add4fece7d3413c41569cece108ee1657a0652cff18df174d90a7eea3c674d30

Analysis

user interaction
yes
max time kernel
899s
max time network
899s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara.Dir (1).zip
Size 12.2MB
Sample260715-vmze6ac16w
SHA256 add4fece7d3413c41569cece108ee1657a0652cff18df174d90a7eea3c674d30
MD5 14746ec626caf2c979e63268897f7336
SHA1 38feda199ce506af6e933b90c9eba463077a01b7
SHA512 ddf8aedb607c15f5a46c9ec551251f9e331a5588d03c9dd6823b250d2678e50997fbe1354bd8dfbb171fd3cd3615b3eb618aa08bb7ccad3c44ea8bb7c45cda78
SSDEEP 393216:vURyKOQfeLVgm/EkT0Uq4g2UXbEds1uTmnyS6J0t:cDpeZpTQ4g3XbEEDnySw0t
TLSH
T1ADD63367D1F82612CFDBF17B798BCF1D78A6A6CE0050A80029DC63463A570D45ABE1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286090143531927"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1808	3508	chrome.exe	98
PID 3508 wrote to memory of 4428	3508	chrome.exe	99
PID 3508 wrote to memory of 4548	3508	chrome.exe	100
PID 3508 wrote to memory of 4428	3508	chrome.exe	99
PID 3508 wrote to memory of 1804	3508	chrome.exe	101
PID 3508 wrote to memory of 1804	3508	chrome.exe	101
PID 3508 wrote to memory of 3092	3508	chrome.exe	103
PID 3508 wrote to memory of 3092	3508	chrome.exe	103
PID 3508 wrote to memory of 2508	3508	chrome.exe	104
PID 3508 wrote to memory of 2508	3508	chrome.exe	104
PID 3508 wrote to memory of 4380	3508	chrome.exe	105
PID 3508 wrote to memory of 4380	3508	chrome.exe	105
PID 3508 wrote to memory of 1380	3508	chrome.exe	106
PID 3508 wrote to memory of 1380	3508	chrome.exe	106
PID 3508 wrote to memory of 3736	3508	chrome.exe	108
PID 3508 wrote to memory of 3736	3508	chrome.exe	108
PID 3508 wrote to memory of 1912	3508	chrome.exe	109
PID 3508 wrote to memory of 1912	3508	chrome.exe	109
PID 3508 wrote to memory of 700	3508	chrome.exe	110
PID 3508 wrote to memory of 4092	3508	chrome.exe	112
PID 3508 wrote to memory of 1908	3508	chrome.exe	113
PID 3508 wrote to memory of 4988	3508	chrome.exe	114
PID 3508 wrote to memory of 4084	3508	chrome.exe	115
PID 3508 wrote to memory of 4092	3508	chrome.exe	116
PID 3508 wrote to memory of 4092	3508	chrome.exe	116

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Solara.Dir (1).zip"
1⤵
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd376dc728,0x7ffd376dc734,0x7ffd376dc740
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,16678380068741519368,17734304628609718643,262144 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13883309546264616631,2673112887530163711,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,18173086665174639292,12914264365488930975,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3336,i,3944220736164542816,13397872203133080954,2097152 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15893471549527603265,10474653077419104427,2097152 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,12595925176579213270,1207088146904840178,2097152 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4024 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,17705502191050216897,15282167373244531034,2097152 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4016,i,7599887114397614693,1127953906374053895,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,10675339443489440537,10138656236235149149,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,121323109616213342,15363093383409654690,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,5163130676788156610,6460489483615332180,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,14012340663912497648,4007147593587991185,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,9819844302317907041,6595356275583325336,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4460,i,4184059987251607248,14069936206831256526,262144 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,17356814708553455771,8484234789563516930,524288 --field-trial-handle=2096,i,3903511888051526102,1991466738875859623,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1544 /prefetch:8
