b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82

Resubmissions

05/07/2026, 17:51

260705-we8vasew4v8

05/07/2026, 17:49

260705-wee7zsew3y8

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrytalTempCracked.exe
Size 1.0MB
Sample260705-we8vasew4v
SHA256 b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82
MD5 3bfcf3f9ad3c0ab57e1f7b5875f6c3eb
SHA1 505f34642d30e28a0d4ab25cf2ddccbd5d8efb90
SHA512 776e431497341199c625646f26e72e7f13709d8f7e6f5f9cf5470e84e6e903d68e4920bc904066436b3ca41d82a2e46fcd182866a396672893f0c6241fa8a084
SSDEEP 24576:p0sBpxxpwjJYZ6S/6alOjYDE/dMgAG//U6X8OgIb40N6TVxbz:p0sBvxpwCPpOhLAG//U6X8OgIbdN6bb
TLSH
T132358D5A67B801E9D1BBD17CC6678607E7B270491330ABDF02E086A51F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pcFDzEtCQRd\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\pcFDzEtCQRd"	CrytalTempCracked.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GYMKVtROUhYD\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\GYMKVtROUhYD"	CrytalTempCracked.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	api.gofile.io
2	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277475871421918"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2944	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
2044	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
4060	CrytalTempCracked.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2044	CrytalTempCracked.exe
4060	CrytalTempCracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	CrytalTempCracked.exe
Token: SeLoadDriverPrivilege	2044	CrytalTempCracked.exe
Token: SeDebugPrivilege	4060	CrytalTempCracked.exe
Token: SeLoadDriverPrivilege	4060	CrytalTempCracked.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 3484	4060	CrytalTempCracked.exe	81
PID 3484 wrote to memory of 1120	3484	cmd.exe	82
PID 3484 wrote to memory of 1016	3484	cmd.exe	83
PID 3484 wrote to memory of 4348	3484	cmd.exe	84
PID 4060 wrote to memory of 4560	4060	CrytalTempCracked.exe	85
PID 2944 wrote to memory of 4064	2944	CrytalTempCracked.exe	91
PID 4064 wrote to memory of 4340	4064	cmd.exe	92
PID 4064 wrote to memory of 1544	4064	cmd.exe	93
PID 4064 wrote to memory of 2076	4064	cmd.exe	94
PID 2944 wrote to memory of 3112	2944	CrytalTempCracked.exe	95
PID 2944 wrote to memory of 2420	2944	CrytalTempCracked.exe	96
PID 2944 wrote to memory of 4016	2944	CrytalTempCracked.exe	97
PID 2044 wrote to memory of 228	2044	CrytalTempCracked.exe	100
PID 228 wrote to memory of 736	228	cmd.exe	101
PID 228 wrote to memory of 3508	228	cmd.exe	102
PID 228 wrote to memory of 3380	228	cmd.exe	103
PID 2044 wrote to memory of 388	2044	CrytalTempCracked.exe	104
PID 2044 wrote to memory of 1416	2044	CrytalTempCracked.exe	105
PID 2044 wrote to memory of 680	2044	CrytalTempCracked.exe	106
PID 4060 wrote to memory of 1904	4060	CrytalTempCracked.exe	110
PID 4060 wrote to memory of 1472	4060	CrytalTempCracked.exe	111
PID 1976 wrote to memory of 3916	1976	chrome.exe	115
PID 1976 wrote to memory of 3840	1976	chrome.exe	116
PID 1976 wrote to memory of 3840	1976	chrome.exe	116
PID 1976 wrote to memory of 3740	1976	chrome.exe	117
PID 1976 wrote to memory of 5004	1976	chrome.exe	118
PID 1976 wrote to memory of 5004	1976	chrome.exe	118
PID 1976 wrote to memory of 676	1976	chrome.exe	119
PID 1976 wrote to memory of 1704	1976	chrome.exe	120
PID 1976 wrote to memory of 676	1976	chrome.exe	119
PID 1976 wrote to memory of 1704	1976	chrome.exe	120
PID 1976 wrote to memory of 3412	1976	chrome.exe	121
PID 1976 wrote to memory of 3412	1976	chrome.exe	121
PID 1976 wrote to memory of 1720	1976	chrome.exe	124
PID 1976 wrote to memory of 1720	1976	chrome.exe	124
PID 1976 wrote to memory of 132	1976	chrome.exe	125
PID 1976 wrote to memory of 132	1976	chrome.exe	125
PID 1976 wrote to memory of 388	1976	chrome.exe	126
PID 1976 wrote to memory of 388	1976	chrome.exe	126
PID 1976 wrote to memory of 236	1976	chrome.exe	127
PID 1976 wrote to memory of 3900	1976	chrome.exe	130
PID 1976 wrote to memory of 2128	1976	chrome.exe	131
PID 1976 wrote to memory of 2504	1976	chrome.exe	132
PID 1976 wrote to memory of 4284	1976	chrome.exe	133
PID 1976 wrote to memory of 4284	1976	chrome.exe	133
PID 1976 wrote to memory of 4928	1976	chrome.exe	134
PID 1976 wrote to memory of 4928	1976	chrome.exe	134
PID 1976 wrote to memory of 400	1976	chrome.exe	135
PID 1976 wrote to memory of 400	1976	chrome.exe	135
PID 1976 wrote to memory of 4916	1976	chrome.exe	136
PID 1976 wrote to memory of 4916	1976	chrome.exe	136

