86982ce9e08c3f85d0bed70670c2df8b7edc5c7e8eaa8b2bf49c0925e6116f51

Resubmissions

01/06/2026, 17:40

260601-v9bydaby7v1

01/06/2026, 17:37

260601-v7ftjsdt4p4

Analysis

user interaction
yes
max time kernel
88s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.bat
Size 335B
Sample260601-v7ftjsdt4p
SHA256 86982ce9e08c3f85d0bed70670c2df8b7edc5c7e8eaa8b2bf49c0925e6116f51
MD5 42be5623d716725fdd0abdadc02e199e
SHA1 7f0513b1c81bb106d1f335eca42686b92596a722
SHA512 edb010942c3ae47479e44557a50d86ec1a409054723efa4fa8b4da877c55c53d19032e29d56ba2f072dc0c46b2f1b83e0992918ace3526c0a91199315999c226
TLSH
T17AE0C01174CA263643BC89C084152192DF5C22DFB46509F23364D0541F4196493B80C5
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248091180350572"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1396	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 756	2580	cmd.exe	82
PID 756 wrote to memory of 4892	756	net.exe	83
PID 2580 wrote to memory of 2136	2580	cmd.exe	84
PID 2484 wrote to memory of 3144	2484	chrome.exe	87
PID 1676 wrote to memory of 1848	1676	chrome.exe	89
PID 2484 wrote to memory of 4480	2484	chrome.exe	90
PID 2484 wrote to memory of 4480	2484	chrome.exe	90
PID 2484 wrote to memory of 4908	2484	chrome.exe	91
PID 2484 wrote to memory of 2032	2484	chrome.exe	92
PID 2484 wrote to memory of 2032	2484	chrome.exe	92
PID 2484 wrote to memory of 4916	2484	chrome.exe	93
PID 2484 wrote to memory of 2436	2484	chrome.exe	94
PID 2484 wrote to memory of 4916	2484	chrome.exe	93
PID 2484 wrote to memory of 2436	2484	chrome.exe	94
PID 2484 wrote to memory of 3464	2484	chrome.exe	97
PID 2484 wrote to memory of 3464	2484	chrome.exe	97
PID 2484 wrote to memory of 1060	2484	chrome.exe	98
PID 2484 wrote to memory of 1060	2484	chrome.exe	98
PID 2484 wrote to memory of 4736	2484	chrome.exe	99
PID 2484 wrote to memory of 1812	2484	chrome.exe	101
PID 2484 wrote to memory of 1812	2484	chrome.exe	101
PID 2484 wrote to memory of 3716	2484	chrome.exe	102
PID 2484 wrote to memory of 3716	2484	chrome.exe	102
PID 2484 wrote to memory of 1116	2484	chrome.exe	103
PID 2484 wrote to memory of 1116	2484	chrome.exe	103
PID 2484 wrote to memory of 2984	2484	chrome.exe	104
PID 2484 wrote to memory of 2984	2484	chrome.exe	104
PID 2484 wrote to memory of 4400	2484	chrome.exe	105
PID 2484 wrote to memory of 4400	2484	chrome.exe	105
PID 2484 wrote to memory of 2568	2484	chrome.exe	106
PID 2484 wrote to memory of 4828	2484	chrome.exe	107
PID 2484 wrote to memory of 4952	2484	chrome.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4892
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:2136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff53cec728,0x7fff53cec734,0x7fff53cec740
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,5358698645472635640,1102087953406543587,262144 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,12498299037206255772,13248938899438215372,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,9957911811655047194,171499506930116941,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,8193012364019074858,16695986041766239106,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,8242123791950962783,12458042357821507842,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,10572666618198487107,8562172278203433854,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,14844126240481479841,7719330804840380142,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,4192026943001436255,7415582364561454005,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5604,i,4535903463768792268,10376453684742097395,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,15284149433855766900,4826265613729134068,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:12
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5728,i,6651034208872122379,13376199356854480370,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5932,i,8596044563326858619,1877121356827846240,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,10180202508762969647,196020141826996226,2097152 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=228,i,7769694990487629906,12653640499207030166,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,14364029210734663195,8939240772056539901,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,6664679066674854645,3212678460488608492,524288 --field-trial-handle=1936,i,5097110029259954433,6258170030617164746,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff53cec728,0x7fff53cec734,0x7fff53cec740
  2⤵
  PID:1848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a4ea8b8be1451fe88f812f0e136bf56744968adc22ba72ce7006f3e1e1037807
MD5 ba45f966ea54de57f69c358e0073dc0c
SHA1 667cba6254daad80766aff4069ea5b0a6b4f92be
SHA512 22c53a7139bda25ee80ce9f8c58aac52a8308f7366ea43f91344610f8b8b4acd1cb444d7ee6e647fa4cc932a876a7047c80822fec841ae05822048be846cc281
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7e3265f75649f9b18179974cbfcd9bb2f0b0c0e461693f98071dc5286f442211
MD5 b6ead03a851f58bc8264ada7bbe44ce1
SHA1 53c9d86029d9615e9a43c446167448e1c92495e7
SHA512 a41dd3e63a286378b15ed83f4883f4ee45b2727278a81d79570fbc5068b0115299d8108c9a0dea50217ff1952c6e07b980b88f81656600351e2e29782c45f961
TLSH
T1C4F0F9B6DA21EC3B1CFC172960944B4BEB5413672750495F3A3D520D8FB167B858581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 eea964dbb623cda43b928fc54178c7112651f9efc037a706ac4f652045e9a65a
MD5 462b9a2dfd0178df02aa8b251585e52a
SHA1 cdf4ae9ac817afe939fda984e486c6f367be92bd
SHA512 c219a291abb813519af7ec2a836c9e7e1abca1d48d39037579b4046e34c2981b5fd6dc02d8af304546f96e70112e83d1d56d8a11796864e0eafdb53ba238d861
TLSH
T1371197B7E1AEC9D4DBDC55FFD0B508848B220B04418B864EC7C060AB661FF3A72C4960
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1be9ac8becb6867b6704adc0dccac70694ccf84886b079c20775df65573ecbc4
MD5 ec17ae634b5969167a489b1c211fb4d8
SHA1 53ae18c7546bd95978a15e62e910c577d2c01353
SHA512 11cbc9c220e7c263b35c9ae85ca23705615a84f45b4f8230a0c850a5e502ba85057a5abc032dc7c42f63837f96bbf7ec9322a22b2fec3738b3fcb06908133e46
SSDEEP 192:1R6cBzL1yH4F5kcXfv7sBpAPRp2acM9NHsb+WNniLBQB2cQNe6vcUVVyIsnAUgtK:1R6mzJdX8UX1rw4u2cUkC8
TLSH
T16A42D92FBA10657B5DDBC22AF921B757E3F5102532D41E84EAFC8A1C15E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f311364437c43687c237278349bdb8914f2e23b7c5d8ef28017745d6b4505f0e
MD5 03ebcd6db740e9718be696b76918d65e
SHA1 15212db2ce25946016341bee2975493a7b327bce
SHA512 c4909faae68a0b55597fc76660337e9b4d0ee2eb34687b60c9c1a19629664f1921bfcc2ba292d4a645885a780813cc90174a3a7ae6c308565660de5b6e0973da
TLSH
T17FB0123180019103C08606B015465CD871386F21A70E1705D3E06932D8265A18814170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593f9f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593f9f.TMP
Size 96B
SHA256 db835498e17d94d6633af1462efa8f80c3a0ba5a0810c5aac8ac3aec2b0d3672
MD5 de8e1ad4dd269dbd368da9ebbe7979e6
SHA1 7684b71f8de942f70a09beb57174430aa0fc6f4b
SHA512 8a1f3c317825e6753feaa35f8f22f0a44806ed5b7713195810467f181b686b615350238208f9dbc0708e2dae44dd55eee87d36e2baaa167da084beae73b369c2
TLSH
T124B002A9D103621AC1C203B029E6E5D87271DF25CA43B21796E01BA6DC75A7655251E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6bd1ebced64f3e69541238d324742caac52f991f8a2d1adde3029f34b1431102
MD5 fdb41fd5099868e7ffe66daf6b9c51db
SHA1 303a574849d3382351e9d3df9c7a5a7edbc4cf7c
SHA512 acc299d088047e28b6dd44864b51f6b12dae8070806c3e1d40c8f9c6a55837666297e36d21360e4512a51ba396674f4d16479379159e1046c3c60b4054feb105
TLSH
T1A9A0022185408849C054177010C35950A39C89500955060160D0218DECF11E0910214C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ff5ae1e1761581aaf1424d0677333c4e27b5393deeea490cfb81bb05fb18b806
MD5 a30f4a3e51ab77df91eb7c919d431fd9
SHA1 bbf97fe364ea782fea202e4b46441a0a9ec00a60
SHA512 1129eadc7fbe3ba514c69f49d5f5d0d47a6ca64f99376a1cad4bea78a654321e3cf76eb6302c149fc700b266aa19c39bda3deb1fbe1d88b9056e92116354615a
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Jm7Rkm1tYpBeh2BAoe
TLSH
T11DC3122B5E75A97759B5B70EB08E0B1F1EF14EA7C920DE82C8D85B0437E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 acd7c7106ac898b7db349d78924f6944918c3c5825dc5d2ffb5877a0f984819c
MD5 59c3f0396106809980f0940b6c639126
SHA1 6552548f73b9de1c9d4420a2a894625c4200c1de
SHA512 61bc13d02d536d18b9a6b94679cf8bb489e28b9c34a709d0161de7602bfe7071a6b2281284a6dea6b50fba0edd176b071457156a2aaf3e6ea1c2666a6973cbba
SSDEEP 6144:ztCF97i5lPt2YJqcm7Rkm1tYpBeh2BAox:zQj7WPt2Yi9oBGcAox
TLSH
T14A3412378C74BD7765A5F329B00E2F2F0EF1D676C521E6C4C5C5FA04266AB982A89C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 55e590f7a5ff113a71c13ff3725fe31d8e2d713741f2704f35d16a7cb02b2284
MD5 75e4c1d17447e902d4dfa811cc91b296
SHA1 a4862e5327d18deb3d96de0877eb066870e4835d
SHA512 2b13be3c50991492e41391a31da354643028feb40846178008ec6be2f7bb5e15e672a7b676e7dbd01c1b575a17734e8fafb83ee5f706414511ea69799f97141e
SSDEEP 6144:AtCF97i5lPt2YJqcm7Rkm1tYpBeh2BAox:AQj7WPt2Yi9oBGcAox
TLSH
T1FC3412378C74BD7765A5F329B00E2F2F0EF1D676C521E6C4C5C5FA04266AB882A89C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download