75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575

Analysis

user interaction
yes
max time kernel
161s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper (1).zip
Size 3.2MB
Sample260710-e7mzvsev2w
SHA256 75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575
MD5 6b4f0b1696256b71541bc6a293103704
SHA1 978f7c7b04fba2e6966c23927de29a51ae2506aa
SHA512 cf963828f21386b084014f4296d998f18985d7cf7d372803a37c275b3b4527133026241592ddf25daa8df0fb967054de4d089fd31ea02a2f7bf7b372df719bed
SSDEEP 49152:00gdei9Ls69ridKJ7yk8csy59GbnhOAG6fyoK+wocWALjE66eQmHcBGAQkIZlFJ1:JG3pJO9nOAG6frcOYQccBGAz8lFJIGvb
TLSH
T1EDE53396BFEC2C05EE2D7C9F4B501250FFA22A479B8D4294471646BF0825E21C6ADCDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1872	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281317908838756"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3392	2084	chrome.exe	83
PID 2084 wrote to memory of 2920	2084	chrome.exe	84
PID 2084 wrote to memory of 2920	2084	chrome.exe	84
PID 2084 wrote to memory of 1872	2084	chrome.exe	85
PID 2084 wrote to memory of 3048	2084	chrome.exe	87
PID 2084 wrote to memory of 3048	2084	chrome.exe	87
PID 2084 wrote to memory of 5684	2084	chrome.exe	88
PID 2084 wrote to memory of 5684	2084	chrome.exe	88
PID 2084 wrote to memory of 5452	2084	chrome.exe	89
PID 2084 wrote to memory of 5452	2084	chrome.exe	89
PID 2084 wrote to memory of 2664	2084	chrome.exe	90
PID 2084 wrote to memory of 2664	2084	chrome.exe	90
PID 2084 wrote to memory of 5000	2084	chrome.exe	92
PID 2084 wrote to memory of 5000	2084	chrome.exe	92
PID 2084 wrote to memory of 4392	2084	chrome.exe	93
PID 2084 wrote to memory of 4392	2084	chrome.exe	93
PID 2084 wrote to memory of 5508	2084	chrome.exe	94
PID 2084 wrote to memory of 5508	2084	chrome.exe	94
PID 2084 wrote to memory of 1560	2084	chrome.exe	95
PID 2084 wrote to memory of 4876	2084	chrome.exe	97
PID 2084 wrote to memory of 4876	2084	chrome.exe	97
PID 2084 wrote to memory of 5096	2084	chrome.exe	98
PID 2084 wrote to memory of 5096	2084	chrome.exe	98
PID 2084 wrote to memory of 4204	2084	chrome.exe	99
PID 2084 wrote to memory of 4204	2084	chrome.exe	99
PID 2084 wrote to memory of 4448	2084	chrome.exe	100
PID 2084 wrote to memory of 480	2084	chrome.exe	101
PID 2084 wrote to memory of 5176	2084	chrome.exe	102
PID 2084 wrote to memory of 1652	2084	chrome.exe	103
PID 2084 wrote to memory of 1652	2084	chrome.exe	103
PID 2084 wrote to memory of 1148	2084	chrome.exe	104
PID 2084 wrote to memory of 1148	2084	chrome.exe	104
PID 2084 wrote to memory of 4696	2084	chrome.exe	105
PID 2084 wrote to memory of 4696	2084	chrome.exe	105

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper (1).zip"
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdca8c728,0x7ffcdca8c734,0x7ffcdca8c740
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,400456694590442885,4185610872005309595,262144 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,13054004310427359796,13751057607181367612,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,2861603445206651669,7922640026123621820,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,9300429343596048517,18308520483558186855,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,11829372505535876021,2693987274551207412,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,6313378657044376938,9472173178059534248,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