9130026ee97b873e0a28cc4d39b10c9bdf85d27f794dae2296cb635dad22862e

Analysis

user interaction
yes
max time kernel
107s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kemono Downloader.exe
Size 14.6MB
Sample260707-e4fflshy2t
SHA256 9130026ee97b873e0a28cc4d39b10c9bdf85d27f794dae2296cb635dad22862e
MD5 018058541fb30314b9c76bdf2f940795
SHA1 f8a78777d59dc1ce3fa9ee4f33e340cc3438470f
SHA512 48d58ef055b7977f80da83808f695ff48649ced0a7fc7af13b4c5be3ebd61d50597e04cdb8b8ca4e01c673ce5a049095e18410313f7fbcf9e94c655074f4fc38
SSDEEP 393216:aNViGRx6k0Lp5/rCjcwdjsuANWTKTbEETV0zS+9:aNVlRQt5OjcwRsuA8TKPX
TLSH
T111F63355618070B7EBD202369A9BDE759B63BCD007A3C1CF42A075A06E7B1BD0539FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4700	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278722224793238"	chrome.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.msix\ = "msix_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\蝬꘤ā\ = "msix_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\㤫혴泾退ڠ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.msix	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\蝬꘤ā	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\㤫혴泾退ڠ\ = "msix_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\msix_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1452	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4712	1928	chrome.exe	97
PID 1928 wrote to memory of 4744	1928	chrome.exe	98
PID 1928 wrote to memory of 4744	1928	chrome.exe	98
PID 1928 wrote to memory of 4700	1928	chrome.exe	99
PID 1928 wrote to memory of 4552	1928	chrome.exe	100
PID 1928 wrote to memory of 4552	1928	chrome.exe	100
PID 1928 wrote to memory of 5060	1928	chrome.exe	102
PID 1928 wrote to memory of 5060	1928	chrome.exe	102
PID 1928 wrote to memory of 3500	1928	chrome.exe	103
PID 1928 wrote to memory of 3500	1928	chrome.exe	103
PID 1928 wrote to memory of 4036	1928	chrome.exe	104
PID 1928 wrote to memory of 4036	1928	chrome.exe	104
PID 1928 wrote to memory of 3540	1928	chrome.exe	106
PID 1928 wrote to memory of 3540	1928	chrome.exe	106
PID 1928 wrote to memory of 3384	1928	chrome.exe	107
PID 1928 wrote to memory of 3384	1928	chrome.exe	107
PID 1928 wrote to memory of 2956	1928	chrome.exe	108
PID 1928 wrote to memory of 2956	1928	chrome.exe	108
PID 1928 wrote to memory of 5264	1928	chrome.exe	115
PID 1928 wrote to memory of 5792	1928	chrome.exe	120
PID 1928 wrote to memory of 5792	1928	chrome.exe	120
PID 1928 wrote to memory of 6072	1928	chrome.exe	121
PID 1928 wrote to memory of 6072	1928	chrome.exe	121
PID 1928 wrote to memory of 5208	1928	chrome.exe	126
PID 1928 wrote to memory of 5936	1928	chrome.exe	127
PID 1928 wrote to memory of 4056	1928	chrome.exe	128
PID 1928 wrote to memory of 5340	1928	chrome.exe	129
PID 1452 wrote to memory of 3656	1452	OpenWith.exe	131

C:\Users\Admin\AppData\Local\Temp\Kemono Downloader.exe
"C:\Users\Admin\AppData\Local\Temp\Kemono Downloader.exe"
1⤵
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffebe10c728,0x7ffebe10c734,0x7ffebe10c740
