5c8686057376c819505436fccd735b9471309c42bf9486d34bbe19695bf9ab6a

Resubmissions

23/06/2026, 03:43

260623-d94vqaav6t7

23/06/2026, 03:38

260623-d659daav5v4

Analysis

user interaction
yes
max time kernel
170s
max time network
169s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A3338C4DFD8.exe
Size 23.2MB
Sample260623-d659daav5v
SHA256 5c8686057376c819505436fccd735b9471309c42bf9486d34bbe19695bf9ab6a
MD5 36e0d9d995321990e9f5121abbe6d341
SHA1 46d131593694d4278aa57cee4fe71d1f50a8530c
SHA512 5a473cdb23149f3d8cd2d12a5b1794bc067cc04c854df44b68936940ea92cc51c7b2be2747be83837737d37336812cf8b92768c50d4c4096e412ed98dfa70bad
SSDEEP 393216:e33Aenzs37qIg96AahTxoCpGUKTc3UwKCHVR1yJAo02iBc+zUoNxuY3Bx8:mAenQ37qI20FWCpG5I3bKCHVDyJAo02q
TLSH
T1733733C9949E15E4F0E2D3F45B6A609D7438B73C4F81DCB3389827386B6B2465BA1E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266596021418734"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	taskmgr.exe
Token: SeSystemProfilePrivilege	760	taskmgr.exe
Token: SeCreateGlobalPrivilege	760	taskmgr.exe
Token: 33	760	taskmgr.exe
Token: SeIncBasePriorityPrivilege	760	taskmgr.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeCreatePagefilePrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
760	taskmgr.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2152	1712	chrome.exe	85
PID 1712 wrote to memory of 2036	1712	chrome.exe	86
PID 1712 wrote to memory of 2036	1712	chrome.exe	86
PID 1712 wrote to memory of 4236	1712	chrome.exe	87
PID 1712 wrote to memory of 4276	1712	chrome.exe	89
PID 1712 wrote to memory of 4276	1712	chrome.exe	89
PID 1712 wrote to memory of 3844	1712	chrome.exe	90
PID 1712 wrote to memory of 4576	1712	chrome.exe	91
PID 1712 wrote to memory of 3844	1712	chrome.exe	90
PID 1712 wrote to memory of 4576	1712	chrome.exe	91
PID 1712 wrote to memory of 4520	1712	chrome.exe	93
PID 1712 wrote to memory of 4520	1712	chrome.exe	93
PID 1712 wrote to memory of 1696	1712	chrome.exe	94
PID 1712 wrote to memory of 1696	1712	chrome.exe	94
PID 1712 wrote to memory of 2084	1712	chrome.exe	95
PID 1712 wrote to memory of 2084	1712	chrome.exe	95
PID 1712 wrote to memory of 5808	1712	chrome.exe	96
PID 1712 wrote to memory of 5808	1712	chrome.exe	96
PID 1712 wrote to memory of 3044	1712	chrome.exe	97
PID 1712 wrote to memory of 2468	1712	chrome.exe	99
PID 1712 wrote to memory of 4476	1712	chrome.exe	100
PID 1712 wrote to memory of 3588	1712	chrome.exe	101
PID 1712 wrote to memory of 5184	1712	chrome.exe	102
PID 1712 wrote to memory of 5184	1712	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\A3338C4DFD8.exe
"C:\Users\Admin\AppData\Local\Temp\A3338C4DFD8.exe"
1⤵
PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2bc3c728,0x7fff2bc3c734,0x7fff2bc3c740
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,15013656820356431746,4838575660269582863,262144 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11041009096094157138,7293632722822317421,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,188226756782084072,5987317046252309520,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,17075416937373290118,18416009608754050263,2097152 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2427444367421667310,11995364737708332809,2097152 