c0d75ae711adc3feb91de32bb8ff0bdf21781826926ed5c4d242818102dc777b

Analysis

user interaction
yes
max time kernel
390s
max time network
387s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stereo fix 2026 (1).rar
Size 192KB
Sample260620-lezxaad18p
SHA256 c0d75ae711adc3feb91de32bb8ff0bdf21781826926ed5c4d242818102dc777b
MD5 bfb6fd90b7cf79a45c01a22863bdb254
SHA1 77348e4cb0e9f61f47028f15dffa5ba05170008c
SHA512 0b693ae2593d126ed0114ff5c4be64cfbeaa29f6630b69baf2139c38af52b8ee32372340e90a6c68518006e76b7a503421df45f547ecce11267bb6896381686a
SSDEEP 3072:F0w5stlhRcVgNcBuGfvypLNMXF8aZJ4kSsG1qpxS35VnwepA:FHgTcBuuvypeV8+zMYpkpRa
TLSH
T1A81423BCD312B28CDF50500B25119D63B7161A4739BB1E4BEBAD173F52ED0288E4F999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
125	4756	chrome.exe
125	4756	chrome.exe
125	4756	chrome.exe
125	4756	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
86	discord.com
91	discord.com
92	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264213194861245"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
3508	chrome.exe
3508	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1940	7zFM.exe
Token: 35	1940	7zFM.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1940	7zFM.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 704	4252	chrome.exe	99
PID 4252 wrote to memory of 1208	4252	chrome.exe	100
PID 4252 wrote to memory of 1208	4252	chrome.exe	100
PID 4252 wrote to memory of 4756	4252	chrome.exe	101
PID 4252 wrote to memory of 3312	4252	chrome.exe	102
PID 4252 wrote to memory of 3312	4252	chrome.exe	102
PID 4252 wrote to memory of 1028	4252	chrome.exe	104
PID 4252 wrote to memory of 1028	4252	chrome.exe	104
PID 4252 wrote to memory of 1312	4252	chrome.exe	105
PID 4252 wrote to memory of 1312	4252	chrome.exe	105
PID 4252 wrote to memory of 2988	4252	chrome.exe	106
PID 4252 wrote to memory of 2988	4252	chrome.exe	106
PID 4252 wrote to memory of 1112	4252	chrome.exe	107
PID 4252 wrote to memory of 1112	4252	chrome.exe	107
PID 4252 wrote to memory of 4080	4252	chrome.exe	108
PID 4252 wrote to memory of 4080	4252	chrome.exe	108
PID 4252 wrote to memory of 1564	4252	chrome.exe	109
PID 4252 wrote to memory of 3332	4252	chrome.exe	112
PID 4252 wrote to memory of 3332	4252	chrome.exe	112
PID 4252 wrote to memory of 1772	4252	chrome.exe	114
PID 4252 wrote to memory of 1772	4252	chrome.exe	114
PID 4252 wrote to memory of 4348	4252	chrome.exe	115
PID 4252 wrote to memory of 4348	4252	chrome.exe	115
PID 4252 wrote to memory of 4276	4252	chrome.exe	116
PID 4252 wrote to memory of 4276	4252	chrome.exe	116
PID 4252 wrote to memory of 2148	4252	chrome.exe	117
PID 4252 wrote to memory of 2608	4252	chrome.exe	118
PID 4252 wrote to memory of 4456	4252	chrome.exe	119
PID 4252 wrote to memory of 3508	4252	chrome.exe	120
PID 4252 wrote to memory of 1728	4252	chrome.exe	121
PID 4252 wrote to memory of 1728	4252	chrome.exe	121

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\stereo fix 2026 (1).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8768c728,0x7ffd8768c734,0x7ffd8768c740
