9e3da3de63468e6380f34cb610cd41ab6e10f22031500a8fc1312445fe28fc53

Resubmissions

02/07/2026, 17:07

260702-vm2khsav4t8

02/07/2026, 16:29

260702-ty9vlaex9n8

01/07/2026, 16:23

260701-tvy9pabx4w8

Analysis

user interaction
yes
max time kernel
209s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ComIntRep v11.1.3/Source/Includes/AutoIt3Script.ps1
Size 7KB
Sample260702-vm2khsav4t
SHA256 9e3da3de63468e6380f34cb610cd41ab6e10f22031500a8fc1312445fe28fc53
MD5 b0fd0cda9d18264601e9afbebde97d4e
SHA1 63c4752f0ed038b00741003ce3aade4efe4e9305
SHA512 e0909be86ddfb66fe6e2ebf0edcc775def8ecbeaab89bc82f311785d95bb376784cf4b1c9f4e14c8e38a4dfa432d44941a83f8f428f93adc905b086259a02665
SSDEEP 192:aaUGCDJO5EcIHptFkB7mr0zTFp3hxtgxtOxtfxDxiBagB9aNJ:aaUGCDJDpkJmOH0CeBaQaNJ
TLSH
T14CF1EE083CD7642C04186247BE3B4E37E25949AD442DF3A5FAB8AD93E41575CD1B87EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1364	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274858139568937"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1364	powershell.exe
1364	powershell.exe
1804	chrome.exe
1804	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4460	1804	chrome.exe	100
PID 1804 wrote to memory of 3016	1804	chrome.exe	101
PID 1804 wrote to memory of 4696	1804	chrome.exe	102
PID 1804 wrote to memory of 3016	1804	chrome.exe	101
PID 1804 wrote to memory of 3684	1804	chrome.exe	103
PID 1804 wrote to memory of 3684	1804	chrome.exe	103
PID 1804 wrote to memory of 3120	1804	chrome.exe	105
PID 1804 wrote to memory of 3120	1804	chrome.exe	105
PID 1804 wrote to memory of 4532	1804	chrome.exe	106
PID 1804 wrote to memory of 4532	1804	chrome.exe	106
PID 1804 wrote to memory of 1328	1804	chrome.exe	107
PID 1804 wrote to memory of 1328	1804	chrome.exe	107
PID 1804 wrote to memory of 1852	1804	chrome.exe	108
PID 1804 wrote to memory of 1852	1804	chrome.exe	108
PID 1804 wrote to memory of 1352	1804	chrome.exe	109
PID 1804 wrote to memory of 1352	1804	chrome.exe	109
PID 1804 wrote to memory of 3720	1804	chrome.exe	110
PID 1804 wrote to memory of 3720	1804	chrome.exe	110
PID 1804 wrote to memory of 3808	1804	chrome.exe	111
PID 1804 wrote to memory of 460	1804	chrome.exe	115
PID 1804 wrote to memory of 460	1804	chrome.exe	115
PID 1804 wrote to memory of 2472	1804	chrome.exe	116
PID 1804 wrote to memory of 2472	1804	chrome.exe	116
PID 1804 wrote to memory of 980	1804	chrome.exe	117
PID 1804 wrote to memory of 2100	1804	chrome.exe	118
PID 1804 wrote to memory of 1992	1804	chrome.exe	119
PID 1804 wrote to memory of 892	1804	chrome.exe	120
PID 1804 wrote to memory of 892	1804	chrome.exe	120
PID 1804 wrote to memory of 2740	1804	chrome.exe	121
PID 1804 wrote to memory of 2740	1804	chrome.exe	121
PID 1804 wrote to memory of 1136	1804	chrome.exe	122
PID 1804 wrote to memory of 1136	1804	chrome.exe	122
PID 1804 wrote to memory of 4476	1804	chrome.exe	123
PID 1804 wrote to memory of 4476	1804	chrome.exe	123