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,13149150281091763097,15657459010304989242,2097152 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,11400940847859018377,3467673804025496038,2097152 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,17575741279354030849,17361565991584568267,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,5837364270479994638,11494965492689907467,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,14522106078163521965,4667748880180123346,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,17634885360887827695,9020504638127089438,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,11475155216646019618,12299115861498065193,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,13062530571365743651,7220098980898687576,524288 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=872,i,9480257546433231928,5098100493158906261,2097152 --field-trial-handle=1960,i,16683690740181431064,7614228438442443898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ce963a607a157185d42607ca3c349278be5a4a06c1915172449f2f8de37f523a
MD5 dae9936c750c2d06174726256e660a6a
SHA1 08318e88b812c0ae1884220e22e6b93c33cfad43
SHA512 40af063ee22bc85bc565d5af54de0b0af66e7ace232a11f290a20435a9849719d16f180ba25737f878ef5d9ff7779a50e73cd49e82a15e10456284cf728dc976
TLSH
T18CE02BA6C821DC371DFD1B2C61D51745E76203173F80595B3B3C810C8FB2A3A518685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5c10acce44437c12322b1947ec8a8e4424b3cf75b4dd6634e7c440305346e3eb
MD5 1160da158861092743762204afc979f5
SHA1 954cf195d86abfc14d9a5a6a948b18b4d794fecf
SHA512 20637c888dfcadce8fccda6949de6e30827e7703f18622e6024516be58f5bbc24288849aa010cd71000636521242eeda5038453b503bdb86ad5bc2de57791c73
TLSH
T147D0C94E21B43754FF022DBAF17062D0571D399161A11DD342D490A40D3EB5EA5118A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 65cbd6df941bdaceeaf96fac91ea4ea74a90f15e61348a065250ad4166c3e072
MD5 a7f0ea13c48e8f008b3c874ad11ed86a
SHA1 6eedc43652753f5c3f723ab8d22cf3f6daf261e5
SHA512 edc92cc5f5d2f8eea50ad2fe35546296187bff4a5b59838c87016c1c31bbc5a0a1e545aa576affd35ecff198cff4a801fd7a485b70697fb1694de3050f963b9a
TLSH
T169518BB7C3E4897D895552F4AB216E2FCD2E0A24431C3C6688E4EF4B53E2872D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dadccf20799872f2889f07e61f5cd1f81034715ecd25c005c07d48e7515e43c5
MD5 b542e6b6538e4113cfa66d7ec6a42576
SHA1 648fee688906af48d7603171ce0f89fb1bb01ded
SHA512 fadb9679124a99eb0ad043600b50c5dc56866277d3e1e03e02228f36fff160a007f65d72cfdb6b86d660e3452d8a64308c4d29b1c0c3823d111628077a09933f
SSDEEP 192:lRHtvYMriPTvfSuv7HpAPRp2y9DHsb+WNnLR0eB2KPSxYFjVyIsnAUgraJ:lRHt9ieKjUXR5w90i2KXe
TLSH
T17942A63EB910693BACD7D219FA667B53E7F5203121D42E88E6FC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bc5db28412d6d13e50e646a4eab60fbd963a4fb6117be54a82ef0e67f74b7e18
MD5 45e8380924d3eb13b7ea4dd446cdef26
SHA1 3f211ad4ae887a4406443747f5d8bc52133acb4e
SHA512 9b271cd854673ac3cc80db5ddcf1db95fc8ead27a52ad92d5f504b21f99f17041a7f9e404489f4a0c5bc280369f75b99bccc14ff7b77b68930794fc693e68daf
SSDEEP 192:lRHtvYMriPTvfS+v7HpAPRp2y9DHsb+WNnLR0BB2KPSxYFyVyIsnAUgtaJ:lRHt9ie6jUXR5w90f2KM8
TLSH
T17642B73EB910693B6CD7C219FA667B53E7F5203121D42E88E6FC8A2C19D75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 536e71b86d64f254306c649bb0b8bdfc1c69eb7191f13739088bb8bc43fd5d9e