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,2425301140655850869,1984797762138760371,262144 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4372450382624496222,8820537794991797758,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,13094943021524954868,2875035885011503582,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,16208069752256517100,17312517799382351343,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,6906289515879160492,5719102679522896254,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,4123537315051861882,13812782954279830906,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,9403426807019935003,13781192436857914864,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,12815547880822860275,6911118583296496811,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,5916375218248766289,7716833521412764259,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,12874045097273323932,1889420752861007212,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5972,i,5900665388011275717,13269415901851823437,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3956,i,5718534502608014533,16996965945424079107,2097152 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3580,i,8432122720280263919,16421415776888114332,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,730172922209967161,5292224674673624681,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,5375044171837474026,2184170540925001259,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,10115218024487589401,10425092222441012461,524288 --field-trial-handle=2012,i,17965783055299755534,9227285990752313096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\python-manager-26.2.msix
  2⤵
  PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3e1a1536-041c-4ccb-98ab-e4e3b7e21734.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3e1a1536-041c-4ccb-98ab-e4e3b7e21734.tmp
Size 232KB
SHA256 43ff8bf477db333b2841600141623df525f8f0ac721c910ed93a1920a797486c
MD5 422d4e4735399304bddd32890c8aa8ef
SHA1 65ff016ee3f1e52a7ab98c356e805aa430de1e9a
SHA512 651ee0de371470a1372d79d1693fa1c71d33f5bbb443fd6370ce3e5117cb30dc082491659b31dbf925dced761719b961a8bb4975331f8c9971fa1fbea3e9b811
SSDEEP 6144:P39wKn2/yjJX2/T3aBRm7Rkm1tYpBeh2BAow:P39pXq19oBGcAow
TLSH
T1FB34123A9E30FC7A44B5675A388D181EAEF1DAA3CC148F51CAD8AE0423D97C51A85E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c3f9036edaab280c861a89f172b406f89d634a94ffe320c628b3959bd93666f1
MD5 257473ee02d6d526f27f7ca43d8db134
SHA1 c6cdd2c36ad3813ace85149d6a911432658e2198
SHA512 742eace93afca843bbf002e0bf02c1e2b441939ed8d4f6a28c47f48dfe63acaa9ff0175eccd5f36df56bedd0c93630a7f18bf79d5850ad5755bedf513e6bdb90
TLSH
T162E02B6AC821EC3709FD47286115468AE751175B2B80551F363D5108CFB0E3A91C6CAC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 32KB
SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
MD5 b582b2eca79a750948dbb3777aeaaadb
SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
TLSH
T143E2E2F9A6319A3CC9E9F3C983459F40F75EA449A50C11CA70A8FCE465824CD5F7AA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 66KB
SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
MD5 33411bb179575dfc40cc62c61899664f
SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
TLSH
T1706301B43270DBF4E089C49924E62B1CD4D3606FEABF94E4B146DEDD922BC773198848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 991f490aaffa8a7f05055f012193043dccabbbb6d2b852c13c732d168c9cdea4
MD5 356b6c748369791fdcdabc51003baf21
SHA1 62cd57611da1b45466e1f55b793a97465d29dff1
SHA512 c8502a009ab5db89b0d0ce1b0c386209624720312a46af0776d48005b6e5b589a08292bd8a57d9d45bf5286139ecb109ca7c01714c5065b474067102b9037d29
TLSH
T1700144B6FBB309C9CF20423305D47AE63C6416AC020E654F8084C6B398B2A34663352E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 62674e05f98c619459e6a1f841cbec0403ee3aea0ae6c0c2116c6aa6be4db771
