3cd4c5c6151416adf52b3b13fc309e50bdd2c5df0d4d6654b02ecb7c8e5f8908

Resubmissions

01/06/2026, 04:31

260601-e5w5ract6s3

01/06/2026, 04:24

260601-e1kwxsct2w6

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ishartmypants.png
Size 161KB
Sample260601-e5w5ract6s
SHA256 3cd4c5c6151416adf52b3b13fc309e50bdd2c5df0d4d6654b02ecb7c8e5f8908
MD5 2fd5a85a9a4b06343cdc59c343f01ec5
SHA1 98deebcb7bede55ce37647252cae6aadf22b0cd7
SHA512 72f525bd8a5e9ec05e9e96ee51d4ceb8159381bc011ffefabc2bb35c6bec14039745663ec9416606c2e5936fab9561beb4cd836d445a1f6ca07ba5af9f27cdc3
SSDEEP 3072:uopwdKyBI7xlIoMzp96pGUkFoovx9JjkaFpyQcJdwXOA:jyrOL8UkFoq9JjxFpy5JdoOA
TLSH
T191F312BE9A463440AA427E5058158AFFFDE4360904E188A660F49C8D7F3CFF6939F65C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3968	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247619527692253"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5c00310000000000ad5cf2aa10004d4943524f537e310000440009000400efbe7d53a57cad5cf2aa2e000000e0040000000001000000000000000000000000000000c43f51004d006900630072006f0073006f0066007400000018000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 6000310000000000ad5ce1aa30004150504c49437e310000480009000400efbe055338b5ad5ce1aa2e000000e2040000000001000000000000000000000000000000e24ddc004100700070006c00690063006100740069006f006e00000018000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 4e00310000000000ad5cddaa30004564676500003a0009000400efbe055338b5ad5cddaa2e000000e10400000000010000000000000000000000000000005bba05004500640067006500000014000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000cd8e0d151ce3dc01f2e9825925e3dc01d77aa7cc7ff1dc0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 9800310000000000ad5c34ab110050524f4752417e320000800009000400efbe874fdb49ad5c34ab2e000000c304000000000100000000000000000056000000000005944400500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{04230788-2D25-4C8B-B13E-73203FEEF932}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2352	mspaint.exe
2352	mspaint.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe
Token: SeShutdownPrivilege	2916	chrome.exe
Token: SeCreatePagefilePrivilege	2916	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe
2916	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2352	mspaint.exe
2352	mspaint.exe
2352	mspaint.exe
2352	mspaint.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
3260	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4436	2916	chrome.exe	106
PID 2916 wrote to memory of 752	2916	chrome.exe	107
PID 2916 wrote to memory of 752	2916	chrome.exe	107
PID 2916 wrote to memory of 3968	2916	chrome.exe	108
PID 2916 wrote to memory of 1020	2916	chrome.exe	110
PID 2916 wrote to memory of 1020	2916	chrome.exe	110
PID 2916 wrote to memory of 2416	2916	chrome.exe	111
PID 2916 wrote to memory of 4228	2916	chrome.exe	112
PID 2916 wrote to memory of 2416	2916	chrome.exe	111
PID 2916 wrote to memory of 4228	2916	chrome.exe	112
PID 2916 wrote to memory of 1820	2916	chrome.exe	113
PID 2916 wrote to memory of 1820	2916	chrome.exe	113
PID 2916 wrote to memory of 5244	2916	chrome.exe	114
PID 2916 wrote to memory of 5244	2916	chrome.exe	114
PID 2916 wrote to memory of 5868	2916	chrome.exe	116
PID 2916 wrote to memory of 5868	2916	chrome.exe	116
PID 2916 wrote to memory of 6124	2916	chrome.exe	117
PID 2916 wrote to memory of 6124	2916	chrome.exe	117
PID 2916 wrote to memory of 5152	2916	chrome.exe	118
PID 2916 wrote to memory of 5768	2916	chrome.exe	122
PID 2916 wrote to memory of 5768	2916	chrome.exe	122
PID 2916 wrote to memory of 5988	2916	chrome.exe	123
PID 2916 wrote to memory of 5988	2916	chrome.exe	123
PID 2916 wrote to memory of 5448	2916	chrome.exe	126
PID 2916 wrote to memory of 5392	2916	chrome.exe	127
PID 2916 wrote to memory of 1532	2916	chrome.exe	128
PID 2916 wrote to memory of 5684	2916	chrome.exe	129
PID 2916 wrote to memory of 5684	2916	chrome.exe	129
PID 2916 wrote to memory of 740	2916	chrome.exe	130
PID 2916 wrote to memory of 740	2916	chrome.exe	130
PID 2916 wrote to memory of 6096	2916	chrome.exe	131
PID 2916 wrote to memory of 6096	2916	chrome.exe	131
PID 2916 wrote to memory of 3796	2916	chrome.exe	132
PID 2916 wrote to memory of 4640	2916	chrome.exe	133
PID 2916 wrote to memory of 4640	2916	chrome.exe	133
PID 2916 wrote to memory of 4552	2916	chrome.exe	138
PID 2916 wrote to memory of 4552	2916	chrome.exe	138
PID 2916 wrote to memory of 2996	2916	chrome.exe	139
PID 2916 wrote to memory of 2996	2916	chrome.exe	139
PID 2916 wrote to memory of 1956	2916	chrome.exe	140
PID 2916 wrote to memory of 3260	2916	chrome.exe	143
PID 2916 wrote to memory of 5708	2916	chrome.exe	144