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,16915056842647735406,13968842987976484230,262144 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,9299962900995793986,8445249367787211559,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1616 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,3415051770293048028,16330739900580260504,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,16160314568488778218,3800989991176960823,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,781277691326738706,6196093150836834607,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,441153743275877356,16733211981357832537,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,8600432912654495259,7768350055616947040,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,10255157513998686787,13309526795046000260,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,12107100441124660663,378679880904093357,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5692,i,4522723132965808086,8514506461670193859,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3124,i,4107529327602000259,14629671290612964010,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3244,i,17785768953371077650,14404811031040211207,2097152 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,5583596339099828397,14440111229986097194,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,12628537013470919254,2572957264584102350,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,6127345513814957574,8022746272428489243,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,10754083740615524218,14285835717317121869,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5392,i,16340370063962380429,7802200911002171856,262144 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,13588012609198833220,11358436007909241249,524288 --field-trial-handle=2020,i,16012257883415473203,9871082099897106512,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 272435a5cdd0fd9d28449d4b3f5d1f5433426da96ef5f1613d6295962cf59d95
MD5 616d43fe716539a4abe02a5822db4d3e
SHA1 288624335ab16370a738efd83a763a1137efa0f3
SHA512 a5d8d3559da6a56f60b0856ac01bfbde09d1ba0f28f26496df1258f8809335eccbb31ddc65c7a1454649d7ddcf2bc68e95729ce7c47e6766de3f343d2c9f5c65
TLSH
T15DE02BABD931AC2758F9476C6044074ADB4013973B40D99F3A3DC10ECFB9A3B058581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5479b1016e3c8cf5bea3c90b31a26cca3d32b9ad0065e588a9c4b92fadd23820
MD5 487da355bdcbd0db1bef63509d4978ef
SHA1 28ec9ffec648d0845ac11159f1f7d1f2b93cd82a
SHA512 c5c00cec6cf154001deab15f56b065a6b1078ecccd1532f8c6bf85be9a6a1c3043ebddb207a7a449416ae52b040eea8467e47b192227837508fe76830b26f2c9
TLSH
T1321184622956BCBACBE3897220F39BC2275949E1192E2B8AE0D2D76105033B42502E3D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a861316ca79df503ed70fbe01173077bb5504be83dd386df0d7d4501dc9e68b3
MD5 78b5f91c5a392019777f281bc1eabb0a
SHA1 c89db31b7da3c97725ab1cfa206e248a3fb66fe8
SHA512 29b9631ed8dddf52b353f037481730f8aa4bef0df1bc1c1eaf4b7f441eb4f7599ef49f9f3a05c50d8a60b6486d8f02f202b1ebc549a2442528d20b5251d61dc6
SSDEEP 192:DavK/eR7JmTJ26uaaI8kmfumfctlNP5naPYvRfPiNUSruYkRoMrsrE5g8mW:DavK/eR7JmTJ26uaaI8kmfu+ctlNBnak
TLSH
T1CB128CF7C3D8C62DC91156F4AB156F1ECE2D0924432C3C2AC8D5AF5BA3E24B2E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5d417b3f18d74a3598a47332cf2a558a11bfedf865e669f7f9fc8078f6a5bdac
MD5 8187f8bd489a514ac66a629a5b1c08eb