,4510485901861932563,8603638085084811596,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,1859636428983846658,15856906469912088191,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,18429305970795404565,16120152808119285998,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,2763983275026360342,8804794172750480216,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5920,i,11604207893837423776,15596414757755002268,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3304,i,8844990372721979849,2518023633219612849,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3568,i,3416418867114805576,3388471337361014328,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,2016883435780369560,7577110961061263678,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,17265654352723560203,2414889800010273278,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3336,i,5763190684675939738,17876156717957626792,524288 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3988 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5012,i,12936899614321199755,13938799119948676968,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3916,i,7519348872109632806,13332155564619174834,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4288,i,7981347135913537343,6855577676471602476,2097152 --field-trial-handle=1872,i,5621689859514855056,11567152645814906554,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bfdd0e3cfb7ea2a2c62178ec13e43e6a263b042f705a6b1b0340f34566b99929
MD5 588fbaac3ba92fce867ce64fd7febc24
SHA1 da0f9949756a640dbe1362ebcac23937ccb6529d
SHA512 b6f8183d552a83838ec6d657e40ae9f95c3c16c127f6c3c2e4541f05724b1d445ace067cd037d671f81c572a30bc7f0681c42c8b0e54322934e737a3c8644674
TLSH
T187E02BA6CD21AC2719FD472861104785FA9013173781890F3B3D8E1C8FF473B6196A1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 1024KB
SHA256 58ad5980aa8686195900cd574f219a919fe3d53a7b303e03a48e9549ff90e85a
MD5 7c06abb5f1df5d0d8a1addd870da5195
SHA1 699f23c6863141bdf24dc36d36fb5f04cf904466
SHA512 906ec1e3378b310e7021fff8b18fe282a65e7ecd99f1a25582569736ed2bdd5d25aa8e1fd8831fee9023082446277e5b2127f0db30760db37b1744258d65f914
SSDEEP 24576:Cl1w1DD+eB8N2PRJxMHgCGwLsa2CT6hmNWQOmyAmJrRIQt:f1TuN2PRJpYLYs6hmNW5mMF7
TLSH
T19E2523909B4242AF14483A6CD839ABBBD731289C8BAC774F5542BCEB3D158E74133D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2b85d471c76506d8f84a0ac6eba4f45d67cd7742d7be4394f82f5efe4e982811
MD5 bf8c5b41a85a9375cd43a1037db45010
SHA1 a0502beca5a109fb8fb11155cce074cf6b703b08
SHA512 b461b93dd2dd262b8c520bfe4e8e74bb5a23026043ac76daa4c37598b2d1ad5fccbb98731e2189a8f00aabe197731710d3a1356059defae0f4024d7b1adc5956
TLSH
T18F1126E7E39B28C1DF62727CD4E12DD4F835D90C24275FD7528460A99E127B4C0D9481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 d86ec444ac96b1229636abafc56c8834716742754863137b68fa5f4fc83dae79
MD5 fb62fd62b4426b058ee5dab8ba563cd0
SHA1 41847487a4ad0d7d5c4bbe19e938c330b195a5da
SHA512 252a0100ef87f142fc23360edba71398a84a4f6ea0f3bbfb7bf51dbb5cc8c8bb78c25912798e03b3c710c27be227dd46de60b15e81409450e6b01b257184a1a4
TLSH
T1991124F3E39728C1DB62727CE8E02CD4B835D90C38225FD75198A0A59E123B4C0D9446
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 0d410421a073b388c9c96ec3b2db472c5b848a5188316f4e30b705167937f6ed
MD5 b0f4892a05aebf59d69c486fab7b537f
SHA1 604e8e5a53515e4b7e6465b5a4c933dd0c28090e
