hxxp://stealer[.]su

Analysis

user interaction
yes
max time kernel
87s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/06/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://stealer.su
Sample260622-t6882aex21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4016	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266200988715627"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 484	2448	chrome.exe	82
PID 2448 wrote to memory of 1752	2448	chrome.exe	84
PID 2448 wrote to memory of 1752	2448	chrome.exe	84
PID 2448 wrote to memory of 4016	2448	chrome.exe	85
PID 2448 wrote to memory of 5032	2448	chrome.exe	86
PID 2448 wrote to memory of 5032	2448	chrome.exe	86
PID 2448 wrote to memory of 2656	2448	chrome.exe	87
PID 2448 wrote to memory of 2656	2448	chrome.exe	87
PID 2448 wrote to memory of 4600	2448	chrome.exe	88
PID 2448 wrote to memory of 4600	2448	chrome.exe	88
PID 2448 wrote to memory of 4304	2448	chrome.exe	89
PID 2448 wrote to memory of 4304	2448	chrome.exe	89
PID 2448 wrote to memory of 228	2448	chrome.exe	92
PID 2448 wrote to memory of 228	2448	chrome.exe	92
PID 2448 wrote to memory of 2084	2448	chrome.exe	93
PID 2448 wrote to memory of 2084	2448	chrome.exe	93
PID 2448 wrote to memory of 2296	2448	chrome.exe	94
PID 2448 wrote to memory of 2296	2448	chrome.exe	94
PID 2448 wrote to memory of 3868	2448	chrome.exe	95
PID 2448 wrote to memory of 4408	2448	chrome.exe	97
PID 2448 wrote to memory of 4408	2448	chrome.exe	97
PID 2448 wrote to memory of 4444	2448	chrome.exe	98
PID 2448 wrote to memory of 4444	2448	chrome.exe	98
PID 2448 wrote to memory of 3960	2448	chrome.exe	99
PID 2448 wrote to memory of 3960	2448	chrome.exe	99
PID 2448 wrote to memory of 1520	2448	chrome.exe	100
PID 2448 wrote to memory of 1520	2448	chrome.exe	100
PID 2448 wrote to memory of 2752	2448	chrome.exe	101
PID 2448 wrote to memory of 1696	2448	chrome.exe	102
PID 2448 wrote to memory of 3992	2448	chrome.exe	103