SHA1 09e73f96faead5a288733f8cc00968232c33d795
SHA512 c5f0d9967cfeefb84d91ba826ddce2f0e8ddf7bda8e9cdbdc044564b008dc470c2834272f4a6397dd2152a35970aaa67f4148ad03697b95df318e74735d3eb56
SSDEEP 192:DavK/eR7JmTJ26GaI8kmfumfctlNP5naPYvRfPiNUSruYkRuQMrsrlugb:DavK/eR7JmTJ26GaI8kmfu+ctlNBnaQv
TLSH
T16C129CF7C3D8C62DC91156F4AB156E1ECE2D0924532C3C2AC8D5AF5BA3E28B1E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 69957bdd445940e064fffe05c0d3a8605fe4dc311952a5fc02971c63eba851e1
MD5 01ae8c327b53a31b7e6429aa22f5516d
SHA1 bf5a36fb78cdfdbe741708ba0baf7138f5e91714
SHA512 ec672a599dfbeea11c94fa2bc96b962d92e39e4c8b3aefcdd0973c74b9cc57988eee8b39397615b7b165e9e242f6aff55f59cf488cef8c6e0f1a493d2574dccb
SSDEEP 192:aRVcBzrx90v78h1PRpAZfZj9DHsb+WNgJNqOi2O6c/Kx2oHkjH2XveHVyIsnAUge:aRVmzrDw4jXO5wnX/6H2oEjH2X2e
TLSH
T1D452C92BB9101937ACE7D259F9657717D3F6202275D11E84EAFC892C19EB9CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b76623ea0dde0abd0ec5ebd04db83cb5e97fc5f579300a9f43649995f83b0d5c
MD5 4020595633ac61b8bcebdc603970ca7b
SHA1 00538dabb19d57e71fbd21583e25a249ed145337
SHA512 a005839ef40e9ab682222dcfdc3b910f2f9ddcc25aa6aa37bb36e501d0e8473add45a89769337cde36972058982f24c8bb0c45e18bce0e5a3b7b45f37c6f3b37
SSDEEP 192:aRVcBzJx9Hv78h1PRpAZfZj9DHsb+WNgJNqOED+Kx2fkjH2XveHVyIsnAUgraJ:aRVmzJDP4jXO5wnh12sjH2X2e
TLSH
T17852C82FB91019776CEBC259F965BB17D3F6102271951E84EAFC8A2C19EB9CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e30c77f7a2efeee31024784a8167b9f95f22b66e1c77ae06c055f7c5c0e56207
MD5 8121dc80664e4bc008977b9b4bf5dde0
SHA1 b29368a86f0e6396425aca55010effd20f74c262
SHA512 9bc92e95bad566d5e9938da05f28f24e8230bf6d6e55be14854a107fc88e3cd650db83eefc3b14cef504fa68f7b2268ca23446356b770f83f36729bb2eb1782e
SSDEEP 192:aRVcBzmx9Dv78h1PRpAZfZj9DHsb+WNgJNqOUwMKx2zkjH2XveHVyIsnAUgraJ:aRVmzmD74jXO5wnib2wjH2X2e
TLSH
T16C52B72BB9101937ACEBD215F9657B27D3F6202271D51E84EAFC892C19EB9CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 825b913da90aa6b0dd5b0a1ff61da33ffb38921533ed84de679184ba88eb8188
MD5 5f5425303b4a2a977da3c569579e10d5
SHA1 5ad480e80119c2f6bc4fe123f882ecbb01085942
SHA512 27cb07136420d3eea6f0f50815769d576127d28adec3c67ec55b475e53190089ff27583fc5d9f4f4758ecbabebc07781639b86d6694764dd8e4ad238c67f65e4
SSDEEP 192:aRVcBzQx9hrv78hAPRp2Zmj9DHsb+WNnNq4Kx2PkjH2Xve4VyIsnAUgtaJ:aRVmzQDhT48XT5wUP2cjH2Xp8
TLSH
T10442B82EBA14693B6CDBC219FD657717D3F6102271951E84EAFC892C19EB9CC322740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e482e75edd40cd1fefea4414dccb8383c785d0ecfd99f549b0d2546f2f6c5e7d
MD5 a48b46d36054186fc68fcde5ba652b11
SHA1 8ca141defaac039551f034f53b2a7c8eb1a5bc22
SHA512 e8c2681993f42ed2dce0e427682698ade8c738cd8b39b8a31ed35f6e3017edc20d76e9ed32bb55ac473eb50277c2e7b4830e2b2165b55368c9e61ac6f32adc76
SSDEEP 192:aRVcBzrx9pv78h1PRpAZfZj9DHsb+WNgJNqOi2O6c/Kx2oHkjH2XveHVyIsnAUge:aRVmzrDp4jXO5wnX/6H2oEjH2X2e
TLSH
T14152C82BB9101937ACEBD259F9657717D3F6202271D11E84EAFC8A2C19EB9CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 610d8d6f3c62f8abfe4e7f2a5c185b49fb11282b0e1c1d4a3dbfbf011666963e
MD5 97ff27afd137011cb3ef68bb154e1732
SHA1 f4ca456e0030fde43b35b75b567c8e758ed000a2
SHA512 176b899ce5ec8db2541ca3a5af08a535c3d0e8792c60d1db9842a348e4f477bb1b22391237aa0ff7dc1b291a7fa83dbcdd4f117659e88707525acecd0ee5bd31
