b040c8b8d9e80f636ba74600c15bf560bec75b6b004987147bbd44a3d900a827

Analysis

user interaction
yes
max time kernel
677s
max time network
672s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loaderrobloxskid2.exe
Size 721KB
Sample260723-bc434sbr21
SHA256 b040c8b8d9e80f636ba74600c15bf560bec75b6b004987147bbd44a3d900a827
MD5 79b2513acf605457514adc39a16d3f7c
SHA1 a9a932136ca94e8f0ad80316cf9ebe23dece788d
SHA512 294b93bcf70570a104c30f63c1e24ae9d81dff6628d8c27eb19fae38393eb938fa341717e6b218ddca124d966ee325968a8ba02b5573cea4d9fb9c70c42d31ff
SSDEEP 12288:o5RClfkw5lOMX6GsDHpn/i+nisuMy23ocFHSJdtqUxCj2AqeMQmzFTSpkP2NnnrC:o5RC/LHCHp/risU23ocFqtquGKFzFTSk
TLSH
T1DFF4CF0AF3B192B9C127D574C962E617FB317C056B2086CB73D41899AFF75A08EAF211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
42	api.gofile.io
46	api.gofile.io
51	api.gofile.io
12	api.gofile.io

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe
660	loaderrobloxskid2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292420909332005"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5968	chrome.exe
5968	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
660	loaderrobloxskid2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3580	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 1860	5324	chrome.exe	83
PID 5324 wrote to memory of 1900	5324	chrome.exe	84
PID 5324 wrote to memory of 1900	5324	chrome.exe	84
PID 5324 wrote to memory of 4820	5324	chrome.exe	85
PID 5324 wrote to memory of 1676	5324	chrome.exe	87
PID 5324 wrote to memory of 1676	5324	chrome.exe	87
PID 5324 wrote to memory of 3028	5324	chrome.exe	88
PID 5324 wrote to memory of 3028	5324	chrome.exe	88
PID 5324 wrote to memory of 1848	5324	chrome.exe	89
PID 5324 wrote to memory of 1848	5324	chrome.exe	89
PID 5324 wrote to memory of 440	5324	chrome.exe	90
PID 5324 wrote to memory of 440	5324	chrome.exe	90
PID 5324 wrote to memory of 4604	5324	chrome.exe	92
PID 5324 wrote to memory of 4604	5324	chrome.exe	92
PID 5324 wrote to memory of 572	5324	chrome.exe	93
PID 5324 wrote to memory of 948	5324	chrome.exe	95
PID 5324 wrote to memory of 948	5324	chrome.exe	95
PID 5324 wrote to memory of 1756	5324	chrome.exe	96
PID 5324 wrote to memory of 1756	5324	chrome.exe	96
PID 5324 wrote to memory of 5272	5324	chrome.exe	97
PID 5324 wrote to memory of 4724	5324	chrome.exe	98
PID 5324 wrote to memory of 1724	5324	chrome.exe	99
PID 5324 wrote to memory of 5148	5324	chrome.exe	100
PID 5324 wrote to memory of 5148	5324	chrome.exe	100
PID 5324 wrote to memory of 5968	5324	chrome.exe	101
PID 5324 wrote to memory of 3028	5324	chrome.exe	102
PID 5324 wrote to memory of 3028	5324	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\loaderrobloxskid2.exe
"C:\Users\Admin\AppData\Local\Temp\loaderrobloxskid2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:660

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8c118c728,0x7ff8c118c734,0x7ff8c118c740
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,11396212742110897759,8677986297098801456,262144 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11958823052181643618,8699133929645775653,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,13972100919327193701,6130652761818844020,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2536 /prefetch:13
