565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample
Size 2B
Sample260706-1a1eksbx2s
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4332	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278468777589784"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
3340	chrome.exe
3340	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2040	4564	chrome.exe	92
PID 4564 wrote to memory of 436	4564	chrome.exe	95
PID 4564 wrote to memory of 436	4564	chrome.exe	95
PID 4564 wrote to memory of 4332	4564	chrome.exe	96
PID 4564 wrote to memory of 4608	4564	chrome.exe	97
PID 4564 wrote to memory of 4608	4564	chrome.exe	97
PID 4564 wrote to memory of 4280	4564	chrome.exe	99
PID 4564 wrote to memory of 4280	4564	chrome.exe	99
PID 4564 wrote to memory of 4984	4564	chrome.exe	100
PID 4564 wrote to memory of 4984	4564	chrome.exe	100
PID 4564 wrote to memory of 4456	4564	chrome.exe	101
PID 4564 wrote to memory of 4456	4564	chrome.exe	101
PID 4564 wrote to memory of 1404	4564	chrome.exe	102
PID 4564 wrote to memory of 1404	4564	chrome.exe	102
PID 4564 wrote to memory of 3376	4564	chrome.exe	103
PID 4564 wrote to memory of 3376	4564	chrome.exe	103
PID 4564 wrote to memory of 3144	4564	chrome.exe	104
PID 4564 wrote to memory of 3144	4564	chrome.exe	104
PID 4564 wrote to memory of 4404	4564	chrome.exe	106
PID 4564 wrote to memory of 2160	4564	chrome.exe	111
PID 4564 wrote to memory of 2160	4564	chrome.exe	111
PID 4564 wrote to memory of 4656	4564	chrome.exe	112
PID 4564 wrote to memory of 1560	4564	chrome.exe	113
PID 4564 wrote to memory of 2032	4564	chrome.exe	114
PID 4564 wrote to memory of 560	4564	chrome.exe	115
PID 4564 wrote to memory of 560	4564	chrome.exe	115
PID 4564 wrote to memory of 772	4564	chrome.exe	116
PID 4564 wrote to memory of 772	4564	chrome.exe	116
PID 4564 wrote to memory of 2192	4564	chrome.exe	117
PID 4564 wrote to memory of 2192	4564	chrome.exe	117
PID 4564 wrote to memory of 4120	4564	chrome.exe	118
PID 4564 wrote to memory of 4120	4564	chrome.exe	118
PID 4564 wrote to memory of 4800	4564	chrome.exe	119
PID 4564 wrote to memory of 4800	4564	chrome.exe	119
PID 4564 wrote to memory of 4260	4564	chrome.exe	120
PID 4564 wrote to memory of 4260	4564	chrome.exe	120
PID 4564 wrote to memory of 3340	4564	chrome.exe	122

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
PID:1100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbe305c728,0x7ffbe305c734,0x7ffbe305c740
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,9249714642643561792,4612864845551714379,262144 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,727863342681304849,1879380283494147804,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,15023198966440241624,9575711661377694351,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,15503121966405181916,7339973267808555011,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,8993497173090633778,9805919106331556047,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,3333774643400801340,3016749754695167125,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,7350924248270697870,12879907228439848024,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,16117981070665122211,348921500122340689,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,17564671320605447885,3789837047175858409,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,10186621336786468932,2353228237194465896,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5980,i,17666117184757524533,18352557176121230272,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3428,i,1955050939726330795,11602228969372709960,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,15171520121248409878,11647544378942286411,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,7379455446111387761,17368686107525294683,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3328,i,18013321862503277689,13258796529661786841,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3448,i,7957988412161321214,5233520843171929066,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5852,i,8236763956048628171,15981350011035673983,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,4119367657294466354,7886402242199889963,524288 