SSDEEP 192:aRVcBzJx9hrv78hAPRp2ZfZj9DHsb+WNgJNqOED+Kx2ikjH2XveDVyIsnAUgraJ:aRVmzJDhT48Xs5wnh12rjH2X8e
TLSH
T1CF52B72BB910197B6CEBD219F9657717D3F6102271D51E84EAFC8A2C19EB9CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c032370128d52849fc0c9531218c5a07674c01858e6be5cd102f74c3a78efc6e
MD5 2fbab219bf7d57a086b7f1013a010417
SHA1 b957fd0d4393bca5a20c3c2eefb41f14c01939f7
SHA512 d60803a0b6ad0b13c2ad89bed3805487856566b35cc5ed078eaf9fa555aaf114fbcad9a405b6c98dfbc1367153dd46e96a463dc49556193cf4cb7f3b12d01c11
SSDEEP 192:aRVcBzEx9hrv78hAPRp2ZfZj9DHsb+WNgJNq4Kx2PkjH2Xve4VyIsnAUgtaJ:aRVmzEDhT48Xs5wnP2cjH2Xp8
TLSH
T1B442A72FBA14593B6CDBC219F9657717D3F6102271951E84EAFC892C19EB9CC322740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b2afa016ffc6a9e62a01c1705f2c3d5a32182e0bcb010776c0b0ddc19e47f348
MD5 8de6314cab861e98a7d3bf236568b185
SHA1 2a4d3704ac24febf799da73d5bdf2bb703ac7a32
SHA512 e428cd5e44fed01bcf3ba14324a9071cc6742ddc841539157d198e33d45b4a03acf1cdc044e4f8efd7b25e99396b279849e0fd1c512659ee30f906e1fa2ad709
SSDEEP 6144:eupsLiqC6IPHXi0X6vK+1Fm7Rkm1tYpBeh2BAoJ:eupsNC6cHy0IFs9oBGcAoJ
TLSH
T1BA341227BD66DEF725A4A718B08E0B0F0CF549A3D460D997C8F57F00239AAC9414EE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 545017c3e8eac7a03ee56ff1acd2d10807f248d30ba528598bba1da3dc018624
MD5 bceba0544890efeab1d4ed38dbbeb834
SHA1 e2901ec648903d13caac68b420e4f8dab19e585e
SHA512 3e09fb9e71792547c0793891924c03ac23cb40e4c9d421b1f5becf8d26f58795b0ca7c3a3fa9530e662af6acf7f3f2ba6d2d7662c3a2c9f583f813577da82187
SSDEEP 6144:D1bpsLiqC6IPHXi0X6vK+1Fm7Rkm1tYpBeh2BAoJ:xbpsNC6cHy0IFs9oBGcAoJ
TLSH
T1E2341237BC668EF719A4AB18B04E1B1F0CF44AA3D460D98BD4E57F00639FA99450ED78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 49f4822001c6e494ad77137bf1a09667ed444bf5ca582cd0a43ce52d9c97586e
MD5 a78d15a6d4ead98ba9d014a255321f3b
SHA1 ef8ce7e3e4a14d5065dd576cbae3183f8f78aa78
SHA512 b394bc1cbd82f3c09893599045d531c991ae42bc936437a0c37a78c7b521668799dab05f1b8d97defdadd84d08205af3e4c118eb38bc3662685f7514a029b795
SSDEEP 6144:H1bpsLiqC6IPHXi0X6vK+1Fm7Rkm1tYpBeh2BAoJ:VbpsNC6cHy0IFs9oBGcAoJ
TLSH
T16F341237AC668EF715A4AB18B04E1B1F0CF44AA3D460D98BD4E57F00639FA99450ED78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 73853a2cad3750b4858d7411cbaa7f6aac87fc1e173fcd66512f7601a07daf2d
MD5 cacfa9a8ab53dd3217b04aefac2af1cd
SHA1 317e8437acac3e2e63388582c959c7b6294e783c
SHA512 408508adcb1de47e1586c8acc1f36b3359e2c5fab65bfbfb583e25a1f98cd296bbcd2bf9b5a33eef73eb3025fd8d8b956d03d1dde0d0d62f58a71d68168ddb50
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:om7Rkm1tYpBeh2BAoO
TLSH
T1ADC3123B5D65E9375978A70EB48E0B1E1EF24DA6C930DE4288D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8cb99700d070195e9daa75ef6f1411d4442646bf7f8c567c899695c3ec6536c9
MD5 44d8674975e992a26454a731cc66cab6
SHA1 b36ce26443c3651841fdd4124a28d4af09885a01
SHA512 50323dfa5c0bbb2d8f8afcacad0fe26be76ab6cab60e03402ba2405ffc2bdcbb819b167e2f25a167f03aa7bfc326f3aec0c943877b21ddb1b657ea6dd8e39d02
SSDEEP 6144:pupsLiqC6IPHXi0X6vK+1Fm7Rkm1tYpBeh2BAoJ:pupsNC6cHy0IFs9oBGcAoJ
TLSH
T133341227BD66DEF725A4A718B08E0B0F0CF549A3D460D997C8F57F00239AAD9414EE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download