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,3736013154130439112,8492049058865699694,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16578824296612298866,9807839121510367615,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,3462400739954485710,7394134462380224764,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4252 /prefetch:9
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,4114850481249208716,13022358789145322577,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,22632656254637029,16388698354745226991,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5988,i,15348421082393182485,8254101457363500474,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4656,i,3119433405874396403,3078134082964799199,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3588,i,14290229216747930418,1903600716613746091,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3336 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3576,i,5607278270507912605,7770902443252840851,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3468 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,5555465168381137352,4019101755924854143,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3584,i,1250985332906315526,13046946653490762744,2097152 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5728,i,11059584315665575259,15717630212544596091,262144 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5436 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,7556241181281757053,10529315877725736775,524288 --field-trial-handle=1952,i,14073835322717045991,1367672160594530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:3028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c9e928c919c58bdc25cbfd0984afb5e1d419b323042a6faa0c5e2ceefec17dc
MD5 116e6baca0317f795ced3a9704027a75
SHA1 5bfe4bd378f21c3132063d6ae9530fdde7c1037e
SHA512 81286dc14218f700a323586ad3f5a67af4034cb726faada6e761fa38a66c664f52d65bd7f112c88d08dfd1af14ed39057dba222c24507d6e8e6de887ce14c2e6
TLSH
T1ABE02BAACE219C2709FD471870104645EB8013177B828A0F363C520C8FF4637439692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 7c69fb141c40049458e7bdc5b419f4c65fdb034651ec654c98544520655dfc87
MD5 749432173f557f43f7aea033cb013f79
SHA1 b9e4717a454cfd3a3402f1b4eb38f58459a08b38
SHA512 9ffa12ff5829433e6b5166ecd9e52b47c7d6395e8b50a299d170fbacd8760194d6b99dad5e596b963cedd3c84cfb6a153b484e0e40c968f0f850ffc1c8bd5d0e
TLSH
T111015C2237AFDD61D3126B35A2F4F964747213F0CD03CF22618386B4A716B953A4672C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 ea2872f31d6de2e3ddd2e9b549ad3fa0e79bbf03b31f633d33e034316a4a920b
MD5 a5aeb290bc2bf70ad6ed143e54ec7b25
SHA1 cd2067653f4217574f51b98391562900d99d8130
SHA512 1df64a96faa306226600771e93bf3a06e84c1f120bc1ee3f86cf8e38b9cb5164fc7eff8bbf92733100dda14b0a33999dcb6c62180e6e03e625f11010a28d7806
TLSH
T146019416CBB49E69F7502E3BE2C5E6E4F3B226300E0F8FD150C481B3672C7612442268
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 496ddcbdbc11f6e17fe665eec7158ea51612bc923c468a56ff3390f54994c26f
MD5 049e29096db4b0bb71923e28a5f698e7
SHA1 dd4c8ce186fa39593f96e90528ec925b20f65b7b
SHA512 666db447010b9dd592da3db70c7c7fb7af5723fa8f813650f84976e4b1e7d95964f449b32242d0a3b792afb3bbfc0b729de97bc1dd40f1afb40ebaf025696bfd
TLSH