C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe
"C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5
    3⤵
    PID:1120
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1016
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe
"C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5
    3⤵
    PID:4340
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1544
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4016

C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe
"C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\CrytalTempCracked.exe" MD5
    3⤵
    PID:736
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3508
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae00c728,0x7fffae00c734,0x7fffae00c740
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,5974170702489876081,9466507148765844584,262144 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,7146212453864274113,8468133525593496916,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,278281400032887952,11412540628650744038,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,13233590578220060461,13297399769406981788,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,5487029648655001650,15211313687372025117,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,6068151017136200476,6839895103229590840,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,332014275510867711,1652522338420209747,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4268,i,10504940124814836589,5411346152221954382,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,7100698441233148798,3894954398321471490,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,14741649124397689378,2568764711897260172,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,10370323711600346567,2529311232194531119,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,10886959119642923928,12913278948796607698,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,7548203935078404028,1046003420700728487,524288 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4300,i,4744925987079910759,8361176845259794810,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4884,i,999326486334121457,18129552298814488206,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4796,i,8100236008250811637,18343284621109173570,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6068,i,1389764752542423745,17844392583597743190,2097152 --field-trial-handle=1980,i,3459745772750810389,14969982968219656676,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 66addb6769c6456690a39a4d2cf31b86db65b27262c38abb72368258a347525c
MD5 959e17934c1aa7cd40bb7c3efdb656bb
SHA1 43b2f81616e71e3ac7fb61d37f0b0904ac72d7c7
SHA512 7d6ef42c565945ba1c8ace8a6cc537e5f3ae9d26b3550082cd25c09fd5fb08eb526a37721ed710d17511c73952f550f81248fa4f2123ceb135925ef69fbeb448