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ishartmypants.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcfeefc728,0x7ffcfeefc734,0x7ffcfeefc740
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,3187346145389921695,9832150997174112088,262144 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1965783519102690552,18123203004391382319,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,7212282540951083358,16888022573823849265,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,4651878307368913221,6947384940693944156,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,11859100500589047820,18120593291933929617,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,10633266730488476522,4835582854361873404,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,7488664067854070441,17582976372005477862,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,2495934001577675867,13738757724840078911,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,4743722818621191635,13609808649324736033,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,5000775809717468153,1195964126894335412,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,3384782018342788660,1804880666270827507,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4856,i,13826749162647765610,6805552166702572122,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,9478020514126959600,10439466519156899138,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,8411126706526027975,1967349108469082215,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,9312203127408683749,558099863779230226,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3484,i,5276050980670298186,15692945850288261460,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4716,i,13286840553729890286,3918440766281185150,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6020,i,14822664282977890548,7307512067020440569,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,13061086541590438247,2219592244242675711,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,14440106772126716056,17019818212930739026,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6340,i,9322610500881891322,16502536910946840593,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4820,i,8993654956272081888,368429475062084963,2097152 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,6374648074636238944,4735044025405217757,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,12952788225334300543,16521798602270706712,524288 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5976,i,13480647939132645919,13297233949556097564,262144 --field-trial-handle=1960,i,11885002490838741700,15023654482708119445,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 32f2720238ca3f60df57f65ecec5467bb5610060422436d93029894683b74d33
MD5 e5a304dede1be43dc0650d2ab83924a2