  2⤵
  PID:4092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c7576f1d6fca9789538f86d98ea2c4f78e9716bf77d26dbf3ba4a9b1ea087955
MD5 fb9bf25eb8fecf906b5db84b4bb80f0a
SHA1 c1d79c746c4d1840c84eb717273ae855069b9e88
SHA512 224153a20c6617b9346ab1ff3e301a92cbfa3c9fa753897af48a7aec9343735bdbdb316f12b8c199692bad896bfee9fd90ae79273532f8c84fe2d41a020faa98
TLSH
T1FFE02B6AC9629C3B18FC1728A5654746E651131B2741988F773D910C4FB477A428685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b5c528005be5e7b68e757da556625fb7692d39009b809b067025db130c8da73
MD5 1f5d4081ca93026a68e4fd9d4eddf542
SHA1 771a7b7b876a3d32109a7b0ba58d485cf8b0d7fc
SHA512 a99d9f8f48466f471fa4040350cea68726b5bfee5521a4fbc2f759f699a6bd3cdeff709505b2bbeba935a5391de33eaeddd65aa688e4335bf9ac6dca5f205398
TLSH
T146519CF3D3E4867D8511A2F49A217E1FCE7D0A14131C3C6289E8AF5B53E28B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bb60ebfe986fb366d906ae1d3353736e84eb5773beed84c8d4336a079ba09d5a
MD5 a986517d34faaad4691e95aa2770733a
SHA1 b949d77e9e2f5d98b5cfb5674cf5e5974eab17de
SHA512 18b1a7e1a5af35cf305dbbcfbe7450a9f4e312ebc5c1c96e162e5cc88014bf875cdd53911618af3545647ce75c16c0416b24a4e9d6dd5afb710d26ad3466c101
TLSH
T1F2518DF7D3E4867D861196F4EB156E1FDE790924132C3C6289D4AE1B43E2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 84d230be871fd1ba43ee538bbc146abcdcd4af89c183da89a65478f37948c2b6
MD5 f169df84c1c81adbe8bafd684c2b5c81
SHA1 cf5629dccd825ffa79e927fed1e3dae9aa25212e
SHA512 688305e8a21629ef0a4e9dee195df411a6d940300a3da436810e048547582d80f3387f95ceec491f1fb9e5c75e290218ce3e1952a3323202b5c6096b212708bd
TLSH
T155518DF7D3E4857D851196F4AB257E1FCE390A24022C3C6688D8AF5B53E28B2D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bef86c1bfb7bc8ba88c957da37dfdee4a086e1a4bd34a67b8a6ced972d2b40cb
MD5 ebf0279041dc9c4b4f0d6bca2203fcca
SHA1 ecc0ea2a8c71a4f88a33f7765eb3e181316f0a74
SHA512 78297f4dcd8fd3951feeae4b9bf99ba197f9568a3fd06d1799aee45af5a4941e375cd10c09dd93f58147ca960ac9d498933256aea28d28d9f72d6d19a72095fd
TLSH
T19A518DF7D3E4857D861196F4EB157E1FCE790924032C3C6289D4AE1B53E2972D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 72f9f71c01bc1516c50e74919f920707c26cd8b78fab2cff8a7f6a4eedfe0142
MD5 428505c67e6bae283398f4a30cf4e372
SHA1 5bba870ceac61144813d93f99d17d9bcf962e198
SHA512 c3605518c085d60a523e879c211ad9fb337e181200d74baee190430bdbecd1acc1087e8f4c201a5529a00d1548521c7d8553c82a9b2697026feb9fadffede018
TLSH
T1DDF09EB7F27A706300BD44BB1E04F80E3579B4790590D8F0DF9A812CE0965E31B22447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 638d011c2312c1caa3d12cd70146c523f5b9e31d772f10b3ffc503a557d98d44
MD5 a07f90ca6ac6ffa32291a6733db624f7
SHA1 ed1d22590d2bb1e5afff5b70335199f867872ad5
SHA512 e7773b5aafb5e6bb8333421cb26be2d9ee132d064e5205b7812f5f863efaeaee1eff835e1142ace87b6f399d79f5ea48e5d4a45d5f808db4fd11966f5a8669fb
SSDEEP 192:CRipHCQq52Sv7MF+pAPRp2S9HHsb+WNniHuM0AIeifkyVyIsnAUgraJ:CRipH/+goUX91wiOM0AXie
TLSH
T1CE42A42EEA116D7B6CDAD219FD227B53D7F1203126D51E80E6FC8A1C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4ec08bd36ed933acc5a3ec373b3f7788328f967d1d6bb006e4229c3de9ae1626
MD5 20816c5d9ed2358081ebc68e3f0479bb
SHA1 82cfbcb1aca7130e4aeeed09dba3e448c41992a1
SHA512 efac8a0952b451251c78df22bde8577f0c4eeed00cc3888b5983834ff7dbc0cc814f89a78e8ce635cf59025e06c713149250a45bb834f4b57c53556e0936e13f
SSDEEP 192:CRipHCQq52zv7MF+pAPRp2S9HHsb+WNniHuM0AJeifkcVyIsnAUgtaJ:CRipH/LgoUX91wiOM0A0o8
TLSH
T18742A42AAE116D7B6CDAC229FD627B53D7F1203122952E80E6FC8A1C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 294284cc2a2258689b9651a80008d73947a65d484966a4a219cac4865cc3ac33
