ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Resubmissions

25/06/2026, 15:00

260625-sdapbscx4s8

25/06/2026, 14:56

260625-sba73sc14n8

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
25/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Real Executor_39936735.exe
Size 583KB
Sample260625-sdapbscx4s
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Real Executor_39936735.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1364	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268732271343528"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 1212	3708	chrome.exe	92
PID 3708 wrote to memory of 1364	3708	chrome.exe	94
PID 3708 wrote to memory of 2544	3708	chrome.exe	95
PID 3708 wrote to memory of 2544	3708	chrome.exe	95
PID 3708 wrote to memory of 2292	3708	chrome.exe	96
PID 3708 wrote to memory of 2292	3708	chrome.exe	96
PID 3708 wrote to memory of 692	3708	chrome.exe	97
PID 3708 wrote to memory of 692	3708	chrome.exe	97
PID 3708 wrote to memory of 6140	3708	chrome.exe	98
PID 3708 wrote to memory of 6140	3708	chrome.exe	98
PID 3708 wrote to memory of 2412	3708	chrome.exe	99
PID 3708 wrote to memory of 2412	3708	chrome.exe	99
PID 3708 wrote to memory of 2340	3708	chrome.exe	100
PID 3708 wrote to memory of 2340	3708	chrome.exe	100
PID 3708 wrote to memory of 6012	3708	chrome.exe	101
PID 3708 wrote to memory of 6012	3708	chrome.exe	101
PID 3708 wrote to memory of 4184	3708	chrome.exe	102
PID 3708 wrote to memory of 4184	3708	chrome.exe	102
PID 3708 wrote to memory of 1556	3708	chrome.exe	103
PID 3708 wrote to memory of 3164	3708	chrome.exe	107
PID 3708 wrote to memory of 4360	3708	chrome.exe	108
PID 3708 wrote to memory of 5564	3708	chrome.exe	109
PID 3708 wrote to memory of 4452	3708	chrome.exe	116
PID 3708 wrote to memory of 3772	3708	chrome.exe	117
PID 3708 wrote to memory of 3772	3708	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\Real Executor_39936735.exe
"C:\Users\Admin\AppData\Local\Temp\Real Executor_39936735.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffb7d7c728,0x7fffb7d7c734,0x7fffb7d7c740
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12548745043384965727,7186181692717758705,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,8108675027879711091,5572574489460337306,262144 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,11323061550858811477,4514619746509717243,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,16856673817889762154,6938581197929882539,2097152 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,8599614429078035849,4200616046643598125,2097152 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,9237378174494277547,15539818838618512752,2097152 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,6145820354791505552,2205479950744445358,2097152 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,16248983694136111211,15583067551472856865,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,17514588554617206061,9260491377624829459,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,9591566990543245119,18277543975594541133,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,14924212006867118996,17375610046205597162,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,5918422232941205179,12895708046802159533,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,13440944108718555751,5050384476890241511,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1208,i,6618041622939107735,16275026247844875608,262144 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1300,i,1075206277386762740,2940387344370823895,524288 --field-trial-handle=2220,i,16167782719581964717,567783130579069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1208 /prefetch:8