SHA1 4e377ba4f25d853ebedb708c9447d7c246f19d99
SHA512 34766e383fcc0ddc27aacc252a66f5ea1ee2e3ed14dfa7020acc7a0a928868d7a7b5eff76854ef7dff39bd9e26b360088715f7bf82bec91e4937c165dcd22386
TLSH
T184F0F4AACD22EC3718FD1B2D60645B4AE754135B3B80848F3B3D9A0D4FB563B465685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 25KB
SHA256 7cde7247de28123bf27a71926d921a33082de6b0ae04303656ca3b4df4397dd3
MD5 9c52f6cfe20ef284aeed4922b4d44daf
SHA1 54a3f7df5adba2405973e37c3fb104f9aacdaeef
SHA512 4d11306d814a9a39d5936c28c111a242537a2c2516bd4d7c740cf80e02fda0c0a539a40814568e7630fc9beaa974f66eb25b01154d43c710441acce07291ccc6
SSDEEP 384:9pSkFNVWVtdYznmMht4DTDTPi3yOiOACFHGHLCL/1TKt4M1dIJo5iNciho5ZIDn6:9pSQNwenmW4bLYyWZ1ut4SdLU2ihJI2I
TLSH
T108C2F16C2F694C356CE2917F49A63E553E5EA8867816571FA4F071E12CF0FD898C08C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 16KB
SHA256 058b7f222517d213e364316d8c73b43d8fbb6a11895427bbcd4c72079884e677
MD5 28173aca16234fe90fb08dd99c623336
SHA1 4a378dd18465c41aee31f596f6915be4bb4285f3
SHA512 783269c3bdc1a6d9eba1254b42367e98228e97ce5f4a0dddd7ea68bd85a52430f05f602ea499f3e61f2ee20822061048ca7fba4d6da52d34ecc029f4f0058f8f
SSDEEP 384:9pASMhlEM2enjdhXrZXxw8ihx1JW/jqRsSKf1YnpZDX:9pYLp2iLXZx9ihxfaVGnpZb
TLSH
T19372D08E5126526BA8C3177B70DEF7862F166F0DDCE14F936BD68402D32D6E8C568053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 8744561ebcfbe4ff67ea81c9bc20a792e1940879d65f344f057efb40e7633333
MD5 7e37cb5d20932c868cefc7c008851107
SHA1 cf9dbbc76050858fb277ec11188e5b265387216f
SHA512 a4ee4991171e618ee6a2e69985a4b61a8fe62156d061feab3132fd9eb133e04b90ec52d29dabcbbd1445312df5633b6500f45f3ea5334359981f0a24e0031eda
TLSH
T1C2D0121D15C54C91D70E027153E154413539165DD0DB4F7573ED2C796727771B142E4F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 acc36464a28e8902c2d080e81386369f954eed28621cf39f0c83c243f6f52a80
MD5 532d6e0c97b98bc0e8078d890319df8f
SHA1 760ebf93dcb9786bb54385b2f6912eb4ed6e1cb4
SHA512 0bf0993fbd35480fb91b75498625b9ca97e529d79ec390d4dab19841a53c823aca3bd134e391114ff1c63eab3f3f3656c71ad4799fc9d71d603e620cede38846
TLSH
T17EF09E0DB5504E76E7EE8F3543D2D202A277010CC3D69E16636538305A6B371E12A833
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8eadc5a51f454156185584ff51e2007b7c8b2755036835f05e3be187f23d7315
MD5 37cd73379201069107b5fb3bc5116ed4
SHA1 a4bebcdf02075b288c47db3fad4a91bfa706c779
SHA512 5d383e998855bacf4021baf3c93979ae7f19078cfc1c2229ec194962ef102b4048f74078df2afec6c30c2a9e63d1a9eacec202e56e65c201a668036a4c97c52d
SSDEEP 192:DIWIp7F3okvFBbZ73zMp7CObOSg8iGdcZ8AV2VYl34DNdpIl:DIWIp7F3okvFxJDA7dqL3KgZkGtKXpc
TLSH
T16BE18CF7C3E8866D891156F4AB257E1ECE2E1958432C3C16C8D8AF4B93E2971E21074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a04e00126080d3f3ae6e2734964c121f7f6cb7a731d68cde645b0e8ac6fadf5e
MD5 da89fcea604df067d497b4663a141d3b