MD5 40e332a9e15f67c535e055a229bf5d67
SHA1 e4e3b69e384e2409d6f543c3138fdddc2aba55d4
SHA512 6cab05eb89c21d53b90d323c00ad2adf21245a8c3eda1f61ec49749dab4ee56c5fc9b44639b6c691fd5fc4340f8f850e29a4699f6d019fcc9cbff1bd9f3ff8cd
SSDEEP 192:CRipHAQq52Sv7MF+pJPRpVS9HHsb+WNniHuM0AVeifkIVyIsnAUgraJ:CRipHJ+go7XQ1wiOM0Ag8e
TLSH
T1EA52B42AE9116D7BACDAD229FD267B53D7F1203126911E84E7FC8A1C14E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 543d538f70b1af7ba5e929d38062a039e7dcd8e1d8ff7939af5e3da38496c2d1
MD5 848b01882a81eff71d792698ecd8d1be
SHA1 9dfb5635d601fea329fe5e11b214b8f0f40fc3e0
SHA512 2b02e604747049c9bd63a3562c5ca3145c3b13db4e4a596e5b2ebc5b3085e2057d890418e1cc7caa75055a7c2b7ab07e863cbb53741b0860439b112804d285ee
TLSH
T149B0125080026102C04B02F0216695CC71545F25DA0A170243E86A36C8355A18024150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f48c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f48c.TMP
Size 96B
SHA256 67a64809c6c572da14a9806adceaf92a3670cabb48e3369d5121e60c046422af
MD5 73a5c9bc34d3045766af921c112fb54f
SHA1 17e87af7c74ec06973cffdaadf97bf8a643c060f
SHA512 5ca57905b8d6325f4e726c20aec21bc8b07df28ce140d187f2a21d6e7c60ce8bb4e4e37e86b705d96f000b5f8114a84b3b6d2a9695acff6b8c044a742590b90c
TLSH
T1B9B022B8C0232202C88203F030A082CA3220CF28CA0332A2C3E80B2ACC302300828038
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 b080dd1b3654faa71ae0ba305acd1d79d648b3432609e1282abefdf2520dd7b5
MD5 4f24de829188c8f973533d329c3932c2
SHA1 14015e5e3116109fee42c4c8ec9aab9cb9765aac
SHA512 5bba3e57b5c5b57f8e07edb6b2fab024de067e1303e86d0ae0ba3e3a9b7a563f72071f749717bc75cd23eb3fa30dd3b7aaa0d22f3433a61e10f54a3946ce2cdb
SSDEEP 6144:LnuKWNfxXT8uFLaum7Rkm1tYpBeh2BAoL:Lgx/Mp9oBGcAoL
TLSH
T13C3423329DA1EE775D54AB2F300F1A2F09F18EA24116DF959CD1960877B3BCC0D8A974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 8ad1bdef4ed7adcacb2324f429742e001371734f74034bf8e3ff49defea7f161
MD5 a5c4e4dafe068888d4fb9bd482fc7bd5
SHA1 a06b7bed30b0f907a821f99eeebd204952a0a716
SHA512 cd4f0e3102b66a7bcf27c147a2a52b51b68c7e313457b4f7c6d659a5aaebfc9aeb269734aa3092f448d887ec5dd74fce79a6efef91adcd719b2743a2d76978be
SSDEEP 6144:UFuuKWNfxXT8uFLaum7Rkm1tYpBeh2BAoL:Uxx/Mp9oBGcAoL
TLSH
T1CA3412329D61AD774EA4AF1F700E292F0DF18FA28116DE85ECD05A0877B36D84D8B974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c9027d6ecbb2fb0a9a1f6eb939d4b14a33bce93ddc2bf4e6ef0a307f4a50f185
MD5 bd82620a1fc75372ad31adecf49b9dc6
SHA1 264661bc79bcbf3605bca69bd35f1c355c7a6fbb
SHA512 e1b2e10c354ede3b7746c3c87f6c2ca2acea96e85703dbd1169977544ca367653300a3bd79fd8d787f03f4e4c0f2d793a7429d9c5ac5c6d2a63c0f241b6a3e60
SSDEEP 6144:gnuKWNfxXT8uFLaum7Rkm1tYpBeh2BAoL:ggx/Mp9oBGcAoL
TLSH
T1233423329DA1EE775D54AB2F300F1A2F09F18EA28116DF919CD1960877B3BCC0D8A974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 bf61e8f50e952a91c2321a5dc2837170fe770079400059227502eb5dc3b5ba3f
MD5 54832d80951786684d61d217c907c7d5
SHA1 b236a869fe42f8dd79c27d54cc47cc1734170905
SHA512 8626faad01652806494855524f48a3a2db0f752acee192dd227ea3c8dbbbd55c7f6aedf7f7776bf17a5f53b0a5e548aa7fd8b378163ea0bf315e28e58b3329c6
SSDEEP 6144:gFuuKWNfxXT8uFLaum7Rkm1tYpBeh2BAoL:gxx/Mp9oBGcAoL
TLSH
T1213412329D61AD774EA4AF1F700E292F0DF18FA28116DE85ECD05A0877B36D84D4B974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8dd8b735e7ff43ec8fded7e2fe9936ace06880bb81f59ca6942d97bc371cf211
MD5 991a931283f24eb4243f39c146b5fa81
SHA1 a6fc97c3abf01499498fa97f03a287d34f7c0590
SHA512 0cc726a96390ce5a8bb849dfb1c69da51b8d302b5e420013b5d7346111453d654bd0e8c1235a4c47453003ac3d5fca2b57bf759481960eb9968c4ef3243a08d8
SSDEEP 3072:/4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/zm7Rkm1tYpBeh2BAoM
TLSH
T135C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download