MD5 a7367b1082937eb4cfedb3444b12615b
SHA1 1e12566e7c49853677e7295d9151f2bdc05817bd
SHA512 ddb2e89b2bbe55efd1bae89321b8427f543a9129fa35dd111e82a8b1c20f09a21cef6a5bf4d13afaa5d91b2b06118ec5b63dd9c95f0cd9924f10b5ab3c4e46dd
SSDEEP 3:MsEllllkEthXllkl2zE/loms:/M/xT02zy
TLSH
T1584404047FD14C07C50051304051C35013F0DC540717F753347104335CC57410C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 53fe021bd87f4d13357c12fecccbab986c9f3203c32ca97eb716339ecc7ed22e
MD5 3dbafba058ee205fa1fdfb5ac0e7f2be
SHA1 d7f705dd373a06342ee8eab54d7f8f417d044b22
SHA512 802a8979605d2601221824a1d45511e185dcb3f1427feab867e091204e3a105af9967b7a95915e48dc7b466193c3b32406f86091fb57b1e925e7d9efeca6cd07
SSDEEP 192:DhfNRNASuSBSeBC3+BcS/aa+jgzds0+nSItNPCDaPil11H48Lzx:DhfNRNASuSBSeBC3+BcS/aa+jgzds0+c
TLSH
T1B7E19BB3C3E8852DC91156F4AB216E1BCE590A24431C3C6BC9D4AE5BA3F2871E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 20bd42c7ac6ee0b57145ea1ad5d24030a9ed3cb04f08d33b4e831e07b6bd47c8
MD5 9d8c4ed28c91a7eceb0b6c34fbe0bbb7
SHA1 22dfc69747df19d4a0c03632f2d11f6acb57ac28
SHA512 482847a9f46827cd7776a7f9275781e89079d885580f9d3c6ed1ef72333e3859cc15b779191977c3d616bcb2f8f4f2c637198d2a225ca3434c7cb93f59ef2cfb
TLSH
T1D2219E57967F7C5B51281CBF5D047C093CB5B8310242A8F5DAEA42ADF0898F71F02413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 712c6f5332afcaf2945d03d2e859d33467129101fc257021cff2b5bd48170464
MD5 a6858f83d3c862be2662e3eaf592dc20
SHA1 3d8776bc62665da7f779276c16d512522d9415b3
SHA512 641ebb1375a26e228a11f6bcb83fe3b208f1e96d5fee6d936c0be4968d92e9c7ce72a082c1c59e66e19c7d96d994ea98a0101aecd57bec42e30b9effc8157f3f
SSDEEP 192:sR1cBz//O2BK1jWmv7shAPRp22mLyw9wHsb+WNeylZd4cQ2Ul4eAC8pMzVyIsnA4:sR1mz/mt1Y8X/WKweWE26aC6U8
TLSH
T1CA52C72EFA146D7B5CD7D21AF912BB6BD7F5102122842D84EAFC8A1C15DBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 707257a24b35b296c7ba61ebe6437d5040c09581670720aca1b5163fd0c388b9
MD5 1167735496285141796b802d1e4d94dc
SHA1 6c4440837d7a58c63b876600603102ca35cc6dd1
SHA512 088774bd6976e880199bc6f7063756932e4403508bd777d4704aa56b34bf58ff64af618a3264b386017f54eaa441cc589c9809cac85c4cfbb3af34511287d0bd
SSDEEP 192:sRJ//O2BK1jWmv7shAPRp22F9wHsb+WNnZd0bl4eAC8pMzVyIsnAUgtaJ:sRJ/mt1Y8X/FKwz0haC6U8
TLSH
T1B142D72EFA15693B5CDBD21AFD62BB57D7F5102122842D84EAFC8A1C15DB9CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 956f319908426913e52b80cf97a745fdb76c3d2a6cecb803b5aea91170cf21d7
MD5 5b7614201d680e14838b25d4021a8b36
SHA1 7fcc594c39e196815aacad38e9481e5c42cf0e2a
SHA512 bd81dd26905d8746f91bdd7b302c2ce9b8e467a356b15eefd7af4a4bc327b2188e6bdf0356b2d927e8b56df16245ebae3a3a5245fada68b92e590611e8a4ab14
SSDEEP 192:sR1cBzv/O2BK1jWmv7shAPRp22mLym9wHsb+WNeylZd4cQ2ikl4eAC8pMOVyIsnB:sR1mzvmt1Y8X/QKweWE2iKaC6ve
TLSH
T16F52C72EFA156D7B5CD7D21AF912BB6BD7F1102122841D84EAFC8A1C15EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fc8479263854407f40f025c9ffcb7ceb404803b5db648087d4dc8914851dbed
MD5 31fdfeba2ec9dfdf223c45a3aa810739
SHA1 698cd56dce7d7032fc33b01710189fa9d766d79c
SHA512 b9775910210285ee077d77dd1071f3bb8061846dbb7411fd4e92e5e11fc9015b2c4a79af6773c6138ccb091a885bc83f6339d393a795266f83d8b461eb7498ee
TLSH
T1CAB0120080615141C45202B012421988B1147F14970E270393E06D62C8752718034071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e7ea.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e7ea.TMP
Size 96B
SHA256 73e36f7e4d7445dbd56a53e772d98235a51bf044c02b6925b82cedfe4bb96056
MD5 5d23baf0b79296c138dab2ec6a73da98
SHA1 5798ce7a899205210f9039d7ef5e3d39123c636c
SHA512 e73d314806ad907f66301e04c87ace4aacc68fa4caa8865ff1a1917372d4771c80177d18065d869902d8e7dc2d21218555245111ff8b7bdebd45806824a44819
TLSH
T1FFB02202C0032223C03203B03382C8C833A0CF30C2032203C2E00FA2CC30B300830030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 15c67d3a5e572c9320da9fd95461e600710e38ce4ff8616d63ee5bd8e487b26a
MD5 4d55097e5bb01e11564472dd2d20489c
SHA1 e958aa8e6fce0b1127e00f2596d12bd44c748627
SHA512 7c19239b508ea27065acac0978de15c572f04d60695a4e523a89d885ed60ea7c0d71988146502342ef181678ee6dac77456f55f004fb7d7e9c5dd0b184705226
TLSH
T18CA0026043C29C41C82406B116BD03C437144C30130A82535D968C448D565439265612
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 eed6778bcec149e9119bcc4a96b1c70b8d17f96709b4ab98bc01137aa04bb466
MD5 34083af617290ad2ca51080ed0e11212
SHA1 88cc0a0a24a2035c5513460a267862c8d3199b79
SHA512 45aa83410f5c1d93cf5521aa0f16d5991c168a3c348bb42f58657a7dfbd11138984685f148050a5322f5902b8700087848318d5fa17b1bd20883729830e26c87
SSDEEP 6144:mw39wKn2/yjJX2/T3aBRm7Rkm1tYpBeh2BAow:f39pXq19oBGcAow
TLSH
T17334123A9E20FC7A49B5671A288D241E9EF1DBA3CC14CE55D9DCBE0423DA3C51E86D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a5a6503512392fa8e98dae3364b1c82ccffbe5bd4e4fcf064abf3d343f009ab8
MD5 3ef86b58aaf60a4bc4ac638adb10f0d6
SHA1 348a68729d614e4c54c86c6c2d94fedff81bb914
SHA512 a087a055702df7e4f50513735de0245372ad8076972deb92565ff1360ed5fbc37651443aca0a802231f7ffa4fa3b51461eec90d2a83d6f5accecc92956e5e4f8
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:em7Rkm1tYpBeh2BAoK
TLSH
T1C3C3123B5D65E9779979B70EB08E0B1F1EF149A2D920DE52C8D86B0437EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 bc914b89a729a76efd5f8cf82872fbb5bcbba7b94360c66e15673e6e81182dab
MD5 68f51b5e530c8a795a5ba3c905376d30
SHA1 59cfbe6cc35e4ca9ee7dbd339631377d25ea0fcd
SHA512 ee37c7a6a7b05d39fc3632e39c6a3d32be5d62d38d4f83f162a6d74512279992e105666b489876e468d885bc40f328189e878bce6c5ba7a99f4d85695ac26f2b
SSDEEP 6144:rd39wKn2/yjJX2/T3aBRm7Rkm1tYpBeh2BAow:h39pXq19oBGcAow
TLSH
T13B34123A9E20FC7A49B5671A288D241E9EF1DBA3CC14CE55D9DCBE0423DA3C51E86D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 684ace0d3f928860e8fcef6a3399a449c616f6495b03874db87a459886e4685c
MD5 de7110ba752d819c9e2b7859384749d3
SHA1 9e990c3a22a487bb47af5559ef4cd80aa6aceb2f
SHA512 d5dc899ee6ec9079fc86c5a1ccb0471d694569d44303b9f276665ac3024cf31c81786fca20c962dc7c2e527fe101d35804f21628b689d1a6529755a015e8f72c
SSDEEP 6144:S39wKn2/yjJX2/T3aBRm7Rkm1tYpBeh2BAow:S39pXq19oBGcAow
TLSH
T12D34123A9E30FC7A44B5675A388D181EEEF1DAA3CC148F51CADCAE0423D97C51A85E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python-manager-26.2.msix

Path C:\Users\Admin\Downloads\python-manager-26.2.msix
Size 44.3MB
SHA256 66f0370d3f47068916dbd35b2afdc7cf72cba57500e070844a6ca2aa43ec5d70
MD5 1acbd055b8103e05370ccbe3e2ff5530
SHA1 4488d10ea55cba246b55c5b11fdc5dc5f1aeb9fe
SHA512 b52144a19c5a522a66c4445f6640de420ad523cfbea72964d3713eed45e6c8e632f46636c9d26d4247d7544d1ed8b112e5231112a3787155afe8bd5e8aba37e7
SSDEEP 786432:dXhPIo2xDgAK37y7VmUonZ1AdnyfShaC4nzVXlS8UI6aqrwEz4xcaSjPoA9F1t2u:dXhPd4gW75oAxGSYCh8U7aqrwEMxcjn9
TLSH
T1E9A73311BA090EB7E1D7EF316592CB27830DA190724DB68F2E6407F4157B7CA2B4B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download