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6372,i,12640851726956876232,16106617257238112853,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6608,i,1696506265868216180,6143141501616145034,2097152 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3372,i,9147418295669088399,1691281536660272015,262144 --field-trial-handle=2020,i,2893394524564761403,14500068657806697057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9732dc16-e6e8-4111-a689-df2e92615d4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9732dc16-e6e8-4111-a689-df2e92615d4f.tmp
Size 115KB
SHA256 af89d2c38ed33c0cdccc7074410f9a0e26fb28bd816a84bbd7cb70de830cf359
MD5 5703a09dfb0374e42622b9b2cf6b3cba
SHA1 a0eb119897452bd24b43efbd209c2815ce09b291
SHA512 bfb633d301ca531637999621fff79287bbc0906fd6d83e9feac23c910bfa1fc881d818d982c9260f9d26722c9df13e5fdf298d4b0f819489b03a01207291b393
SSDEEP 1536:bnLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Rqfd7NtZL8cHQRZEQ6Sps3
TLSH
T14CC30237ABC21F339D92CF64B9530FD6A7B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b41d7425cb3bed8541d9a12b1f534979eb5dc2467172be9e5524692ea22c580a
MD5 9fcc092ee6dd5a27545f69776dda0c7a
SHA1 74372b8e418953626fbd45ffe9577c2dd791a426
SHA512 e749cfc20c0ae762d41284fe42e1311cbcb44c8f7f2d7b2d23511353df7057b485a3493c0e1423ca8dc0a5548458fe882311a5a2598008a45b3e58d715f4413a
TLSH
T15CE02BA5C861DC2714FA071DA4141782E794135B2B40994F7B3C820C8FB1A3A4986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 e0f6fdd400386d6dd395c10166f9f8b920f17af9b879ceebdc108a1f304598b5
MD5 ded6c19dbd6712af2b3b4f4c6a1e25ff
SHA1 1f904e462eeaf676055068f8b1a8848c483d4af8
SHA512 4a5fff573321903ac01cac57fee10383070c8461132b6b36d4f793cfb29d0c95dc496073543fb8474742fb43958f39554a41950d6a4420255444030e6cdd1673
TLSH
T1CC018B3D92C118BECF1591B436CC0DA021300C68848E8762896F5E3D74EF2EC0793019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 13217e2bb52e96c098b49cd969cc4b85ccfcb1060aecba3570449c12e5a2eb3f
MD5 30266c9ac7360fe138a6dda56781e3aa
SHA1 0489409b46fe81e578658cd6b136dc6a8c056745
SHA512 9c142371df53201666126a4d36b41c42c9457a0e690d52a27a1c9dcd43abe19a90d9b83b0f44c107abf9d87d7de42428847e810c375e6cebe7560ba4bfc333d0
TLSH
T17B01247C92C228FECF9995B436CC0DA021340C68848E97668D6F1A7E74EE3E94693468
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 47c2b99de3fc30ebb5b995cec9e7cfc1e3a107eb127e6bdb1b6f5dda6046e356
MD5 070d0659ff62bd6a5c3f06d42bdfab2c
SHA1 9756060c1c3dc200ffb06e3b6016709ae53b56b1
SHA512 6f1920542965a367b53a03fa70d0362281520b48c8e8d4459d96024b61c164a529e920a46565dc599a96c65007e3e62e453e9b4d1dd43018201c2738190c690a
SSDEEP 384:DJhNH8rdMFJkNeERJQwzJ7JtAaIoAGJZSZ006GFo1JaOsPOeGEBTlhvTenwTMtzN:CdYZCXkC
TLSH
T10E6258E3C3D58D2ED81225F5AB25AF1FCD1D1A18433C3D1A8DD8AE4A93E28A4D21165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 dec51cd5f450f36cf24ab28c419e13926e838c8a6cc9ba8269fa21c8581b95f5
MD5 7b5646f914615944bc0e8af4a25b5afa
SHA1 ef405c99991fe2a4753812d3da779c7e3e8ded54
SHA512 cd53a1b7ebb4014b804a29376457a67347b241571ff29f8e94a8c5b9ff0292b09ada8cb5f2fd6399e07ada806f8c18b62241012de4f544e2b85b4de815d1d0a1
SSDEEP 384:DJhNH8rdMFJkNeEpaIoAGJZbmZ006GFo1JaBabTPOeGEBTlhvTenwTMtzsbEh7jd:5ZCXd
TLSH
T11E4268E3C3D58D2ED81265F5AB25AF1FCD1D1A18033C3D1ACDD8AE4A93E28A4E21155F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3f80eb23cb70b8955c395adafe35d627496285d8d08fb386b66bbf5cb514b705
MD5 dd527ff934708bf928bcf705ed21dee8
SHA1 6515d79b2a96f71a1d29a461365990f505eda68a
SHA512 3f89e91ea3c829d9adadce98f66af6761ba7af148f0ce319896fd84ce1be07d54328b4c2a6f6271d9cbdac1f034cd3aa8a8991498433debdc7f828fbe0af697e
SSDEEP 192:CRP7/ckU1jVLPv70pAPRp2dj9+Hsb+WNn1y0LauL2KykwiYVyIsnAUgtaJ:CRP7WZLHgUX68wA0euL2Kyb8
TLSH
T1D142953EBA10697B5CDEC219FD617B53D7F6102236912E84E6FC8A2C15D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 12c57ea34494fa7cedb1db8cc5bbc501421e4bf43da3e730fdf8e9cfd00957f1
