697408577"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeCreatePagefilePrivilege	2088	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1448	2088	chrome.exe	93
PID 2088 wrote to memory of 3964	2088	chrome.exe	94
PID 2088 wrote to memory of 3964	2088	chrome.exe	94
PID 2088 wrote to memory of 3920	2088	chrome.exe	95
PID 2088 wrote to memory of 2828	2088	chrome.exe	96
PID 2088 wrote to memory of 2828	2088	chrome.exe	96
PID 2088 wrote to memory of 3004	2088	chrome.exe	98
PID 2088 wrote to memory of 1832	2088	chrome.exe	99
PID 2088 wrote to memory of 3004	2088	chrome.exe	98
PID 2088 wrote to memory of 1832	2088	chrome.exe	99
PID 2088 wrote to memory of 964	2088	chrome.exe	100
PID 2088 wrote to memory of 964	2088	chrome.exe	100
PID 2088 wrote to memory of 1260	2088	chrome.exe	101
PID 2088 wrote to memory of 1260	2088	chrome.exe	101
PID 2088 wrote to memory of 3508	2088	chrome.exe	103
PID 2088 wrote to memory of 4596	2088	chrome.exe	107
PID 2088 wrote to memory of 4596	2088	chrome.exe	107
PID 2088 wrote to memory of 4872	2088	chrome.exe	108
PID 2088 wrote to memory of 4872	2088	chrome.exe	108
PID 2088 wrote to memory of 2812	2088	chrome.exe	109
PID 2088 wrote to memory of 2812	2088	chrome.exe	109
PID 2088 wrote to memory of 4740	2088	chrome.exe	110
PID 2088 wrote to memory of 4740	2088	chrome.exe	110
PID 2088 wrote to memory of 1816	2088	chrome.exe	111
PID 2088 wrote to memory of 1816	2088	chrome.exe	111
PID 2088 wrote to memory of 3324	2088	chrome.exe	120
PID 2088 wrote to memory of 1544	2088	chrome.exe	121
PID 2088 wrote to memory of 3440	2088	chrome.exe	122
PID 2088 wrote to memory of 3144	2088	chrome.exe	128
PID 2088 wrote to memory of 1192	2088	chrome.exe	129
PID 2088 wrote to memory of 1192	2088	chrome.exe	129

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\new 3.txt"
1⤵
PID:1272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb6485c728,0x7ffb6485c734,0x7ffb6485c740
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,5428935926632794359,6627960242787519047,262144 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,6146671766307825377,14187322998521257975,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,8541563164059057392,1116640641022283656,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,9370294930512486621,11723032346094600507,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3368,i,6378345790465631768,3586421360439652686,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,3503851583409607705,806450297328358832,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,10940962220990030359,15371851394427616112,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7994766905715946043,14741105271771132325,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,10450153502877108360,1136151953928469102,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3956,i,11677478954022515724,4167956870339435460,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5880,i,1932428983692979962,18443592926138420137,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3368,i,2221012408059541655,17928397747579002288,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3136,i,6908181221458329044,8756014586848798118,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,6852944198305486513,3479862582260454996,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,3251983542231998126,11543703039102312598,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,864820247612422182,1890108073018492392,524288 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4720,i,5569970757354423162,2978167844786249411,262144 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6104,i,2866998501496410686,5640150839704763851,2097152 --field-trial-handle=2060,i,2214642354633387499,5552985692202942083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5236f968e6e6f596b9b65572f86aaa9d10b250a455841d3dacd9fbb85ae3e65f