T15561CEF7D3E8857D8911A6F4EB116E1FCE6D0924432C3DA6C9D4AE1B53E2872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 71d1c0480012bf9b84c1c94164875b6ef3ab1f657015b222e2eff2eda25fb720
MD5 16cf8a4e0d997e49069d3bcd5646d6fb
SHA1 f3bfbca8f3e29931272de5d8e317d7709c361b08
SHA512 ef564758b78f5a051bb01e7d57c8ff33227aba49ae32fedd533516ba48d02362e57a9f3831a1a906d486af8322cae81d947bda8370673ef42b6ae92bff2f3643
TLSH
T1D311A293D6BE746B107D09B76E0478067CB5D8310192B4F9EFAE815DA0D14A30B03457
MD5 SHA1 SHA512 TLSH

Submit Download

c8fd82d3-29c8-4b04-a16d-46847903c36b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c8fd82d3-29c8-4b04-a16d-46847903c36b.tmp
Size 3KB
SHA256 05d89d25d28a29698c1e4dbae213379f22f0c528b3af5e86f086af6f0feed9bb
MD5 4eb65a67fbeaf8194621d5c71cf1d31b
SHA1 dabd1ecc5309bf225d46c4d86929f129587cce7e
SHA512 24f3d4f62dce844b404299aec10bdbe9eb0e84b813b1d7fa1a2f36eb093b0eeafc495ed1fe2217767e88210eea039343462ea3e791d1f471bf775cff5f7b7ae2
TLSH
T167619BF7D3E8856D8911A2F4DB216E1FDE6D0924432C3DA6C9D4AE1B53F2872E20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9180b49d4454af0d71f1fae3c5cf4a94417f1f36fa5c8bc0e3e61345216d5fae
MD5 1d78fa36dab99d30fef0903005a6c70a
SHA1 e70268448a37dab8d1f500428d0f033dc59cb9d7
SHA512 208de297e8d732b2986a719a08985cc0a47d2280bcddea360d0221627bf67f3dd0cf6ec3e8c3bd799f0f40363863e0a670839bc657c5463dc47b14f99b9a760c
SSDEEP 192:kRlhc6AybxdBrmeStv7lpupAPRp209fHsb+WNnXU0BLe/2OzJVyIsnAUgtaJ:kRTc6A4dBrwNZgUXzRwE0c2Ob8
TLSH
T1D442C72EFA20653B5CCBC31AF9617B53D7F5112666941E84EAFC8A1C28D7ACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e3cf2575b15c92a14c74f6b75cecbc8ff885edf735471501d872257b76b1ae00
MD5 061c42bec37f6878c6c164b314bd173c
SHA1 dd1502961f286912ed329cf9ab180f040ef7894e
SHA512 ed1e20bf0032da7b4bc6a407ceee42ef505fd0b71fab3209e5f50d942b7b0b1e100242cf20b7d3da6853c6a341934a57faac36126ff532d249699fd69a698351
SSDEEP 192:kRlhc6AybxdBrmeYJv7lpupAPRp2ilb9fHsb+WNnXU3nE2HLe/2Oz3VyIsnAUgrK:kRTc6A4dBrqJZgUX/RwEU262OVe
TLSH
T17452D72EF910693B5CCBD21AF9117B53D7F1112666D41F84EAFC8A1C29DBACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a0520bd2bf3581a49aac99955b089221dac2daf9d1e49293b9d8ce058281fa29
MD5 0a323a708de7a19cbce6dde7613fa992
SHA1 36a741920bdb30f6da30cbbad170e6fa358b2933
SHA512 b21242e484af29a8f5be397481db781b89c407813cb960f8eff5d7cbad1810c9fa58cde71519fd6371a23c677443222b48f02a4ee58b39705c37da7230f0804d
SSDEEP 192:kRec6AQbxdBrme4wHv7lpup+PRpkilj9fHsb+WNnXU3IfW2Le/2OzjVyIsnAUgrK:kRec6ASdBrSoZgCXhRwE0WV2OJe
TLSH
T17552C62EF910693B5CCBD21AF9117B53D7F1112666901F84EBFC8A1C29EBACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cbd05e28cfe619e223117f06cc71a6882d917fd7a6b2b91721eb05fec26611ac
MD5 d049d22f82a021c6c003721c21cc3dfe
SHA1 b9bfd9b33592af32a6248dd1126195fc222a19cf
SHA512 8aa57933e0929d11a84bbea8b5cfcca8ffe7cfe34e3c6dfc952e48a9d34df813479d2638fb9e5d1fa666b799da8f6580bdc743f61abed3f18029e8e8dc247a7e
SSDEEP 192:kRec6AybxdBrme4wHv7lpupAPRp2ilj9fHsb+WNnXU3IfWsLe/2Oz3VyIsnAUgrK:kRec6A4dBrSoZgUXnRwE0Wz2OVe
TLSH
T17852C72EFA10653B5CCBD21AF9217B53D7F1112666941F84EBFC8A1C29DBACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c31692dc7a56c9933c477e1873bc31141782983605d7e09147d2adb542a888ac
MD5 62b5e3a4dec68bfc46840921a9151a1e
SHA1 95e4689c7d89d691b65846a858fe34ed5304cd3a