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://stealer.su
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd18bbc728,0x7ffd18bbc734,0x7ffd18bbc740
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,752332520159644554,5452049957626293141,262144 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,5120926878955497323,1504793363391273942,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,17488254223148635011,7630507397764510214,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2908 /prefetch:13
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,17725337968495389203,18079421868415882782,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,3100596643763046721,1040662503609017093,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,9192482541122285517,8129878670412576739,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,9208414659040337100,16939161242324467053,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3244,i,13240606530412427967,15361760579341146742,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4700,i,12174235235771400182,12585873621395631770,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,2401580897886730948,15157119314290421068,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5804,i,14564314878002592466,10827582062701285662,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3648,i,16326122050927174661,11139314241387811610,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3304,i,299870112846264916,8729826306782401767,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3392,i,10963442750065144793,243655838633167970,2097152 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,1691725968569291216,16297134936825755795,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,17429549225796780433,16159257935367886309,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,15000950447607883314,9285288854201677272,524288 --field-trial-handle=1952,i,7262270716927471788,16675360051101820074,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:14
  2⤵
  PID:3992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ab950225c1461a69d11e3d5e94e03b6e17ac5d6a045280b394be50c7d97ff73e
MD5 985f79a85578ae89ef4239a75ecb84a6
SHA1 0095b7fc55711b9efdecfdc4caf4063a7e7158e3
SHA512 0b42f2d2da2a2242ab25bb355d891205bb171ec05d901567c82d2809d336eecbe9f89ffb025feabb055fb6c03588e6b0b6058259403599b624fcc902b60f33cc
TLSH
T15DE02BAAD926DC3B09FD2B1964504747E75013172790498F3A3C910D8FB553A45C6D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 2476e6ce98160fd6df9d556983e95c21f7e00721dd5369948fe2445963eadcdb
MD5 d95c66f00cce7105aefc932babfb1f82
SHA1 2314d78f58fdb886fa76036f8c2d1c827fea9e41
SHA512 d1817d6e518a92d24a5703202ef29b557788726b15de2c6b35ee9b53ef6f282c6efc7c18b4cabf65f7f34b0e56e0f966956ceac0791be96691ecd3e6cf7d63cc
TLSH
T1BCC08CA4B8902003DB94463828C88BC0F7AE680801020A12C2E18264BA22B52A219DD1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c27c28eaab4971c060d45d1b99612a101f5ab3bc6aa56221c102ec1bfb6e661d
MD5 fab005cc217a26a3c867fc47e6f6ccf7
SHA1 32de3b688a748760628217bef41a8b7cc57908b4
SHA512 3d09075758323bc800674129690775f46354fc9dc7ede1bd82dad91343ec295d00777fc29b357c35d2af41b5c62e9bd6b00a9353603c29e6a44ad9fabff6c1e8
SSDEEP 48:YALl4y4+5J4UPhCaXYfo7EdKsbW4sPWgmzsrW0sXOWIsnWZswWFzsDyWksPW5zs1:DlP7zQaIaEdw+ZRmwaR6pHR4
TLSH
T1DB918CFBC3E4D62E8A1196F0AB146E1FCD6D0524431C3D7689E5AF4B63E2872D20075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2ca26ed92dd257c8e048ba759e245a052fc7e5fa3186b816ece1623743e7ca62
MD5 160f714f4d1f717de0adb6884d35448c
SHA1 da0c21b40c37139bbe53cafb752494ba308a027d
SHA512 bcf40e02ddeb4d3f09e854503cb3bbdeb64461d856756134b3f6f61c44a7f66c64371dfea157255faac26a922c2fc6bb71f5a472f2abbdfea60e30e54acce741
SSDEEP 192:pRL3YquaSgL/Mv75plPRpJDwCi98Hsb+WNnn/Xw4v0KM2KpBaAaM8yIsnAUgE:pRL3w8YV3XBCuw/X/0H22BavE
TLSH
T1F652B71EF9106A7B9DC6D329F9127B27D3F5102536D42E84E6FC8A2C28E79CD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b8aaa38255b42116b9001b984fa3a9cb621611da5c6f5ab072f0bddd551b162b
MD5 4b68f6620ae8527075ddc68ec24e8021
SHA1 30f0d21cf681f6f07241884a8be0690221ae5c32
SHA512 69e44b37d48e1db5b9dfc1de871b999ade03ce783e01aa16b5c207b7105b35b1565b7657068c612654339a0e8e60c8e39aa82aabfaf4fb86a90c49bac2ad98b4
SSDEEP 192:pRL3YquaSgL/Bv75pAPRp2DwCg98Hsb+WNnn/XwBlWJM2KpBaAaUVyIsnAUge:pRL3w8RVUXkAuw/XcWu22Baoe
TLSH
T13142B52EF9106A3B9DC6C32AF9127727D7F5102535D42E84E6FC8A2C28E79CD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 292369b4f6427b174ce772afa32ee63636a797558683d412830cb7f4413795cf
MD5 91e78bbdf125ecf43e8cc713e8a0b6a1
SHA1 ae436d5ee8f6fa76d87192fafb4bc7f8f4644d57
SHA512 b955155f467b5ce4ef020a431cf745558f60315b0865e2f75c4592854b6fdcf4518e6901c2adef4e9d9c007207eccd3f8a458b2b8b07d42fa920ccf7868c3094
TLSH
T145B01240C4015101C04602F812521C88B1189F11BA0F3B05C3E17B2398355908018061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a35f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a35f.TMP
Size 96B
SHA256 ee11e16774995535a738274cb1eeefd4568f94d026347120bc591f3471cd3d6c
MD5 82e13b7b615d961d2d6332903b1125f6
SHA1 e8815b9bca7d07fc4f9c79ce7d480916bec2dbc3
SHA512 b1668a22516320bf19797da7b2a59eb7cedbe2684d0aa5386572e227bc263fd801568071c9b378cdd1e8b643fd2736c82316404d192ae613a5f0e0f914eabfd3
TLSH
T1CDB00255C1066352E05243B42995A5E8B164DF7FC603132693E15A67DC257A056259F0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1d8bcb643beb1b239dbbe228cc3aa5b10531799f3b5cd379ac7b86b822d38f3e
MD5 350a31f83950b06f1b079e5556e0fbf7
SHA1 127e5678342256d8461f90571c093ca383d73b5a
SHA512 ecaf1cf7a2613f0611e591885305b04e2f5daf66e52c38415a6fe38ece959bfdd36af2486b201ef0abe5bfe65069a459071a43b4aca6e9257f0b57ac49b8e5ed
SSDEEP 3072:YdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Y0m7Rkm1tYpBeh2BAoF
TLSH
T1D6C312375D74E8765AB5BB1EB04E0A1F1EF149A7CD20DE92C8D85B0437EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a0bdea11a6958cf8bac3f352fc540aeba0585f6f68276a5d82aee9c5b75eab57
MD5 38970c2aca014cfd6c61f136e24f6698
SHA1 8036fc8a5307400a207e48a2910874d1b4bf7737
SHA512 679fce54d6ea15a9fe5443bccf345ebad1944479baa6700feee2df1877b900558449840e64a8cb71ee3b985142a426902b85daf97589830b2fbf731ffce8419c
SSDEEP 3072:cUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:cXm7Rkm1tYpBeh2BAoF
TLSH
T174C3123B5D74A87749B9BB4EB04E0A1F1DF149A7D920EE92C8D85A0437E9BCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4d09263822c3002ee5121c3ad8fb5516cfd1f9ec910c0e2dffb8fb759b150245
MD5 5f53fe4655a5f67759fc836fb5560199
SHA1 9289d3ca2e448029f662cda465384027ae453c09
SHA512 27dec0538ce4bbd10f1c865e8a081740d9abfc02a883d35f4358125841c7b8f0fcb774c1b558582ff2a441535adb336d72354f4525a90671b7da82769c7fb003
SSDEEP 3072:hdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:h0m7Rkm1tYpBeh2BAoF
TLSH
T1CBC312375D74E8765AB5BB1EB04E0A1F1EF149A7CE20DE92C8D85B0437EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ac0264ef49a07f36ef300eb3969523bcd348dd10578a6a16c70784e6e3ff5165
MD5 e3376374941cec33be56b84d3cd8add4
SHA1 f58055dd5dd1534f6d10ab0906b7fe6c0c15f5e9
SHA512 1867a6e52ba4b6e4a53607fdee5c5e047b169543ef44850574d5f4e94ec5b9a95a52726db12f89379899d8f80efc63d19970a473e152fded5fc31f72bcc7183f
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Sm7Rkm1tYpBeh2BAoF
TLSH
T1A8C3123B5D70E97759B8AB4EB08E0B1F1EF149A6C930DE92C8D85A0477F97CC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download