MD5 9c32093309ddbdbdc0b24888bd1b2475
SHA1 14940760560ce3862f9012ec17d46fa3384f27ad
SHA512 b3384301ffb07a4d45d6fe60308b4310d860b58109a6be5ed2352081ab677c806c637b6637bdaad06db04e4b602a9b952b0248452c9fbbe73cf0fab9f005a8d6
TLSH
T18CF049B6C921AC7728FC4B1820960B06EB55135B2B80485F3A3C930C4FB063B414681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 c8ad2da1545bdac3d24a05674fbd3decef050202a1eaf041bd2332beb8e7f732
MD5 19023646310c1d34a96ee4d7b088dbc5
SHA1 4e921e5b032417f003a9ae25348140ab3b2a4def
SHA512 b65db0b65a9faafd8eb20511b1470b16804d0f16a78499584cc6029928921429fd6c3f818b0521045691dc36d15b565d351043c051b303a6d5e677326f1d9344
TLSH
T161E095D75DE0E131EF020372F01145D0036F0AFA161E2732D7B424085C273F2B52044E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 a58bdb5d401d83bfa95f825d40610353a2e603a76a8c1275c986d0d76d556e47
MD5 fd9b0501cced82daed0982da7969be07
SHA1 2cc80c11a7cc05e25959a4c07550683cb20e2ae7
SHA512 4c02830bf24b2654f01587a490d6a9945a4ffb80bd2a36289b29dc8f24beff92456205d3c1da013c6f45d5a49df9a520a36af393170b1b47e79314e2109522a9
SSDEEP 192:DF1AbxucMiVOs6sCnbdiKztq/6EydZO7dVsJhoU+mh0zUTflXv2HUJl:DF1AbxucMkOs6sCnbdiKztqSEydZOdVU
TLSH
T1E122BBF3C6ED823DC85256F9E715BA1BCE29091403283D19CCD4AF5B53E95A2D280B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1f26a026bcc0c510b1f1a5e2dff1234a854f53d0bede74d5733a24807b56914d
MD5 0a284ad3824f04de0dad0cb4e018ecb0
SHA1 6d9d1cb562f23690d1cd62e3b39e00fe1eb4b2de
SHA512 c349a0d0e76f56fa8120137c411eb7192cc0ac511a0eaaa76ffa7c699f6b364e5fdf9fc40dc32fae4349381b8d9930126293a6163f99f24f762582794f4aabcb
SSDEEP 192:mRdyLAmBn2N1v7hpAPRp2IrA95H5Xb+WNBU5G86x2iOZecwvt5VyIsnAUgraJ:mRds7EF9UXqrjBT2Mfe
TLSH
T10452082EB910247B5CCBC229F9257B57E7FB146161E01E84EBFC8A5C15EBACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2231bba1db1aee66afc754391a09401887fb339be01bc4053f0f6d388edf12fc
MD5 26e44555c83400fb5bc75870828183db
SHA1 23bd7948952c5c231d8f7ff5fda92ad5e2e35788
SHA512 232e62af081d65817579c9d968ab466c80fd904a4951123bc8162e8b3f2cbde38a422baa9b2b82e4208d089b96790738293e8ccbcde04cff18e41dd27238c519
SSDEEP 192:mRdyLAmBn2Ngv7hpAPRp2Irt95H5Xb+WNBU5G86x2lOZecwvL5VyIsnAUgtaJ:mRds7E89UXbrjBT2Nf8
TLSH
T17352F72EB920647B5CCBC229F9257757D7FA146161E02E84EBFC8A5C14EBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 077a012a53cb42d11f6912b440cfc3e8c14904ece2302aec1f4abfed4fe77a15
MD5 7f89f3811a93c3e5bb209de2bdd853e1
SHA1 db481ff3952fb1b267a062c43a3a4fca6e1208d3
SHA512 ff1a848639bea0dac7accd49f770cde1cdc4a74c83a91131360910f9417732a8f1d0216d1b8370a021c6eb80380b73fe529fb5e7652cbd67cb0d8073fee59e6d
SSDEEP 192:mRdyLAmBn2Nvv7hpAPRp2IrA95H5Xb+WNBU5G86x2lOZecwvL5VyIsnAUgtaJ:mRds7En9UXqrjBT2Nf8
TLSH
T16952E72EB920647B5CCBC229F9257B57D7FB146161E02E84EBFC8A5C14EBACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 40db7d3196e483766ac1917c401098784b89ab0a0e472e24f9acbb4323e4ee35
MD5 936b1933f8d261d1c6f6bf3d67beb13c
SHA1 bbfd383d3bdae7a6316ddde9bb761b347508f7dd
SHA512 57b00bc7fed040d349b8a503719d789c50cfbfc4b8e7051bcb27744a850aa687c13abe9373b76f159ab5932269b169e4dff6c940516b739ca8e2af6d8bd44f5d
SSDEEP 192:mRdyLAmBn2Ndv7hpqPRp0IrA95H5Xb+WNBU5G86xDeS8bOZecwvx58yIsnAUgraJ:mRds7Ed9uXMrjBTX8t+e
TLSH
T14A52E82EB910657B9CC7C229F9257B57D3FA246161E02E84EBFC8A5C14EBACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0d8004f7a98f99bb8fce1a6a7c58bdef680bed09f436d9e1be7e64269846e67d
MD5 353060e546f2c5c65ebeb63d8074fd63
SHA1 0b73d9aa3476dc4893c825af247cec598d0c1c9d
SHA512 aa2f51a7745e17a3ba29c2c2274de57f00fd6cef6bddae04f023cbfdbf7f3236879f962fa1914ab91a883d57e52d8db81016990360278881b92e6ee4ed880d56