MD5 90d322bd3b2c0d3a082ad60d0248dee3
SHA1 87289a1d92b2a5eee10e19b3e66023ff88766186
SHA512 c539f1e227f8c380f16ccde51ff009dcaf581b8388e4778004c4b4b5bc4ef4cb89e972d97a51315cbc71ecfe3ad71ae41be9cb30252083f1c3cf5337c8ef73fb
SSDEEP 192:CRP7/ckU1jVLfv70pAPRp2dwdk9+Hysb+WNuQ1y5Ol2xauL2KykwiqVyIsnAUgrK:CRP7WZL3gUXS8VEC2kuL2Kyde
TLSH
T1D952A63EBA10597B6CDED619FD617713E7F5102226912E84E6FC8A1C16E75CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0fe1c10e8aa73c57ed52507777451304213704abcc3af89c2a3bdc4f9129e3a3
MD5 f753cd36bd626bdb07e986c68a703c60
SHA1 e14540a7fc6c57dd80c5d423a98204f11fe42cfa
SHA512 9b62bf747f38e15815c3e4504f1561de03d15475eb3f2667941cb9886fa540b783f743bcde844bdc9c4aba55a8314ca888d1258de333718bfa66c5af9b329bb0
SSDEEP 192:CRP7/ckU1jVLqv70pEPRp+dwdk9+Hysb+WNuQ1y5Ol2G3auL2KykwiWVyIsnAUge:CRP7WZLmgYXa8VEC2GKuL2Kyje
TLSH
T1CF52953EBA10597B6CDED629FD617B13E7F5202226912E84E7FC8A1C16E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b75610de64f1d76db18e3a4914dd0c3138319f66d07c77aa764facd130fb19da
MD5 aecc31db1c0d5ffc37afaa97ee64a942
SHA1 3c35829685a95bd611d001b0ba3d73b5390fb3b3
SHA512 1b95c228773a89601ae4515b073061b7d45a7816990fe8f6e2eaec1fb673663f6d824da19d5834b723f17d737a2f5331300a9444f67231a9e9483c4e52a0cb49
SSDEEP 192:CRP7/ckU1jEPv70pAPRp2dj9+Hsb+WNn1y0LauL2KykwiYVyIsnAUgtaJ:CRP7WgHgUX68wA0euL2Kyb8
TLSH
T1D242953EBA10697B6CDEC219FD617B53D7F6102236952E84E6FC8A2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7227aed9e94c9dbb0dc471af92a508e5773b92f57ab610f27a090a7bc541af59
MD5 0c1fe774c3930afe071dbce6145566be
SHA1 edfb93901998a34a5cd230342deb51ed3e1e5eb1
SHA512 f294fd3f4e1c1287bd5534138ef01b857fb24d4b29401d5f97201cda65027e1b49a3b900c40775a8f66b30fb528276f2aea18ec3a90151c1427297c95df226f1
TLSH
T170B0125084416102D44202F41687188971589F14960A170583F0692398366508115050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abcb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58abcb.TMP
Size 96B
SHA256 c5bf60fb13c051d034f4071ad807a95a3917a4a018f2086e9b3feff51ab326bd
MD5 33d4ff97825587ca52570ea876c26944
SHA1 7cba982d98524657346dfcfb0f1deac093b60103
SHA512 7fd65471fb624200ea0b4f40f58f32e8fe505a41d1b34fcd054ccb911f6ad205ae87d4eb39ab31350b7a3937b97e47ba47c19b8adb6edf2239174956a3c9ad8c
TLSH
T1E8B02200E2032202C80203B0388CE8C830B0CF32C303020382E00AA2EC2023008282B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c11c874c1a8969b7a1b9dcc36980acd6a423e72c105909e54c4ba65c64a6d78c
MD5 97f9845b4b837bbb32e913d0bc27caaf
SHA1 32916390a709cd16bc38ea31db8567affa1af893
SHA512 faa25334d403160bdc8a5a7a058128d6f164f10c10e0a8d1a236f5289e22fc42b37435a4d5699a139e69421cd07c62dc0be2406106446f6ac40176f3a81c5a21
SSDEEP 3072:eGncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdjqfd7NtZL8cHQRZEQ6Sp4:tcBaj2tiHpCbVDpaJ/v8wmqZ/ZLW3Ex/
TLSH
T199341273AF866E3A9D5AC650B0530BCF63B10ED18070A69BAFEF77DB1943096560187C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9fd486aa7260baeae0f667f485df1b87c873da0ae00cebf3f550a73f8e8b5344
MD5 4660b919925e36e282324504955de2c0
SHA1 aba7aef5cd9099f06ba0f5e47a62498fedcae490
SHA512 8246242108af096f51f8ecdb3e62afdf2cbd4adf7e40b84bf4bcbcb77dffff9710f3ccb745a44b2ace4188f4600744fe45479e819bd466383f35217778b0d923
SSDEEP 3072:TGncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdjqfd7NtZL8cHQRZEQ6Sp4:EcBaj2tiHpCbVDpaJ/v8wmqZ/ZLW3Ex/
TLSH
T1CD341273AF866E3A9D5AC650B0530BCF63B10ED18070A69BAFEF77DB1943096560187C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 339KB
SHA256 af1acae2ffc069d07de36769d1b1c51d15fcb1a32aa2ab17151e5a38a39aece9
MD5 01b178f835368ac2325a13549eceb527
SHA1 3c94bd2f50bf7bd4fad906da9a2d4a81fc2ad5cb
SHA512 739627e39453b2313b4e4f6f317b70d7c5db21bdfbcc1d608de4a8971c5e1341bc1ae87402c072f12b809df65d0aa1dc6998362eaebf57ef9a66d637bd87d843
SSDEEP 6144:ObIamqMNk/p1qmYGfpyxCvZsgyJMcBaj2tiHpCbVDpaJ/v8wmqZ/ZLW3Ex/:OMQSkR1qmYGtv/yJmHOe8VqZ/piQ/
TLSH
T17E741373FE457E268D58925070530FCB26F25ED18434A7AABEEE27AF1B071929114D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download