SHA512 6c9fc033748fd99db3e242d062fa0298c62be9dfd055795d8fa183ec76f759c3c6d6ccca712ec1d5d6ec302270d0c91f74d120c936a242b6f4178b5d1bdd938b
SSDEEP 192:DZg3dOR7dCaItqElQavQP/zNPLaPtfPgBvq6XDMpI5R5x5SrOXG3ilJelW:DZg3dOR7dCaItqElQavQP/zNDaFf4BS2
TLSH
T15412BDF7C3E8C62D991151F8AB152E1FCE6D0924032C3C66C9D9AF5F93E2871E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3fcfd7b122b733803fc733b8bd3560fd41a02362f8e18f12117ede68a17dc249
MD5 0267e1ce352092597a6ddbe4912c8dec
SHA1 684818db60ddae5dd981ff32f5e7dd5a04dd403a
SHA512 0b617b1f76dba45bf3b1b9de7e3fcec7f4bdb416a85d81ad2e968556b97b311c27338c0d6d3ea7ee3904c402f4d35ab13149c9e4706b1486139e5d8b500aa98a
SSDEEP 384:oRzmzG+oIJlZgsX5RwqyyVw282r3bax2e:emzG5IJXgoRw682axj
TLSH
T1EF62D72ABD2029775DDBD219F922B79BD3F5102126D41E84EBFC8A1C24E7ACD3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4bfc402fcd29ca4eebf63da54aa2f3d06cd82fa3fb1f00176485c6f92bea8b4a
MD5 e069b2ae26563462d5f379d1b692a6e2
SHA1 4906fbde608e8746cf49d3fd45a8d25eb384c006
SHA512 c7aba8e9561c41c629eb2b93a526157bfc76d02d31bd0de3b5dd142cf895653d081c855cb05b8604d23e8521e41a6f1060b1456671442d808bafc9a3fec7790c
SSDEEP 192:oRvGQvofgxT9v7lpupAPRp209fHsb+WNnSA0/IV2qej3LHadF+VyIsnAUgtaJ:oRvG+oIJ9ZgUXzRwd0/Y2r3baL28
TLSH
T1F742C62EAE10643B5DCBD22DF9227797D7F5102525D42E80EBFC8A2C29D76CC2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b29274f5b57cda6712218beff000baf17feb3b6de7e42505fb3f3ccd02674860
MD5 5574d2f6c95e62c2f2ccf63edbfd9fc7
SHA1 bee1c084f8ce3195a4780627c16814182303c43c
SHA512 f32a22462fd92bca0325eff41a54d7c05bcee0f78a7ea3c39eec4baf04f627f05ef304d03d594b14cf9acd8545d859a9c96bfeae399da8452ae2143ed8152c93
SSDEEP 384:oRzmzG+oIJJ/ZgsXpQRwqqeVw2o2r3bax2e:emzG5IJbgbRw6o2axj
TLSH
T1F762C76BB92029375DDBD219F922B79BD3F5102126D41E84EBFC8A1C24E7ACD3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 385975980f27dc282b9df004fcc93f23a19121979539bb87735a1c21e824bb6f
MD5 0d3401831ef1c583df48e908f37ede92
SHA1 fb9222519d486b32e4236fbbaba92c68b29d06e4
SHA512 71fbc830879e442791ac102ce60a109893e89a1cfbc4684b1e95a05303edee7086104ad7721866e8272470f7f6b91de3da432c697bd60834ba2e4868022f029f
SSDEEP 192:oRzcBzGQvofgxT9v7lpupAPRp2ZUK/9fHsb+WNOfSA4752AIV2qej3LHadF+VyII:oRzmzG+oIJ9ZgUXeRwqq2AY2r3baL28
TLSH
T10C52C62ABD2065375DDBC22AF9227797D3F5102526D42E84EBFC8A2C24D7ACC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4be92635b607823558e7ab423da53712deb7ca67ad7b57e967765f232f6734cf
MD5 e049cba4323802db2cf9ae1d916aefbc
SHA1 0b8f7e2ee189f281789c26359cd6e008d7c25aa8
SHA512 df8a7b1dd75d99cd5510deb75caa1b12ef2c797ce849b4537334b61899589e42072590048d724b3926f332e2827f117d507aa23427a4b5b6bd656391276807f8
TLSH
T160B01250C8035111C04307F4318B1488B1A89F10960A2B0243F069228825173C434090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f2f6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f2f6.TMP
Size 96B
SHA256 013563ae27e8d46daaa227b11a3d08c92281755f82524095d4fa7b85a32ed8db
MD5 ee967d948bde66c24f736b5a8ab3a212
SHA1 e4bdabaf0b526487bb0aeadf05c1fa0ddfb6b45b
SHA512 1ad151143544da1dfa9a229187e6d68223fef9c055c2c659076239904e6457476eeef0fec9c63ec1ada503721f442616bef1d0576a72d8d6736358baa7d0b007
TLSH
T122B00266C5076312C04713B02AD595DC7164FF26C6031A16A2E11A67DC25A708E26970
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a38b1a0eff1908cbcded2a5a1c980c6aae4b45506e78755250a3a25960baaadf
MD5 a210fc93fa45ac1571581a1f3571df6f
SHA1 f58398cea1483be7f6520fc262e8d30781f43f1c