MD5 c58dafb4fb01dfc2e05428085f5761f4
SHA1 075d64e41720c13fb5bf45ab63eb9bf4608e3021
SHA512 d7b3e4ce757044c9b98f56f2276d553e2e7bb5ddcae5fdb95eab5bf420143686de0b123caf626161a26775c71a0c045d99c76fd525bab59778c6ab0821b650ef
SSDEEP 192:lRHtvYMriPTvfS5v7HhmPRpQy9DHsb+WNn1NtpB2KPSxYFtVyIsnAUgraJ:lRHt9ieZjGXX5wHtH2KVe
TLSH
T11452B72AB910693BACD7C229F9667B53E7F5203161D41E88E6FC8A2C19E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aef8657e54c341a8e2d69bb20470c978e00b8c00b3c5fea54ccf45210d220b65
MD5 5ad6ff6cd148d029cf8cc3f640c17313
SHA1 4dc3f839f3aa7c1bcc724757bd91a056235ab05d
SHA512 4383a77967e96dfcd3e17af6aa778a21055d2034a7c5d347ed33db70c80ccf6c7c8337d0ba3c88cecfa1e73182c09466e97b758d107859e28cf268a3d2a9fc37
TLSH
T171B0124084425502C10202F42182148C73149F12A70B170183F06923DC27161C526050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597edb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597edb.TMP
Size 96B
SHA256 fd746e77a66eb40b2554fabf32e6744f4a4e9c4e2e136e3506aacb0f8a2271ab
MD5 3a5e6f87a7c8aa303b8509a74cf8a59c
SHA1 e32aa17d58ef309efcaf03bb5cea0569a059de2e
SHA512 5ee967df1fec75a13e2b0940d74c329d319c7d825f537186ffc5ffe55764f35ab61ee0cc0f0ac0a8085d645ce08aad16886a47338f1ab193e2f40f79cd59c1c9
TLSH
T1A9B02200E002230AC00203F028AE80C833A0EF32C20302A38AE00F32CC382A00C380A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5945360a464675a15a125d13537cadfc6460d75f46da76969303dea821e8fce5
MD5 cd13a4ce102cef2acad3a43fa3e530e1
SHA1 fe6b1964b83fd8e0df579a62403e4ec3f87fde59
SHA512 2aa8ebbb56d17b3d5cb278e38caba277bfd9eaef5b50d0c6b787d3ed43a683a82cc59394314e53126cc5bcdc822b3306df2f731518446d48e6fe939e88a5d38e
SSDEEP 6144:EgHmsNpI797hmQWLFwgVJm7Rkm1tYpBeh2BAoG:RGsrI7Bh5gVA9oBGcAoG
TLSH
T1233423375D957CB141B9CB8EB09E0F1E3DB24E169A36E9D598F02F08777DA891242A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 38ab0da301f32a16f89e80abd3373939536af60326b2d42034a5342d0296c99d
MD5 fdd519b476195976a2982cc1e3ae2f95
SHA1 78283b6e8b3a91179ee6556d5aa1855ac46c20d6
SHA512 f9503f535211a879f9636f615616407fa3d1133bdc3fea5a5d6c04ce8f8b1a2d9b416e57295498c30d424f0a0dcd3c6be79945d8c48acf033ec7ce7956c32f36
SSDEEP 6144:FgHmsNpI797hmQWLFwgVJm7Rkm1tYpBeh2BAoG:aGsrI7Bh5gVA9oBGcAoG
TLSH
T1D73423375D957CB141B9CB8EB09E0F1E3DB24E169A36E9D598F02F08777DA891242A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 79246030851b6771d8befe56e53464bbd26201b63d642440a089f0d52ed2721a
MD5 ca233f97b8f0c438c337ff6030743676
SHA1 ddc71ff15cf3688a791b2f69db40fe657d5c0555
SHA512 44613e6ac433e622c4735cb31e7c32dbbafce3475b8d67bcd0ff118c452088ad6ddef882b0cc75be7405227c03ef2a5588ab13195c7107e10d518ba7e2f84c71
SSDEEP 6144:+hgHmsNpI797hmQWLFwgVJm7Rkm1tYpBeh2BAoG:FGsrI7Bh5gVA9oBGcAoG
TLSH
T1A134233B5C557CB145B9CB8DB09E1B1E3DB24F16DA36E899A4F02F08777E5491603930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8ff145abf17afa099809bd1512a6f285e192a03793862084da2ce1176e88202c
MD5 31038cd9b136deb63c5ffeac4fedf76f
SHA1 6a69a1493c4f2f3a2bfacb7be775fed8143d5ce0
SHA512 c8d0825fa9ecdaef60d12f8ec92d78139b44236734307ba31060e22f776770d17563e74aca50177212e05f062bf6d7c618f39954bb6ac5eeb03d2ad6060da65e
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:3m7Rkm1tYpBeh2BAo+
TLSH
T17EC3123B5D71A93658B5B74EB08E0B1F2EF149A6D930DE92C8D85B0477F66CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH