fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
300s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RexVolt/Bin/Decompiler.exe
Size 9.4MB
Sample260603-ehe8qaay2j
SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
MD5 a109790efbe0542dddf63ef0415dd508
SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
TLSH
T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249327991814779"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
2712	chrome.exe
2712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3908	4236	chrome.exe	111
PID 4236 wrote to memory of 2456	4236	chrome.exe	112
PID 4236 wrote to memory of 2456	4236	chrome.exe	112
PID 4236 wrote to memory of 4340	4236	chrome.exe	113
PID 4236 wrote to memory of 3744	4236	chrome.exe	114
PID 4236 wrote to memory of 3744	4236	chrome.exe	114
PID 4236 wrote to memory of 4752	4236	chrome.exe	117
PID 4236 wrote to memory of 4752	4236	chrome.exe	117
PID 4236 wrote to memory of 2188	4236	chrome.exe	116
PID 4236 wrote to memory of 2188	4236	chrome.exe	116
PID 4236 wrote to memory of 4256	4236	chrome.exe	118
PID 4236 wrote to memory of 4256	4236	chrome.exe	118
PID 4236 wrote to memory of 2256	4236	chrome.exe	119
PID 4236 wrote to memory of 2256	4236	chrome.exe	119
PID 4236 wrote to memory of 440	4236	chrome.exe	120
PID 4236 wrote to memory of 5040	4236	chrome.exe	124
PID 4236 wrote to memory of 5040	4236	chrome.exe	124
PID 4236 wrote to memory of 2008	4236	chrome.exe	125
PID 4236 wrote to memory of 2008	4236	chrome.exe	125
PID 4236 wrote to memory of 3412	4236	chrome.exe	126
PID 4236 wrote to memory of 3412	4236	chrome.exe	126
PID 4236 wrote to memory of 2996	4236	chrome.exe	127
PID 4236 wrote to memory of 2996	4236	chrome.exe	127
PID 4236 wrote to memory of 1640	4236	chrome.exe	128
PID 4236 wrote to memory of 1640	4236	chrome.exe	128
PID 4236 wrote to memory of 3324	4236	chrome.exe	129
PID 4236 wrote to memory of 3324	4236	chrome.exe	129
PID 4236 wrote to memory of 4004	4236	chrome.exe	130
PID 4236 wrote to memory of 4004	4236	chrome.exe	130
PID 4236 wrote to memory of 3164	4236	chrome.exe	131
PID 4236 wrote to memory of 3164	4236	chrome.exe	131
PID 4236 wrote to memory of 2552	4236	chrome.exe	132
PID 4236 wrote to memory of 2552	4236	chrome.exe	132
PID 4236 wrote to memory of 3524	4236	chrome.exe	133
PID 4236 wrote to memory of 4996	4236	chrome.exe	134
PID 4236 wrote to memory of 3560	4236	chrome.exe	135
PID 4236 wrote to memory of 2712	4236	chrome.exe	136

C:\Users\Admin\AppData\Local\Temp\RexVolt\Bin\Decompiler.exe
"C:\Users\Admin\AppData\Local\Temp\RexVolt\Bin\Decompiler.exe"
1⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe6e7dc728,0x7ffe6e7dc734,0x7ffe6e7dc740
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,17309357786561980477,14587211823433577517,262144 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4768195439565139048,4890589270907539641,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,7876040937765214546,3736258934695562116,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,14140850514818816261,10368171825925807831,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,12967355619963565017,12981512866553275615,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,11911944718540209132,8941953111378970346,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,6519659011490339375,10907098830624373318,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,7175410782976975910,9990832114176267694,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,16438335998254898643,9229195585486056698,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4748,i,15824048526766154785,10146553230001823566,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