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Source\Includes\AutoIt3Script.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffedf83c728,0x7ffedf83c734,0x7ffedf83c740
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,2075797172758257067,382232811219877361,262144 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,17686006518335362632,16846933165093823477,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,6132692725403841162,15499040295111691300,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,5838348385727063356,4735764635918020087,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,140060896284193701,13214873554708381723,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,7148090538057862250,9132777025877193502,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,16815499582608227116,16698555252294139612,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,8984614520061241483,10017323321403819059,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,15316525713679146748,18366788978191200582,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,4022287879978890881,13439980312911408023,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5908,i,17284998341305643651,3514026322235893924,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3368,i,7664835240310992524,11642253380411664488,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,11724923002666986598,9783453877123526741,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,16049177283586758371,2902196057910006552,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,12134882302545983042,14920228056510475746,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4892,i,6101684036155185704,7229463919216595745,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,9786234900641676739,1568162223668191928,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4556,i,7588677085480511625,140038516883066583,2097152 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,12747931584940489854,6304269450277035042,524288 --field-trial-handle=2068,i,4484113278477416278,15275698124248347470,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85fd0f6494556ca38797d991d5a6214acafe1fa9ba7c63f663c0b8f105174079
MD5 228cfb64381ae00423319434d909e2dc
SHA1 a82f10b9fffd4151dcbe6efc92f8f5e7de41e774
SHA512 be2ed3e5dd27a59d2b49238c34a7a2651945ec3ff51d5b7a91581cb9c54c575c3bc7a1e1373ad20491491a8fa1841e5556d96b30cac00e42fc1ed70db27b345e
TLSH
T1EBE02BAAC861FC2709FD5B2834114645E75013563F90C80F3B3E820C8FB5A3A8166D6D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 510c51d2b63ef7c428c1a759694def6e167b8406322002faf69f2f67a2a12b56
MD5 022e5ab814c581d6cdbff5dec0070d38
SHA1 754c01736a2a5a1b09e8c78a0dfb6866fa7f2cb5
SHA512 ed0b9a5fa044569934a671bed1f7067eb469f397f282f98db0a9dcd4e8e5e288d5a6fd5df6bb7070d2a68f5577d5ff0dea7eee1ad10e0f03fca2a00017f06019
TLSH
T14CF0973661DA4043FF680D7809F9CB3F9AB10FE9070723299B04A698201A2B1F1CAC86
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 97ff7732622fd6202522189c2e0d556b850e79aa5546999767958a35a32e7980
MD5 66cfa0c5782e6c9e56479380d36a9228
SHA1 541b66288df64989540ba4782eac96bd22a32f11
SHA512 4203aced8a3b313675da0c3fe31f250f48c8579c9d311c8eabfc71181b611de001041b065d253cdadef0e36f7bd9c1bb5854112be4d17339700d59aadc37c12d
SSDEEP 192:7RxcBzuD+mUjHZIv7cpAPRp2qF0R9BHsb+WNnW9rKZe4N0Zkw4m8MVyIsnAUgraJ:7Rxmzu3uUwUXl6rwwgegCWoe
TLSH
T13652D72AB92029B75DDAD229FD127B17E7F5202225C42EC4F6FC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e67bafd0547246bbc62f957886d3db31294a9af5aa67f943bc1a226569fca8f5
MD5 f66564de8b047d565290d2ae6b1fde65
SHA1 a1bfd0c5350c7f743e40c74d9164a28dc6044c45
SHA512 4b8381f65389747f13b78ede7774dc648cf6a021fe038f01f5b8d5c7d49922c7880236ef8e266e784c630d2a898c121293910b9a83afab8108fa67eb13f33fcc
SSDEEP 192:7RxcBzuD+mUjHZhv7cpAPRp2qF0R9BHsb+WNnW9rJW2qN0Zkw4xMVyIsnAUgtaJ:7Rxmzu3uxwUXl6rwwE2OCgo8
TLSH
T19852D72AAE2029775DDBD22AFD157B57E3F5102225842EC4F6FC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8aa768fac1f0f90a91eaed8ddeff091becde38ba3cddacfdb38561c1d132bd37
MD5 2378d8763fc0e2c0e0c39e1ab87f5681