SSDEEP 192:mRdyLAmBn2NIv7hpqPRp0IrA95H5Xb+WNBU5G86xDow2BOZecwvx5VyIsnAUgraJ:mRds7EU9uXMrjBTD2/fe
TLSH
T12752E72EB910297B5CC7C229F9257B57D3FA146161E02E88EBFC8A5C15EBACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 85f2bfc33beec86a719fb745ab31235adfe422305e96b3b6ea4c63671d506fb5
MD5 6cd0027ee7f16ce030e10a7e00cdb055
SHA1 7fd455905e85efa37667ca91baa1e6239c7f4ac5
SHA512 513c21f0c85f194c92d7a13c855994e54fddce9cd9bd6e15f916c754369b120e0fab0ca904ade87b9bb4b8643fe93951bf3e5c07703771a77122451eaefe7d49
TLSH
T111B0129080426101C40683F8214314887118DF10AA0A170243E06E329C265608014152
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e923.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e923.TMP
Size 96B
SHA256 d81833bb074d77767e36dba5dd35a7ba278d48e119b19cc799aca2f078e17f32
MD5 072e68f1fe2d2961400547e7923f408f
SHA1 c199dbc93cb4efd44494c73a6b6dc6c75251d277
SHA512 0d6b29b94a42de62f63a7db4842181df435a7aaceae28da3506ded46a5498f617f6bd6eebf63e7fcc5be68d1308bf9c1f4f86aa97e6abb40fddae0e814c67c4a
TLSH
T170B02220C883B222C00203B03CA0C2C83020EF2CC203030F83F02A23EC302200028030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 7deac984e046314c5632e6fbb446fad814d035ab2a2e7f5a8349efeff46907b3
MD5 2f14fee6032987426a3e65633d57cee0
SHA1 a3279c09691bc95d510f05c119954e46df1509bf
SHA512 fa683a3d8ab367034550835ab79ac0e9ceaae85ca753e9ed4106a44cee8bbe706cca73ec76573583fe1b7731f9c386058aec08a733eecf89e12321f48259d747
SSDEEP 3072:b4SzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1odqfd7NtZL8cHQRZEQ6Spsi:b7VFm4vCuuwbzIUqSs1qKmqZ/ZLW3Exi
TLSH
T185342337EFCB5E725AA149B0721319C67AA0D2C746306B09CDDB2F9B7CA3590CD86C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4d55492343bdd5dec937f9483c1ea6a961f766653676be2152d3c448544db1a0
MD5 1d2948c9cfee25a42dc0d41a5a59f4f6
SHA1 f10eef1eea90baf9b428279dafd5fac828b5cfd8
SHA512 f7349609d091f53b7f8333b0f831105299362e4a3a2919d7a8cf5da0ba23a3a10d50e46f51a803648baa0688788777609af562215e9e6b777d480717df2f4137
SSDEEP 1536:6lyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Wqfd7NtZL8cHQRZEQ6Sps9
TLSH
T114C30237EBC21F335D82CB64BA534FDA57B644A99030D301AABD3BFB6C93491644249D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 42b3374774a65158ffbdb17e27169549f024985d5761b60c59d3017825a1ef39
MD5 76d2b74133e3483c1c2476d47495d525
SHA1 a90c3c7fd4db315043ad64be187aa4e0460745a3
SHA512 3cd575348d1e8f242e7247e112da9a1d842497b647b62aba245fc40d29e77c7c561d4785af5fc3e39dda08e1b1404748ea332d55f9584cb256015cb1b4dc4fb9
SSDEEP 3072:E8SzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1odqfd7NtZL8cHQRZEQ6Spsi:MVFm4vCuuwbzIUqSs1qKmqZ/ZLW3Exi
TLSH
T1AA342377EFCF5E365AA085B0721349C673A092C245706B05CADB2FAB7DA3584CD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 40bd00d5236bcff474880d411a1436104992c2d7ed0d4b8101760dc9b1367842
MD5 2828a175f8f752986aabc82d6699ef21
SHA1 17484cd10705954eae33c3967f7f62feba8289ea
SHA512 e320d293926463829855bc58749570b2c0f6ff6582c2d973f3d89a81a6039ab71a81a06da171989e484f8a0e72ef945ca76e860d993e60964d5f30db04a491f1
SSDEEP 3072:H8SzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1odqfd7NtZL8cHQRZEQ6Spsi:vVFm4vCuuwbzIUqSs1qKmqZ/ZLW3Exi
TLSH
T1F1342377EFCF5E365AA085B0721349C673A092C245706B05CADB2FAB7DA3584CD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d66419d70c2b592f904d6734f3f7c6ff5a0e4ff4dd04fe3c4199d6423c6dc704
MD5 f04987c1bc0f96367fdb439d2e4e77bd
SHA1 4daee559ade44adc9984aeccde869a605daa1d78
SHA512 f8d522a8ba1e5cd40e89b4cd1927d9d73211bb7d2990cd72e3f89cb9f8774aa269ac30292120b04b31be5225f4aeed1481aedf6118a92dafc441a916a985bf56
SSDEEP 3072:E8SzpFme/vSmkuu53ibzIUkZHR7s0QKIE0e5q9I1odqfd7NtZL8cHQRZEQ6Spsi:MVFm4vCuuwbzIUqSs1qKmqZ/ZLW3Exi
TLSH
T1B5342337EFCF5E365AA085B0721349C673A0928641706B05CADB2FAB7DA3584CD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download