Analysis
- user interaction
yes - max time kernel
79s - max time network
81s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 16:11
Static task
static1
Behavioral task
behavioral1
Sample
yemeksepetichecker (1).py
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
yemeksepetichecker (1).py
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target yemeksepetichecker (1).py
- Size 104KB
- Sample260717-tm5rhae19p
- SHA256 d23a08bf0d7f276c1f2347ad74da0a437ec1b0fa91a0ef4855e5f4f89ec9e239
- MD5 0a8c4ed225fe9c072db816cee5d3e070
- SHA1 35e797db67edf0154eb27dce664682dbc4eab612
- SHA512 3ba1ae3bb2e544d647a3b241cfddef3a032cbc2b609958382822aeed9f110fd0937601c7d952cb50545c957f9c407c987e715b7ae0835975cb43a97bbddd01d0
- SSDEEP 1536:0bdOddq4/VPilZOCDUjD5yZHEe3HUIqm4xOiPQfxKMuCPrslD21ibMSsnPH+k9fD:0ctPiK2MydEe37qmviP9h4ibMSuPpR
- TLSH T1D1A302109F6F98E407DC97FAF51772AE763787DBD1C9082BB9B1AA001035BA65C52C2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3792 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2956 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287783423615301" chrome.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4180 chrome.exe 4180 chrome.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4332 OpenWith.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe Token: SeShutdownPrivilege 4180 chrome.exe Token: SeCreatePagefilePrivilege 4180 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4180 chrome.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe - Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe 4332 OpenWith.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4180 wrote to memory of 4436 4180 chrome.exe 103 PID 4180 wrote to memory of 2924 4180 chrome.exe 104 PID 4180 wrote to memory of 2924 4180 chrome.exe 104 PID 4180 wrote to memory of 2956 4180 chrome.exe 105 PID 4180 wrote to memory of 2404 4180 chrome.exe 106 PID 4180 wrote to memory of 2404 4180 chrome.exe 106 PID 4180 wrote to memory of 3292 4180 chrome.exe 108 PID 4180 wrote to memory of 3292 4180 chrome.exe 108 PID 4180 wrote to memory of 2516 4180 chrome.exe 109 PID 4180 wrote to memory of 2516 4180 chrome.exe 109 PID 4180 wrote to memory of 4380 4180 chrome.exe 110 PID 4180 wrote to memory of 4380 4180 chrome.exe 110 PID 4180 wrote to memory of 4120 4180 chrome.exe 111 PID 4180 wrote to memory of 4120 4180 chrome.exe 111 PID 4180 wrote to memory of 2164 4180 chrome.exe 112 PID 4180 wrote to memory of 2164 4180 chrome.exe 112 PID 4180 wrote to memory of 3308 4180 chrome.exe 114 PID 4180 wrote to memory of 3308 4180 chrome.exe 114 PID 4180 wrote to memory of 1820 4180 chrome.exe 115 PID 4180 wrote to memory of 1820 4180 chrome.exe 115 PID 4180 wrote to memory of 4068 4180 chrome.exe 116 PID 4180 wrote to memory of 4068 4180 chrome.exe 116 PID 4180 wrote to memory of 2068 4180 chrome.exe 117 PID 4180 wrote to memory of 3544 4180 chrome.exe 120 PID 4180 wrote to memory of 4828 4180 chrome.exe 121 PID 4180 wrote to memory of 2312 4180 chrome.exe 122
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\yemeksepetichecker (1).py"1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3792
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4332
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff982edc728,0x7ff982edc734,0x7ff982edc7402⤵PID:4436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4418314026992417193,7292453151857259775,262144 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,7311032031100571401,4105883084500100258,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:32⤵
- System Time Discovery
PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,4154439091400715539,2648088554334628824,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:82⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,18103464330636455270,272198110115549903,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,14415450214094939518,7973601325290516911,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,4336922279285358842,12355186793507006128,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4004 /prefetch:22⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,428363587139868308,11896688051065494481,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5008,i,7653742983111016877,16446183452008962831,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4936,i,15370968244561540957,4244877983486797631,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5136,i,17131176366242676998,6436505716193531117,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3932 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5284,i,13323670505652358136,10139682516859597372,2097152 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,5076653128836765295,17054474891738348729,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,1742276279417748451,11492973662111882074,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,8296815007602897971,14208116158642647635,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,289957402536944841,283387535088089181,524288 --field-trial-handle=2020,i,15627839982365168962,4894522187701076805,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4692
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 5db99b71acdadee131fa3e78f802dc4d7795a78f5fad5750f9cdc4a651bd96b2
- MD5 313d20937039ee86de0f02633bc688bf
- SHA1 a6293724ab1f69d325d9f484acb2b5aee5c5b9e7
- SHA512 9c32043ae033a91ebe8f86beabffb804d5da4805771184e5320a689bedb26a61fd84eefa7122e29bbbabbfaa1617515a853c0b3319abafec4afd1bc23c24908f
- TLSH T159E02B6AC821BC2709FD471864144786EB55135B2B90594F363D9208CFB0B2B42C6C6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
- Size 32KB
- SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
- MD5 b582b2eca79a750948dbb3777aeaaadb
- SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
- SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
- SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
- TLSH T143E2E2F9A6319A3CC9E9F3C983459F40F75EA449A50C11CA70A8FCE465824CD5F7AA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
- Size 66KB
- SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
- MD5 33411bb179575dfc40cc62c61899664f
- SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
- SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
- SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
- TLSH T1706301B43270DBF4E089C49924E62B1CD4D3606FEABF94E4B146DEDD922BC773198848
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
- Size 18KB
- SHA256 0f217bc89f2bd09cc2e613657f4c89a00084ab262288dc303b69a67cb3c0326a
- MD5 f106ad5680bc9db65a63c42e2b0cc496
- SHA1 8360ac9e8040fd333715a1ad2a3c8dd073781a51
- SHA512 fe833f185bac54454809035925bc8ccd0bc9e167a729831d22a3d4a460fa1c03b58b0f7442124a32895464d020c475ed47369ad712ab811ef71995acf81feba6
- SSDEEP 384:St9ztc47h/AzaAWX6YlOPvpmqYDZ77pYUvtCgznOdXU5j:Srpc4Noz0X3O3jYZ9pVnzO5Mj
- TLSH T11292E0074AF99C41914CEF843DCB91162116ADA3EDABC4493184EA63F3FF34462ED1B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 936B
- SHA256 431bf6164bc158f99bdd2fdd5685854e50c003ed21f950c68af08242476ca72c
- MD5 702675c158ce440f524e9d227d33ecfb
- SHA1 dbfcaaccea3551532dc86f675b6cdcf37d1536f5
- SHA512 24e06f25abcf326f8edd6b4f909e2df6421b71ebbf82043bcff6e24a340bf5bb01920872979dacd6c16dcc87121eef0e274201dd7a7a519b1e5c6ff8a90aeca8