TLSH
T178E022AADD26EC3B18FD2B29A0504787E79013672790494F3B3C920C8FB163B4586C9C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddb087bcfd7bfebaedd39071677a22a3844c6329743fbbf3a5273b96500be615
MD5 22dc5d67e70626ffc10cc9a9d31a192e
SHA1 656a942b9078ea2f2f7dd31d279c44fe1e1dd61a
SHA512 03e314fa5e1e5af6633a03ff57f3340e054e805d876426bef2ba9368cabe4faa1c98408539a3f72c408eb71be103260adf42287099e2d76fa8449ebc623a6545
SSDEEP 192:MR/w1O5X+3dyYGfev75hAPRp2A98Hsb+WNnvc0kkLBgzag6QpVyIsnAUgtaJ:MR/w1EO8YGfaV8XLuw00tLca2P8
TLSH
T18F42D62EFE146A7B5CCBC219F921776BD7F5102125A42E84EAFCCA2C15E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bf42140235b07d897ea5a24ea673cd356dae308247a3105e8d2b1a64553b994e
MD5 8e35de2247abe85fa606c04e71f47179
SHA1 bf450eb556e1d119c306c51127cd8972079f5eeb
SHA512 eacb809edbc8d7a849f99a845b195b07ca40e302f0e79571398e3c51d37cb8c90bece7c040be156c5615d154e9c90fd55dd530e3f246aec02b4e3687ecd2ff6c
SSDEEP 192:MR/w1O5X+3dZYGfev75hAPRp2A98Hsb+WNnvc0kkLBgzag6QpVyIsnAUgtaJ:MR/w1EOXYGfaV8XLuw00tLca2P8
TLSH
T11842D62EFE146A7B5CCBC219F921776BD7F5102125A02E84EAFCCA2C15E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9bb40cdb91a58d7b7d0661e83b4e9d14bcfc974546effd0eaf4b60eddfe8fa55
MD5 114cfb134bc08e1ba0c2e47ec1bccd4f
SHA1 d5f0f685a25d94c4ee83ef52a6b5dcbe333ddd9d
SHA512 64258a98809c6d36f0c41fc0296aa13e95a9f434701046fd245ab5c47b8fc03ecdd2ba91927fc7db4f33a8afb2569e77563842c329cd24eb57316a1a0d664337
SSDEEP 192:MR/w1O5X+3djY3ev75hZPRphmlK98Hsb+WNnvc3XMYhkLBgzag6LpVyIsnAUgv7K:MR/w1EOpY3aV3XLuw0MYWLcaJPvO
TLSH
T17152E92EFD146A775CCBD219F9217B67E7F5102125A02E84EAFCCA2C15E76CD121701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 06c69dfbcb0ced79fdb8b90772523601d3c691fce9daf03d2db0d8432df58845
MD5 e7fe106eab902f7a410f06379c0f1a37
SHA1 0e897bc21d23064c88f1b1d58f81282ac70bd603
SHA512 c852e66da1e9b2e09fba8685a084142423395d3707008ff6cd71602c3a584aa4cc0967a6447e446bc18535e1651456e9f97c23bde5bb14c0efa7e54eaab10ad8
SSDEEP 192:MR/w1O5X+3djYGfev75hAPRp2mll98Hsb+WNnvc3SJWWkLBgzag6ZpVyIsnAUgvO:MR/w1EOpYGfaV8Xhuw0YWfLcaXPvO
TLSH
T15C52E92EFD146A7B5DCBD219F921776BE7F5102125902E84EAFCCA2C15E7ACD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4ecff737ab3a52b127eee879715e399837a91f357a1bc9e6b8b00dfa9ad7a76f
MD5 c4e969de7f155e4b3fcfdafd85ef8e4c
SHA1 d29bdec8f86bcd8afa0205e281ad7b09aeda2272
SHA512 4c47b3a7b54115a3836138a42fc7e4d3607d15b49ab3485fd2ff70449bd94fff25609d1a43da0eac116d1e75ee0315e10f786a1a1fddede388ff4875459f51d4
SSDEEP 192:MR/w1O5X+3dqYGfev75hAPRp2mlp98Hsb+WNnvc3QX2skLBgzag6ZpVyIsnAUgvO:MR/w1EO8YGfaV8XVuw0o2FLcaXPvO
TLSH
T1C452FA2EFD146A7B5CCBD219F921776BE7F5102125A02E84EAFCCA2C15E79CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e889a8a2850297e739bb5a92ad227860a5d3406d1c944daeba068120a060ec93
MD5 dad2235bb98ae49b53c1e13432978939