3264,i,14082382127255106221,1412161262465289182,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5996,i,289731888866307127,10000978669721174222,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3296,i,16901938862748961365,7079591894511231994,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,8379801969006156003,14055549131505319463,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3384,i,5016341404372531598,16799618876076295615,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3688,i,10948866972788153701,17175705829621449319,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6032,i,3615710624384251502,16365164966717358050,2097152 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,14589874368978805242,3172609653614058800,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,2789800999873168630,5182512042914833161,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,16802538283424798526,6662159466425183916,524288 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5636,i,3613715520698946455,2457883296699457266,262144 --field-trial-handle=1832,i,17364768712334833543,14044604324172402505,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 be14d3b0a929a9d75513bf36415921dadde1264580a6d6e2ff91570c019feb73
MD5 1d2ea2e227d2f5dd67b7da9c2e5479b4
SHA1 cb65d99f65716b2d46db875a49c9b3a07abf56f6
SHA512 1efd8de8c86662145f7c8e75d9b51a87f7f85dd26ae35563d908c87634a1f822c36bb2a5bb895c4eed43e8d2bb733b3be9421bcaa6d9128b0e99ac7b7546ed6c
TLSH
T1DDF0F9A6CC22AC3718FD4B1960550B8AE751136F2B81995F3A3DA20C8FB163B4586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e17aa2adf9341584b0709ccb467d3f2461f84f5502b3b9e92215dc496146e96f
MD5 4c729a979b380ae2dba6ffe1d2c37a2a
SHA1 399d9a9fa0596bdba86e50cb2cd919c2dbf38f58
SHA512 df11860787236249863f482e77137ca3e7ca14a5a5b5147f3c1e4e65945f7b287b0bd08e1ef3e5e4f424580137bbf32a0ea1bbaffdac2b29b07761405a1858c8
TLSH
T1B5619BB7C7D88A7D851156E4AB21AE1FDD2D0A24032C3C56C8E8AF4F53E6872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c908f90ca3c3d971698dc77e4db631b0f68ea218f345ef7b60dcd386b22362c4
MD5 0f30350bff2df8dddcdca7aeed63d1c6
SHA1 6ad0d4c42d0ab4cf2932a08b0b2f90ff60b47cb1
SHA512 705da2f16f2823e5f326dfbf9dfc5ba1085c1b1e0fb148113f238051757ce630df2aafa79756b0dc86938627150f90dd5ce8686106ddf462139b3b0d14148b47
SSDEEP 48:YALlh0q8hSuq8qisARsafoKsDXLsAgmzsU4s5fsnos3KsEjhhnONzsijs4ms1+sU:DORv37BEVb5SnWjhMxDef
TLSH
T163917CB7C7D88A7DC51196F4AB216E1EDD2D0A24132C3C56C8D8AF4F53F68B2D61068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a7cbc4b25fcfb9665f616e35923f95a864e53b7f04e9fc9299dad49a773ed7d2
MD5 fd23f92bed4bd30c4139c88fc347b111
SHA1 5e1e61af67b64da7529bfa1f70a286dbbfefec9a
SHA512 62128301cb9429e933fdaeec3c33c3732e2e99a33a427a3a3eace4eb5b22fe2a5775c8dfc2bb539543bd347523d865d56ed3bb8a96957773fe766805c2ff6446
SSDEEP 192:wRk9tKt15/Rv7shAPRp22pG9wHsb+WNnIGnsK8kwEn+VyIsnAUgtaJ:wRk9EtTBY8X/AKwhn+k28
TLSH
T13442B52EBD55693B5CCAC22AFA227B57D7F5103122842E54EAFCCE5C14E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 33c6c0bbd844ce47f22e55572fca5471ccc5b2a599f86826e3dc552c5dfafa2a
MD5 b0c1bfdf1ff492dba55bd261ea33b8da
SHA1 964b82e57b91e51670915260033a97706b67897b
SHA512 a7b0cf9c18883c10b35368792ee2393b996f8ea45dd26bc2d39da3d4844812dd86e80772d080011aab14810567c107cfc329c5914516ae2addce7b6a47975b64
SSDEEP 192:wR59tKt15/Rv7shAPRp22pG9wHsb+WNnIGnsK8kwEn+VyIsnAUgtaJ:wR59EtTBY8X/AKwhn+k28
TLSH
T1B042B52EBD55693B5CCAC22AFA227B57D7F5103122942E54EAFCCE1C14E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6e15562fc8a0638c7b0491d7b9e44d520e65018f169c0ad252cddc7537ef3fd4
MD5 d42d3a27326de7840fbbb21964ccec3d
SHA1 9ba7012b6897ca46cf40a380e4345e7fe660daed