SHA512 16d3c602ce79bdd4e7a6da810322fd01cd441f5a539f5f5b31485883b3bb394a17324a9f6efc07a3120b144722248b56eb97e02bf15e52b7952578c8f8c7bbb3
TLSH
T16DB0124084015601C00206F42143688CB1149F24BB0A170143FC6A22C8255D08118160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589834.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589834.TMP
Size 96B
SHA256 a3148a986be4600f5199a533175b1fd2a4aff658b8fb9dde8401c96f4305e8ff
MD5 9ba0895d2a2eb7657212cdf183981095
SHA1 b81247478b8f5dd6277b429135f182ad0b26b12a
SHA512 eaeac39882fb600e89f883548cec2da1924243c989fc9b68d3e937ea2ae2988272717198dce58d91a2fad51cd042eba13f90435c6c343f5b0386cdfcffe494b6
TLSH
T12DB02208C0022202C00203F03880C0CEF230CF28CA030A8382E80BA2CC302300A20020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 386952e9279bbd72e6c3eb30366701cd72aed55b0cc6897426be1ce2ee819ef2
MD5 faa76ed22609446c009a5501e947ee98
SHA1 41de5343ce8da60980cf2e8d4df6e3d3de5d3651
SHA512 328230e89ccc0742223f9d5fbaca6ff16a1505921f4ce10d82b234933b1274f1f1d3a18eb81266c4867309ece5ed816448e1ee3c0e1e6c0313630087600239ca
SSDEEP 6144:jHn0Mz99D0Vy0OxUvs85t/kf+zfAk3Wbh3:b0Mz3B0OGD3GgfaF3
TLSH
T1E93423364EE88FFFA1EC4839D2C927F32E699F025B62B5964012B5021D8EFD47351672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b394a7930c09cb6845c2b930c1a2ba76088ba3de05f13c39176b35bf71c97714
MD5 62405eea6d68369d0fb52171bdf4f0bc
SHA1 20b4f68f2774891d24233fd83c3e39f31c5cf1c3
SHA512 b02176dd1a54b1f4f2ad5e95fb17d5b0235836881d1a9ec1a804e13841a346b6b4710eb3bf7b347c8f72729ab42db4b9ffb6886d8478ddd39e2d74935d3b8491
SSDEEP 6144:fHn0Mz99D0Vy0OxUvs85t/kf+zfAk3Wbh3:P0Mz3B0OGD3GgfaF3
TLSH
T1CF3423364EE88FFFA1EC4839D2C927F32E699F025B62B5964012B5021D8EFD47351672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 dd6045e8c685be088806d95b98dbccb16982e7de50c7fce80f7e5f7fb65aaa17
MD5 38c4412a8085015f2425b04061b38086
SHA1 ae4daaa8c74e92db6f4489985c53ae389e68dd27
SHA512 9195bf031967d2c39be6ae0cdb27189eb492865bb64b68b45e2edacb567fd45de53f7bba1686070ecc77c1b4e284a9146b88fb977e3cdeb4d69238830595dd83
SSDEEP 6144:zn0Mz99D0Vy0OxUvs85t/kf+zfAk3Wbh3:b0Mz3B0OGD3GgfaF3
TLSH
T11D3423568EE98FBFE1EC4839E2C923F36F695F0156B2A1934112A0021E8EFD47355732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e04afd0bc15ec1db61547dcfaa8b9709866379954d47b4490faa41bed6fe7613
MD5 bdb51c47fd03def4dd9b5dd8b4a6fbcb
SHA1 63eaa2081ab99abe396f6a0606ca131be3b568b9
SHA512 36a89abef5f5578e49bee457a5ae3cff9b60cce75e50db7308a6a6870d10068e344322f7af7076672c12e8ccee007a23d2ca9b40c031e29a26ff3f93204455fb
SSDEEP 1536:BChueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6c:EIDFpmzNA9J+zfAsJDREge7oWg+95hP
TLSH
T19EC30212CEAACEABE5A45C7AE0C513F3AEBD5F9527F1BA424176A4023DCE7041395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 388bbc363b04809b088ca36a7fa1617833dc2d82c47587aa71d4362c8878a3a6
MD5 7d162acff24d0a9b715f00417792c3f4
SHA1 05dd3d1a8c59f5c4fd298afd5d65dc4a94894a6c
SHA512 b4d8472e67636fb1a08daa7c5bb1efef67a54c3a1759401efcdc4d15e257a8f836db62984a24bbefab4b840c6aa5ddeb66321c6f51e59a3b46fc6ebd5bfd3209
SSDEEP 1536:nIueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:jDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T164B30212CAAACE9BE4A45C79A4C413F3BEBE5F9563F1BA424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download