SHA1 afdfd2898cadc915925530301820cf80cd12928d
SHA512 b19efc1a92ec62ee3aa93fd60921d6940b0e4935799490e2dbbe194f5cd27335c3f32204a92f8f0c598e8415f860e664043a0254d849f3271d80bf6336ac9862
SSDEEP 192:JREOpjH9cFTvtdnv7YhpAPRp28k8n92Hsb+WNsV7I/oHY0T2X8ecPN8yIsnAUgrK:JREOpb9cNvUhUXJQwroYm2Be
TLSH
T11552C66FA920A97B6DDBD61AFD257757D7F8102121E01E80EAFC8B1C14D7ACC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1e9cf4daf39e68d775fb9b8a555c2d21e6f022be56ed4bdc51c7ab74ac6811fa
MD5 0cbe5d5d0355093627fbfcacacfaacc6
SHA1 9aae55d373df4a290de9599c7f09ca2c36cd3d29
SHA512 6a845c84060b0f2c5e7915262f49edd64d03951d445be11eb5f27bf981faf6669467b6cb221926beb9cfe22bf89fdd6cbb252b2ab083ec86f7bfc38f231ce25b
SSDEEP 192:JREOpjH9cFTvtd2v7YhpAPRp28k8n92Hsb+WNsV7Ib2FxoHY6T2X8ecPN8yIsnAq:JREOpb9cNCUhUXJQwrc6YY2Be
TLSH
T1A152C66FA920A97B6DDBD62AFD257757D7F9102121D01D80EAFC8B1C14D7ACC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 c75f4bfd086869b0bdbe93334000026da2663f56354981662455f84a5f546a2e
MD5 be3ebcd38af3997132d8d3413298eba1
SHA1 415a94ec0aa10c31c10076142332c94d13643c23
SHA512 e4196ec64fbaf7bc3ce65980be4f481fe121a16b12356675bfd97b6eace63f5b50a3b62696ecae9f29076a3c1eba2f6719f3954e7efdfd9d998ce97d7b5c830e
SSDEEP 192:JREOpjH9cFTvt92v7s/hpmUPRp0vQ1oFv0mnn9o8sb+WNtkxBV7Ib2FxMyEAT2X6:JREOpb9ctCg/hLXzmrwKCcLEC2re
TLSH
T11A62C46BA82059775DDBE62AF925BB5BD3F9102562E01D84EAFCCF1C04E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7689501a2cb954767da95391db6264f645e7556e42881ac2bf1bbc8ccd6f664d
MD5 6985675e903a47b99d1a9845145331e5
SHA1 56fb6ef679f3617eed8a3fe772e61a9d06b191a3
SHA512 c73e130d95dc6f23370492fe32b52f1e3116708f73328a7da85a1acff18672f80ec59a7cbe945130f179ff6d64ae7cd48a9e6f46d04c57cd80b60df19f067b5d
SSDEEP 192:JREOpjH9cFTvtd2v7s/hpmUPRp9vQ1oFv0mnl9o8sb+WNtkxBV7Ib2FxoHYKT2Xo:JREOpb9cNCg/hLXQUrwKCc6Yo2Ve
TLSH
T13862C56BA820597B5DDBE62AF925B75BD3F9102521E05D84EBFCCB1C04E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e86aba455ea1c88603f17194ad0ba998665d3747a88efe3a5066a090902311c6
MD5 8f97193a72121e65effda6249b99f2fd
SHA1 9f67da32aaf3f00f8bc9a1cb3c03c25d2d46fe68
SHA512 dccd2d771574ac7798a1d9086d22dc99593e4684600cc5555896f3e548dba54cf9d6cc9ea1e2df42d9cf93289544d0e4c49490b40895a8945b5cad2f1eb25868
TLSH
T102B0120080019101C08E02F02283188CB2245F10DB0E170143E17B2ACC2B5618418150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909f9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5909f9.TMP
Size 96B
SHA256 1be05a7c5558c5bbc4d7d5fe75b647a5c65f18dea550100cbbe6b5efb050703e
MD5 4ab8d26c178b192ea1fd99dbf63ba852
SHA1 08a6caeb8bb3d1cd6e0f1b47689ae7aecaa1b95f
SHA512 f8517f8c7e4faf7079bef71de33416f7b17ac92316ebaf105270de650a4c20ae17b8d92b563bbb0fd8d85f3f5de2883b306f19ab983d579a5e51e5e882bf2692
TLSH
T193B0220EC8222223C00303B038C088C83030CF38C203220282E00AEAECB3A300023AB0
MD5 SHA1 SHA512 TLSH