SHA512 b310a4afe41338262913b6bd9af5bfb0dca8b63e0f1264f74c95c5a64f53d9f7092dfc85b26b7ea0c26682f7ac50bea935745d7f43b079ced569634e6f84cfe4
SSDEEP 192:wR59tKt15/sv7shVPRpp2pG9wHsb+WNnhfeCK8kwEj+VyIsnAUgraJ:wR59EtT4YrXUAKw9esy2e
TLSH
T1D052B52EBD55693B5CCAC22AFA227B57D7F5103122902E54E6FCCE1C25E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 05aa9a01a6ec3dcff8ee312fab01f990fa64052905806526d2d645f1be232ec0
MD5 704f9b3723e1f05c7bbf2df32cb23ae4
SHA1 5069f8cd0faf28f86772e46483600952614cc391
SHA512 7da86c2d47dbb7a6fb65caeed47cf17496d5489cebe4eecb73b00be6dbd792d3bc4b1c568ae8ea8122c85fb673dad8a25ab07ad09d3417452c55ccb535953d1e
SSDEEP 192:wR59sKt15/sv7shVPRpp2pG9wHsb+WNnhfeCK8kwEj+VyIsnAUgraJ:wR59JtT4YrXUAKw9esy2e
TLSH
T15452B42EBD55693B5CCAC22AFA227B57D7F5103122902E54E6FCCE1C25E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 897ebcad946583232931e547cb15f7ec576eb368bdd3a91f56178fc355ac06c0
MD5 5d93eb278e70a25526c81f3f3f3841e5
SHA1 bce09a282cd418909cf704fd35820b5df857c1d2
SHA512 0c0b600050fb1ac69d512dab6d9028ddd86853c5c7efa0bd92cc3b3a2dd00ac1f6c6d60c7fdd014a9a3fb59d88c030e0f93ed9c958891f9b08a2297981b5b34d
TLSH
T134B0129080015141C45302F42D52148871299F20D70A170543F06E328A25271C114150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a565f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a565f.TMP
Size 96B
SHA256 ce9a5c384f5f95d01a86296976771f5f1fb573f54831e9fd7514935c2427b368
MD5 32b275b47ee1750da6f22ccc3937520e
SHA1 bda870d4a76448829e51adef106617e0ffb4d5e0
SHA512 e4649ea7c28fb558b45a600d9950d9233460466fb903e23662d5da3495ced49b6e19cd8738d0cf9e341837b1ee4bb32c73aea9ea913c56de5ea46dabdafd59ae
TLSH
T170B02200C002B202C00203FA2AC0C2C8B030CF20C2230202A2E02BB3CC20B2000200A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 58753c6fe86773ac9e5e1394d7aa5caac73091f83379d02282ee16321dcb1736
MD5 2fbe1bef0d781bd525619bb3c8e7345d
SHA1 e2c488dc412e7b585b20c1f6ee394d61b03e96c6
SHA512 ada75a3025a77442f266bb09c08139d69f32254793fc308678c54f804a611cf16e61787fcc5459d5aa2d9c9d1b9fd07670a87fa6403a9fb09e67b86436410a01
SSDEEP 6144:HEjg96+5bXnt+tSdbmm7Rkm1tYpBeh2BAoJ:Hy0BFhbR9oBGcAoJ
TLSH
T1683412265FF8493B1A68FF1DB84F1E2E0EB14977D4189A67DDDC1B0063A9B8C0509B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 9e578e89e0473b9ebb300351c5ffd855782c4e5562ce433b3b653231ea7b825e
MD5 3bc1e58fcd31e6fcc8cd3e869aaec6e1
SHA1 265ea87643adda1e4a5b79e1b5194b910e4b8723
SHA512 191e65d235c822a5091548344e1f15b1a3490f2b9ece067602fa3967fa01b865564600685ea4e94cdd1cbaa2862722276ce38da370da9e0f82dd3556f258c3d9
SSDEEP 6144:N1CpTl7VEjg96+5bXnt+tSdbmm7Rkm1tYpBeh2BAoJ:NopRhy0BFhbR9oBGcAoJ
TLSH
T1FD54233A6FB859370938EF1DA04F1D6E0DF18927C51CCA6BACDC6A0163AE78C150DA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a8370adee2d54067a72f67db876fe9d351b4a944f3238474ab83dcb4e1fa1379
MD5 e7f1081bb53c8f0aea009976fb401de1
SHA1 b5368675a7a620ab819f89e56993be7181f6f898
SHA512 5cb1fa39140f2e3dde3f8f235ca77b5842f683af12521b534b11e2a73a0ef7a5fc98140d15115db8cbd92ae4a81b83934d09d4bc83a6fc38ca0fef7a08638985
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Pm7Rkm1tYpBeh2BAoK
TLSH
T1CAC3123B5D65E9779979A70EB08E0B1F1EF249A2D920DE92C8D86B0437F97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0b1521aeda579f60cd40dec032cc0d14371f08d0973b86e1baf7cc3723129138
MD5 5c79af757798e1d954d5e416fe69e9a4
SHA1 28b7a7eccd82584bd1144035390a14a8c33b035e
SHA512 420e72ef1a07266da333aa82d263918afecd69f1438ac6477e9eb4175ff8d9b157645922c2b879544dd31e0faaf99a2d2dbab0826501eb799350f1874335595c
SSDEEP 6144:WEjg96+5bXnt+tSdbmm7Rkm1tYpBeh2BAoJ:Wy0BFhbR9oBGcAoJ
TLSH
T19B3423265FF8493B1A68EF1DA84F1E2E0EB14977D4189A67DDDC1B0063A9B8C0509B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download