  2⤵
  PID:3772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9a69340e1cd0d5d025de2a306652dbcb67e97cbc059354a34b9aa991eae05cd0
MD5 a9e3d075514c1c01571eda639fd016c5
SHA1 d858b937a26deaef6ee83fb6f6c3cab60b637c43
SHA512 bc70fe893bcbf1b76f739162ba30c40f705f0d9beb1703b98e0ebe991d3fedd62246770ff21afbc29dbfdff969450d63034a8e303dd0675e03a8b4db15787481
TLSH
T10CE02B6ECD21AC2708FE471874150749E754135B2B81554F3A3E5208CFB0B2649D6CAD
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff0d329a69078df484751b8ce7db3424bac7f7562e34d59d3ad7994eec460938
MD5 c9234cf39ec3af160e6874f4a86d4ee8
SHA1 94e97089377794dfd85d6d7b28c5c5993a6e61ef
SHA512 4ddaf0a612ea81e0daafa3eb3db35a301ae974e5a54e679af44105f0cffc708b1a1481184dc0322297f4d7655cbc6ed707a1745fc7cf1d50439d1b79390a71df
TLSH
T141519EF7D7E4857D851196F4AA216E1FCD2D0A24432C3C66C8E4AF4B57F2872D240B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 03ae8d6513582904600b4cf9131eed873773f842559af91dc6ed251f153a5321
MD5 bac866f9bf01f821b86ab68e56133642
SHA1 a7aec1ef480e64a6f4b05df96016548b39315f62
SHA512 a290d086c288544f01a1bc89cd0eed5c17e99f100e1e4f0800aac4ef6d1fce1a3ee00449defda2bbd56dbe0fd74036137aad80fbf5ed29fe95c785c94f524596
TLSH
T1ED518EF7D7E4856D851196F4AA216E1FCE2D0A24431C3C66C8E4AF4B57E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 216758216ca2d0504eaa429b67e7d57e392ae6333efd574ee9a4140f36d45713
MD5 8ecbedd5812d59a7e00222746e2853c8
SHA1 30f477d70cbe5a06af165730edccba5c543d8e74
SHA512 7b6cddf4d2996ea774d690cc3bf4e24e384dbc6d20789a3ba89712c364c5e78ea41d81fbdc6c58341b90308e72ea57a68355de51e171fb84d9c9fd4b0c8733f9
SSDEEP 192:5RP/xecVlXv7spAPRp22F9wHsb+WNnpm0LDD6PaGgVyIsnAUgtaJ:5RP/UE/YUX/FKwo0/gax8
TLSH
T1CC42C62EBE54693B5DDBC21AFD227753D7F5102122942E54E6FCCA1C14DBACC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 002167edad18f94104733a0794e73ccdcf96e87cc6fc5277a0ff7ebbe615b70d
MD5 e4705c2592232fa5d22ff4167e7cfa50
SHA1 0c7905cf2ffda05bec8a1393269a1bccfcf99989
SHA512 61e39ebf74505874b9cea22659cfef504af6d03f53777d61a8d66949a4af983200585d12d7232bc7f0f17bb5ef7a596169d449c8d6ca482669a3e662943ba0d7
SSDEEP 192:5RP/FecVlXv7sp9PRpl2F9wHsb+WNnpm0cDD6PaGWVyIsnAUgraJ:5RP/gE/YrXYFKwo00gate
TLSH
T1E752C62EB914693B6CDBC21AFD227B53D7F5107122942E54E6FCCA1C15EBACC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2332f4d2217dfb4682b18b418919257877f2f97dc7e2c436637790fc0e5dc90c
MD5 e077258a5ed98b969c54ba86324d319e
SHA1 1d2ff5118e7f58d1b4e5f7ecf2ef34ce0255c8b4
SHA512 a17525fc41cffc0bf474381ab139433ac77bdfd0b625df58e1c9a3cbb0feea94093da297c3c0d809bb6bbc4c892b6bba31f24cfff6ceadd52536fde40e6c3e61
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLkdLcSjCDXODUr+ErU3/mHwcmyOKoq6:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pw
TLSH
T10C7209676C4C8E370F94CACCD8267F4F9DB5025B65D9886482FA9C2903D4BCB11492FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c711ce82215d302e24b4069d3dadf74dc49b600b75b395aade79de0625bf0da