Submit Download

e14b459a-b31f-41c1-b8a4-95f6b5985d6f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e14b459a-b31f-41c1-b8a4-95f6b5985d6f.tmp
Size 12KB
SHA256 c8c96e35ac28487937c6204dab261a6f429b038c4591a3f4bc45766ba59a1a06
MD5 05a870719fbf2be62e9e1e407319c576
SHA1 af891059cf9665bf5d2e79e1304919991424468f
SHA512 06759268df0b62584c875eb6042709f6f9a3df1ff8306c347c162e5b8b3bd8a8cddba89034256851fcd317e20d48b3ae6eceededb4738ba44efcd9f6e16e8d11
SSDEEP 192:JREOpjH9cFTvtdHv71hpAPRp2Sn92Hsb+WNn7I/Qf2+T2X8ecP/VyIsnAUgtaJ:JREOpb9cNPBhUXPQwcI2c2s8
TLSH
T17C42E72EA920A97B6DDBD21AFE657753D7F9102525E01D80EBFC8B2C14E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 bf227f92e78d617b1abb45e9654094f0f9837723d53535872d731b36f99af127
MD5 6186216148a8eeb53ab776889f451bfb
SHA1 ba9696d0ee7ff30e7a973c1c8f89868630f5094b
SHA512 841181535bac596375db1af6dabe4753abaa7f65bc9b44817a12e79ad597f806da195c6be094e96bcbc59652f3279148692410547e186d4936cbc0278d2b4b77
SSDEEP 6144:5VFm4vCuuwbzIUqSs1qKPm7Rkm1tYpBeh2BAov:52zwbzIUfI+9oBGcAov
TLSH
T12034123BEEEFADB555B82569604E054B2DE0C3938A206E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 351bf3678813b3d830dd9eac766ee19949a67d6b4a880717a0704bd49571b38a
MD5 bc73cb41eee4eeb119b0b48afb2dcf48
SHA1 cb4f7c85ebda70958e94f2c94b6df09673afdc6d
SHA512 da42c55b30a80cdb5a05eba34255da2822cdba3c69ba229cd513cfff26d6c9b79ae516a5019a07637d458de90b1ea6eac9b879545811cfea46b69552d785f2bf
SSDEEP 6144:UVFm4vCuuwbzIUqSs1qKPm7Rkm1tYpBeh2BAov:U2zwbzIUfI+9oBGcAov
TLSH
T1C734123BEEEFADB555B82569604E054B2DE0C3838A206E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 0130e153f6a0d43d2be321fdafb5c70750f55a9ef63289b0462dab5a33582976
MD5 3c0865f4d5fa23a3c8b9981ef9eb3575
SHA1 650ffbaa8672fcdad4b952b4cb43dc533f022a50
SHA512 a6ff45a2c02892779986239607c7247c1562d15f2a24c9bce8cc5789e94b5217e3367d423ec2848873b80c57f3b2f77cd684092c08b25c92ef5aa452c3e430d7
SSDEEP 6144:g/VFm4vCuuwbzIUqSs1qKPm7Rkm1tYpBeh2BAov:a2zwbzIUfI+9oBGcAov
TLSH
T18134233BED9F9DB559B42569604E150A2DE0D7938A20AD4AC8C61F057BFF2888E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f7fdb31819e538379660d91d676157d171155516ee590f1435a20a60dcea1607
MD5 b7d107a594ef39b4db0efceda85b0da3
SHA1 4fae014cc45accfc012b7be286a947aef9404ee8
SHA512 fab6923de71cfb6e0266be9ceaa352e94c1252ac4b6b2ae85324c9f6eeb8d89282ea21796c2edd935b5d9e885d4d00f6a2633f795d01fb7cce51c6f6d860f8ec
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:pm7Rkm1tYpBeh2BAo3
TLSH
T151C312275E75E9375979BB0EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 221ad53d46aad74a8a8adca1b24d1d0ed1af14d9058434bf9a25f4c31fc801a9
MD5 febd07e531051fc4647d831e16b86fa5
SHA1 8d77d2de53bccb34e9560546bca468475faa0d26
SHA512 0ff506553f3880c405cda5d52d48c6cfc3b6bb393697526be7f5b329d1fd7837a723900458a6afaffed7084e51a44d9b5d8a7ad4c0057fe716e5d98e28f5fe12
SSDEEP 96:7AR7r18b5yxcCMZyXZTF4qWG3AkUOuF2PGIX1:7AR7ri1y+NZyXEqWsAkDeIX1
TLSH
T177D2F996BD30C641D049683CAC6FDFEE6E28BDC4DD69456B37F0FB6F48B94068954208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download