SHA1 b7a4458b702a3eb9be00ab0612edddc4e035590d
SHA512 345bff741c3b5fbc4e0bf2f308c1d0ca4fe62201276c395aaf9db351fb079ff19dbdb203a393b4a4d38aa91ad9c34fcccfcd749ae1efb44053e7ebefae460055
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLkdLcSjwxXODuh+ErU37kHwa9NP:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pb
TLSH
T19C72F9677C4C8E770F94CACCD917BF4FADB5024A65E9886482FA9C2503D5ACA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d0a1f3038d18c9a447bbc68f90b08bec3d2e71b6093131d5386b55151f1e6272
MD5 9b7781498ae72a4d397a86bfd8725df3
SHA1 ba79047eae36818e5643ec735758231d7884e4d7
SHA512 fd5d830591bcbcbc0a903f4972020b7b51988aea643420c69deb1238846d4922d2885abf00a2143ad69b58146efcf50136bb2da317ca08c5bb9758f3742ff164
TLSH
T1C5B0120180025911C48202F01146149871645F10A60B170143E0A922C836271C834051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aae14.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aae14.TMP
Size 96B
SHA256 3658a766b0ded48812025b625b956404f14d502b0edf2b443667f2384d6fa88d
MD5 65d12256beb80052001795e51d7b8b63
SHA1 b6f8a3dadf79e626cf085ade347f1f8d1907f7ec
SHA512 239f60e9105b0a76b1cbbd7c4dc4919ba20a1e6d4459bd6b478f0d507697ec34e8255f885be352e73d0c31b2c83e2f6ff3dff6ea1957683014bb9c447f910945
TLSH
T186B00296D1026613D0831BF125FA95D971B0EF76C703622296E01AE6EC256718927161
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 689b23e044a9c9739c57686745ed7172475a25356313f9b84c30492448aca760
MD5 753c900157a083c4cc129146da42ed5f
SHA1 680fcd78d99429922fdeec386c369efcc62b08e3
SHA512 5a163402f6b3eb0a19e4ac9022890ce0ba42c611158e237a7a39284763f779c440d7db711fecbba768bd96b6070c9f4f7bd9645d419c81bd6075eac946261c54
SSDEEP 3072:sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:fm7Rkm1tYpBeh2BAoF
TLSH
T158C3123B5D70A97759B8AB4EB08E0B1E1EF149A6C930DE92C8D85B0477FA7CC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0d80eaf790522690e0e58a08ddd2c7106c85a00416afd460dff0e26e0d1f8419
MD5 0123a7805dfa7bf8c9266f6945cd8ec9
SHA1 b49eba8515fd79da0f543f7a2895961a25b8a80a
SHA512 f8a93d5ff674215ecef05cbb45a9a4b1ad926d7cc0c89bdd79152d4159f4b7fb1307a0cb75474fe7ebe96e6b77387f84a3eed206a09ee8fc5e8925959c40adb4
SSDEEP 6144:4QP8pYw80nubFS/sBNxTm7Rkm1tYpBeh2BAol:4QENBUDZi9oBGcAol
TLSH
T1943423173C919E7BAAB9BF2DB4021E1F4EB14C65C920EED6CDC49F4872A434D1A489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9aab46b48c02129c1f79d0874b04979a0040d0030d9c7f89c7432c722cb58301
MD5 78b980a9b41499e8b69af875f1797fe2
SHA1 12749d711b0481d2582d58f15585b197b6d270ad
SHA512 8c4dfdf6ee4ada993ad609dac0b2ac67d9fad7f02bc14fde2b2d005c2a6241d27a25e499ff9f44270aa833c7dad4f174cd87b7831c1f358fb74362ab1cd2ccdf
SSDEEP 6144:HQP8pYw80nubFS/sBNxTm7Rkm1tYpBeh2BAol:HQENBUDZi9oBGcAol
TLSH
T1893423173C919E7BAAB9BF2DB4021E1F4EB14C65C920EED6CDC49F4872A434D1A489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download