SHA1 73943fa8cb2de7ebceed0a20dcbd8e79e9eaf762
SHA512 48e754875d3f3b595b9e6461f79058ce51ec0cb877bced1f0a129fcc0aa0b2a51c91a1a099fde078a33ab3dd65bb871b1d874d362fcccfe8e0d4a4de1f568f97
SSDEEP 192:TRxcBzuD+mUjHZ7v7cpAPRp2qF0R9BHsb+WNnlaWKZefN0Zkw4m8MVyIsnAUgraJ:TRxmzu3uDwUXl6rwABeVCWoe
TLSH
T12D52D72AA92029B75DDBD229FD167B17E7F5202225C42EC4F6FC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42764b3b050248a3d5d52cc763db2e75b6039eea7d222d23b083f4b890de4242
MD5 08175f24b8f257fb4b831649bc16e10e
SHA1 2f30bbe7eb9dad6c449d64a55a8832957716cdf6
SHA512 10d1e1769107b9dfd91288b7a2ab65baf3b67ae8947c69c4f4e3a1d803ebe6d80fcc1f3d69ce37a76573d29b3f9fa7e2e7f8181273964f7cc8ab854b888b9328
SSDEEP 192:7RNuD+mUjHshv7cpAPRp2qg9BHsb+WNnqp0hN0Zkw4xMVyIsnAUgtaJ:7RNu31xwUXlgrwk0jCgo8
TLSH
T1A542C82AAE20687B5CDBD229FD157B47E7F5102235942EC4FAFC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2631cf320ab3b7cb21f04afd6b43ad07a3fc86057623329a45a0808729faeb1f
MD5 bd64a98e649ebda965a724d5c444a962
SHA1 8e1727f36ecdfd6087ad59b1b214b3280c05e82a
SHA512 623e4640e3bf60320cd32fe3e6fd10ca2fd50168e62460e524a2af10a4a42a123e89f542004bb726e0e26f292b4f6cf11a3d7eacb19375dd2e4175f9427c3d51
TLSH
T145B0125080015102C49302B01253189871245F10D60A170293E0AD23C835161C028050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0675.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b0675.TMP
Size 96B
SHA256 f9080bfcf3321cdeb8c86c67069f904c174b2444ee5deb8d20924aedf0a83007
MD5 c7f11ea26634f4ef65d7586f221177cd
SHA1 39b1e4a505a250b9abb41f85f57531faa86aabf1
SHA512 cf15c77c3eee639867d62735580ea5fd627822228363071725780985bb0ce5dc8e1ec2a5cce29b4aae51e9e644c3332adae2d0653620ae37fe1db97082191dd9
TLSH
T1E5B02200C0022202C02303B0A3CB88C8B330CF38C2030222A2E00B22CC28330002E028
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 a18a3ac4417010f8fac6800bf7e082dcf8d37545e30cc271352c963ed718d464
MD5 4b44c1fd877e8a0b1128b36cb214e293
SHA1 1c0fd5554e85174a5706b747f90bd249c39ed90a
SHA512 89193ce994ee3acf6092f0b9c17b62ed6942982a76e1ba2c24c0f95eb55bbf0b66f20d22b3896260b6c32c8eb78c4c53289e26b8563cd67694c71ab2ae75191d
SSDEEP 6144:Xmg1kQfATCFbzQACjPFmUi21rSm8uUVNSlzY/:LneAqfi21b8j8zC
TLSH
T1E33423099EF15DF66F09105032C62E74EAE84F52CA928E8443335BE25EDF6C71B8B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 388ea447ccb7841a1ba834f485521bf9d63e9ecd5e3cdea373e5f4aaf0e591a3
MD5 9c46d11fdf1cbffbf89245588fb01feb
SHA1 a9fa75f7dcaf31df0341c5f9535f1c6f7ce8ba95
SHA512 40ca345c631fb456b6b771fa809e749742c03df2155fd98a195e39cd8c4df84c50144f2bbd0b5a2b669a9f0b95342b4ccbb12816848a0077aaa3e06ccafbe790
SSDEEP 3072:SyFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:bFmUi21rSm8uUVNSlzY/
TLSH
T150C3130076E3E8F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 13173699b964798e441160ca744e475172b4836be2e032897b385da25e22a20a
MD5 025b39364ac6a7e8732950effdc6a823
SHA1 0e3b5b71b774b75b92fe8f4fbfa58ce552c228e7
SHA512 0e95fcc64a55894d732d63b92dec94bb1b21302b9361da197c82ddac808dd6b155d916fe4a2d18130948d1fd5c24b57f1adf16e914173c2f25c93988f2082135
SSDEEP 6144:6mg1kQfATCFbzQACjPFmUi21rSm8uUVNSlzY/:KneAqfi21b8j8zC
TLSH
T11C3423099EF15DF66F09105032C62E74EAE84F52CA928E8443335BE25EDF6C71B8B935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 371a17df9aed78b8a3681072d85fc9fdde88dd1db7793396858713a73f3c69f0
MD5 0fca87b31ba3b820c1d99dd71a252c00
SHA1 fc2ec77186f0b950bc2c07bc80e9161f7a1f521b
SHA512 7eddebb2e879187e73aae3cf9bb97c2f7efcc4876bae2e964c087504cc80f1a8fa10e22fb2f20f7bea86e06206ef95e2784a1f700a46bcb500b7fd5fcc9d09e0
SSDEEP 6144:amg1kQfATCFbzQACjPFmUi21rSm8uUVNSlzY/:qneAqfi21b8j8zC
TLSH
T1F63423099EF15DF66F09105032C72E74EAE84F52CA928E8443335BE25EDF6C71B8B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_opok3pe0.x0e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opok3pe0.x0e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1364-1-0x00000200BA730000-0x00000200BA740000-memory.dmp

Download

memory/1364-10-0x00000200BA730000-0x00000200BA740000-memory.dmp

Download

memory/1364-6-0x00000200D4E30000-0x00000200D4E52000-memory.dmp

Download

memory/1364-0-0x00000200BA730000-0x00000200BA740000-memory.dmp

Download