- TLSH T17811890D119A014FDF62A6FE04D57D2CF4F229EA1A41056640FDB43CDA016B06EDB4E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 cbf885ef72750aee0a811edbf409ca821062319b322c601b7364cea0828152a5
- MD5 09fb4364c67c5ae851f11ee78c8b4217
- SHA1 78b82c5da5f5b50b486ce7df5fccfe1082d59df0
- SHA512 46f6e97973f6c31fae254dff8d5b91e45a1fd755ca4a826ac8a4e503ac2da17ca385893ae47c249f954d16c2ab133c8c5c96221fc391438c8651ad2700e5d3bd
- SSDEEP 192:xRHcBz/4HNxKMv7shAPRp22me+t9wHsb+WNl05O4zs2B322Lce7aVyIsnAUgtaJ:xRHmz/umYY8X/cKwTt2922LJa8
- TLSH T1CC52B52EA924693B6CDAD229FD227B97D7F6102122941D84EAFCCE1C15D7ACC321741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
- MD5 d066f854d368cbebca026e5da297c2c3
- SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
- SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
- SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
- TLSH T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 441289778a5cf84a2a99d291835bbc8c1d6a524256a9aa7a4e6c51611e7a0036
- MD5 9fcbfd5028e305bc01eed42ada467918
- SHA1 597082b3f239a5da307932a86ff7adb2608ed012
- SHA512 9ca12493899f0ea122d600b3395f29a2128fa9b38fdaac187eb7eb40c4036cbadac7fcd80643bbf36322eb9499dd39326a727f33c1c34caca809f7e7e9b12387
- TLSH T103B0125080015303C81302F8154214887154DF309A0A1701A3E07D33CC36190D014290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca02.TMP
- Size 96B
- SHA256 9625e06c10a5e0ce0395a3f3aecd5794133222976b804a554712a527451f52ca
- MD5 cd38db3f056b41eb19beb6b9f305d031
- SHA1 87b67e84d05a31ca2fc9c718f25ce02108e0558c
- SHA512 b7642f319851fe736ff7333b041642f583daa9f58407c329e67a57eff2b8507b4d8a8bb13ae190cbbf6e20527f5bffa1cea1e86e75f85442318e94502f60c26a
- TLSH T133B022E8C2022203C00203B028C880CCB0A0CF2BC303220282E82A22CC282200022020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 7a2783e943769906020a6c0ad9626a5d79d1f03b6e9ef3a1f1b7abc848b67e7c
- MD5 1318edf7769e0ff6c2e014d1f77c421f
- SHA1 b44c2030a299820f106dbdab6bb97b34fae66bf5
- SHA512 fc9f930a1d9b9cd1d6d3c5030ec69e9fef4d027354a28918d18a80baf5163206433b6ab40ae284eb6d29c46b22646c46dc42fa2d5b2d4ceef5fb99059c7aa4fc
- TLSH T1ACA002181141812AD04A567D55C555443356582101F6130694E81254E99055C4122820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 3c2de49f63fb1d7ed028496dec7b92139d76cd24d1abe405200e4c6a68a8ea26
- MD5 69f1ecef30eb5dd40bd3ddab703e7b3f
- SHA1 9e01332f7489f0df7d9674e583d893b6d281d105
- SHA512 043de5f3cf3f0ac4f7f38a481173d654ac1f74744cb45e358fe75f431cb4844751409e9c65bdfa48c165c7cee76aec5f6eb93839976cae7ab467e01b477f7b71
- SSDEEP 3072:zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Km7Rkm1tYpBeh2BAoK
- TLSH T12DC3123B5D65E8779979B70EB08E0B1F1EF149A2D920DE92C8D85B0437E97CD0A44D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 091cb9cd80236efe7db311730ec4be92aaacb0aea807d2a5c43ac505a8a3c3b6
- MD5 134f9b127d65b4c1be27555f6706bac9
- SHA1 2c01d4bf2bb603e07a83abefe086f9b8f2eaabeb
- SHA512 5c179ea223104b22951861e93c490ed1e5f2893ce56101dd46ea8f6116d6527c283b5f597f8eb84d7b8346d5c5e1de06d84c74d78da9c1185701848274b8a235
- SSDEEP 6144:SZ4YNceHqYhV4QQspKICmFRn+ToZCm7Rkm1tYpBeh2BAoT:SZ4Y649hV3K4RnQoZt9oBGcAoT
- TLSH T13434123FBE35BEB3D96AF30C789B5F1E2EF14DA69560CE8540E45B0C62ADA8C1509530
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 84e4e940a7e8e2e9056221df91705814c512f809674f44ed73509ceff469d0d9
- MD5 99be4695ab3d9d3ae6685d53b3679335
- SHA1 1cbe4a58184bad4de6ccccfdfa872ff361195433
- SHA512 c1eb2bf672dc5973a89f7186a4b3980ade740a6cea3d16ec692112c7103d6f361b846ffa6b8cdfe3ab46ae498373c30ac7519518346b0bb625720bd867e92f9a
- SSDEEP 6144:1Z4YNceHqYhV4QQspKICmFRn+ToZCm7Rkm1tYpBeh2BAoT:1Z4Y649hV3K4RnQoZt9oBGcAoT
- TLSH T11834123FBE35BEB3D96AB30C789B5F1E2EF14DA69560CE8540E45B0C52ADA8C1509530
- MD5 SHA1 SHA512 SSDEEP TLSH