SHA512 5de7e5fdc0d40500f708b8666d664dd40ec86bb1ce23ea39c37b51d037608f9acd7e87e8589dc8a17f19031a5535a914f938de66e8c309ded03b6dabce5b1d30
TLSH
T1F2A0021C428487C3DF1656705AC583843F65486863011A0D4096AD8589A26B28143258
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 adf51fb094d9a3ff5f58e078755f971230c1638388325330601b06c46142179b
MD5 7f5e729b6ef9be4c3134432a3337a5bb
SHA1 71d89429e621ff41e9210dd283e3e31692722a8d
SHA512 a23a2238d2d331d31af83322c6361a4e8443f4dfb0c364e5615448a4bbaff5769d8ffc5e7ea3f4382526617838da8108f61231f7765b2b28a77e8ba878cbeb75
SSDEEP 1536:n6ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:VDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1FDB30212CAAACE9BE5A45C79E4C413F3BEBE5F9523F1B9424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 70915457b3febaaaedf79e157cec0962cb6fcb49b2d74b71ee95cb9b1c45e078
MD5 da8412ce2f5ed298997ca976812d3ccd
SHA1 990a19dfc3dfd32032e943c1a70dcf6db36b0c98
SHA512 b21a7ce49f7161d6182438443004df48c220a14c8e2e3ffba2159533f4525d87fdf5790680a3696fbc9d7e5cfbbfaa2be9f1cc9100c34e26578220e595042958
SSDEEP 3072:P7QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jCDFpmzNA9J+zZ:TQmSo0khmRgB36T8LjkIf+zfAk3Wbha
TLSH
T157341202CEBACCA351BC5ABDD5C51BF76F208B9215F214A052EEEE4326DBE041317565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9cb7d39b960d6fca0e03364f1d544630044d200b00c56ce109e0e57bd6c3d1a4
MD5 89ff4d6af4adab6d75fbfa2919f65395
SHA1 895af8f9c8e9bd2b44be1cae2a2c81d8b08b5be0
SHA512 3c563b72a9fba840b5613f2f301607fc0cd4cf3de87c1e120043fdcec1c17691367cd4652761a0ff2d54655a6d2ef1f99f8887bb5032ff63b5673414da2a0b35
SSDEEP 3072:m7QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jCDFpmzNA9J+zZ:iQmSo0khmRgB36T8LjkIf+zfAk3Wbha
TLSH
T1C9341202CEBACCA361BC5ABDD1C91BF76F208B9215F214A052EFEE4326DBE041317565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c023f4bcbf27babda109fa077591539fee578ab6e93965966631cf1669ddc9cc
MD5 c156baafc3c50921cd7db1abbb190406
SHA1 e9651dd12b5ae59119235b645042d92e26d39460
SHA512 f138812e4879fbd62274a76991adfc24283afabac9829c0cecf2450aa6328312a941877c59103f29bf50d97a7169c6063e649709bb4ee25f0c23819a0e40b73e
SSDEEP 3072:KD0QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jCDFpmzNA9J+d:KwQmSo0khmRgB36T8LjkIf+zfAk3Wbha
TLSH
T1A6341222CEBACCD715BC1EBC94C51BF36E608B831AF228A451EAFE4325DBE141317565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 fc997f15277ffcb7fc8a9b25c308cb501c9e6072156ef46d80de7dfdc3ad7fa7
MD5 e8b21458e6d1d33aa5bed9e481765b39
SHA1 2c582f009703a77cfc40af90126406fe239dd0bf
SHA512 1d8b795ce2425400dce6b142c144b1064b172d82ba22441840800ff6ecfb5d5a96e47144ac851fe22fd0755b0512dbbab21e85545b86d2eb2ccf1398e7dfb06f
SSDEEP 3072:1D0QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jCDFpmzNA9J+d:1wQmSo0khmRgB36T8LjkIf+zfAk3Wbha
TLSH
T1F6341222CEBACCD715BC1EBC94C51BF36E608B831AF228A451EAFE4325DBE141317565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d466efd8fce50bb6ebee15a3a9eb3f762ac39a4a16a46ddb150b32ca86d7e506
MD5 5933d1b537eab1ac1d88c5e87b7e0a9d
SHA1 fe41ca705446927d483f3d4ace0f1f5c7a0a39eb
SHA512 4480cc589d2dc154391bc55695ffb056a01d1263454351dcd6ec872502c22afa920e3d2df755e8cbd1bfa1d2d50b5cccd0246c3e7d73451088043f339f15404b
SSDEEP 3072:k7QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jCDFpmzNA9J+zZ:gQmSo0khmRgB36T8LjkIf+zfAk3Wbha
TLSH
T153341202CEBACCA351BC5ABDD5C51BF76F208B9215F214A052EEEE4326DBE041317565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download