MD5 e824872b231ae15b3955bdcbea8c33de
SHA1 7cc118733c632ae080790f5e1b470f6f569664e4
SHA512 9b0e1074cb55f9df73b9adf3777d5b1a043a6da54c882f2bf9b7e1a90b2884c87ecef5f735c4bc06f2dbd995d70306fab39d78f56711d333ab1df5dd62bcde7b
TLSH
T189B0124084019902C08303F01282548871685F24960B270593E0AD22CC69261821C050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e21e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e21e.TMP
Size 96B
SHA256 0e18c1ed5930b67674c04e73ce25144eeba86476028866131ab7774eb555e752
MD5 afe9023f48172e44a539a6c9486bcc4f
SHA1 8f57342f827584f0824669668036f9f168ec2a2d
SHA512 d3a7ac1a72211560861bebb138fc9b3e21d3d719204f02efab07e9f0e48ee784d4005457176f19f016ffd70a42e097c652c940027adeb24a8868e54dad4e9a2f
TLSH
T103B022AAE0222202C00203BC28A8A0C83020EF28C2030202A2E03A22CC38BF002200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 d28ffab03505c3ecf5568138883aa97b9dd4b2f925971aa78b082451e01972c7
MD5 250cff1767b25add541739f3168db10f
SHA1 42e86e5bc54a302212661eea367a70654a5d6a60
SHA512 49edb0c0f65118f72f7610f38f959b30390bbf2807ab69321ec79b42287e587d2f9e5a5820dd6de1c16364b8ee5da54aa8cde2ece372ee30e48aed5db0e0817e
SSDEEP 6144:Xt5LapPk/PZ/r07c+m7Rkm1tYpBeh2BAoL:XXLapM3Z4K9oBGcAoL
TLSH
T1B834122A5D666D3F9CE4170F24CF0E1F6DF057E5CE09E9E644E5EF08238A985250EC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d6cef0fc7c2d55c5d12cf6337cf98973f0372df5df0581e7507758bea411ebd8
MD5 d0b1704a292fb04df36609942aa3d002
SHA1 d05ccd7fd4841bd7a7355d0851bce5955fd64114
SHA512 b0b5ad5578dc474860b7f2b96b2dd8149cb016eab4001df01a4bd7e3d2afee558ffe99372b813cfceee71b151dfb904cde667f503a9efef6854e4b2f6b3a1cd9
SSDEEP 6144:jSt5LapPk/PZ/r07c+m7Rkm1tYpBeh2BAoL:GXLapM3Z4K9oBGcAoL
TLSH
T1AE34223B5D666D3F9CF4270F148F1A1F5DF097E6CE08E9D698E9AF08238A945190EC60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 1deb1c42f47521ba548c681f9db0c59bee1232ec802ad441fac52f189d8606c8
MD5 7939482426f7216500ec47561841d613
SHA1 bd966f347b21efc4eee1352a14b7825cda3c6cc8
SHA512 d70c371607a4f11a48c86561f83052eec96aedad5e814dbf82fd90acb3158732f880b8f53ae80bb1268291c5858bcf9d93c7a3151e7a208398e07bc0f351ceb4
SSDEEP 6144:DSt5LapPk/PZ/r07c+m7Rkm1tYpBeh2BAoL:mXLapM3Z4K9oBGcAoL
TLSH
T13534233B5D666D3F9CF4270F148F1A1F5DF097E6CE08E9D694E9AF08238A945190EC60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6ad1d9053e6e8fd42e4ae026c829d81ef424a1e131abf5725f114e7f4996a0e8
MD5 5a95f35eeffb1a438eef7552c78c9e7b
SHA1 f10813d3bc5bbeac02be57919502a6d567b60af4
SHA512 b6c253ff37b73ea5368c1993812b6e44698cae9f9183a26a97ee0bb23a731cdd1bff9f50633f121d32d62d416b9f4d0be1a616d7819887d41a1e91a630798257
SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Dm7Rkm1tYpBeh2BAoK
TLSH
T17DC3123B5D75E8779979A70EB08E0B1F1EF149A2D920DE92C8D85B0437E97C90A04D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 41142ef5701d2830cf67ee120c83838ff3b3568d152b9c773bbb5e4d273107ef
MD5 53cc7b1f90f96e541989290ee809fa0b
SHA1 282feb867445fc46356ca66d0e92787058c2bf2c
SHA512 d4c23b7946cf2f6fc502d4cdc4b443bdb650d4dd65b531ae68e4f7cb455961b0dbb08762ca57c1271835c037aa19d8db79f7450660f47c402618daf1398c01f0
SSDEEP 6144:6t5LapPk/PZ/r07c+m7Rkm1tYpBeh2BAoL:6XLapM3Z4K9oBGcAoL
TLSH
T11934122A5D666D3F9CE4270F24CF0E1F6DF057E5CE09E9E644E5EF08238A985250EC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download