76eb202284796d258bed9057921f5b72cb5a1b30fb0671f4b5af402e9d713053

Resubmissions

27/07/2026, 12:30

260727-ppwt6ascpc7

27/07/2026, 12:28

260727-pns2wasbme7

Analysis

user interaction
yes
max time kernel
167s
max time network
169s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CamelCrusher/CamelCrusherWin-1-0-1-x64.exe
Size 1.5MB
Sample260727-ppwt6ascpc
SHA256 76eb202284796d258bed9057921f5b72cb5a1b30fb0671f4b5af402e9d713053
MD5 6f4547b4f8133768a0ab25a68c813e77
SHA1 d877a5e5a5535272afd3c2f6cffbe17640429609
SHA512 d5d0eccf25ee5b50655d2a144ccbc13a7df1692d8ad14b327ca794101d1f0be7ce7d4a5cdff33aa35356659e5237cd140dbc2bdca34ac7df3100897889d0d29f
SSDEEP 24576:qfyq93DySYvloLdZD6wzGfXey9jKNW/J1a9oE5BVFTUoHPvDpzxGVCsvCaY+AA/5:6LdZOwzGXJq5B3TmVVo+AA/mmLdr
TLSH
T13275AE46B6A142E6D063C17D8A93EA1AE3B1FC04175157C723D4FB692E37BD48E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe
3168	CamelCrusherWin-1-0-1-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
66	api.gofile.io

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\VSTPlugins\CamelCrusher.dll	CamelCrusherWin-1-0-1-x64.exe
File created	C:\Program Files\Camel Audio\CamelCrusher\CamelCrusherData.lnk	CamelCrusherWin-1-0-1-x64.exe
File created	C:\Program Files\VSTPlugins\CamelCrusherData.lnk	CamelCrusherWin-1-0-1-x64.exe
File created	C:\Program Files\Camel Audio\CamelCrusher\CamelCrusherUninstall64.exe	CamelCrusherWin-1-0-1-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CamelCrusherWin-1-0-1-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296291811733633"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	CamelCrusherWin-1-0-1-x64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3296	3712	chrome.exe	89
PID 3712 wrote to memory of 5024	3712	chrome.exe	90
PID 3712 wrote to memory of 5024	3712	chrome.exe	90
PID 3712 wrote to memory of 4796	3712	chrome.exe	91
PID 3712 wrote to memory of 3748	3712	chrome.exe	92
PID 3712 wrote to memory of 3748	3712	chrome.exe	92
PID 3712 wrote to memory of 4848	3712	chrome.exe	93
PID 3712 wrote to memory of 4848	3712	chrome.exe	93
PID 3712 wrote to memory of 3508	3712	chrome.exe	94
PID 3712 wrote to memory of 3508	3712	chrome.exe	94
PID 3712 wrote to memory of 3844	3712	chrome.exe	95
PID 3712 wrote to memory of 3844	3712	chrome.exe	95
PID 3712 wrote to memory of 2532	3712	chrome.exe	98
PID 3712 wrote to memory of 2532	3712	chrome.exe	98
PID 3712 wrote to memory of 220	3712	chrome.exe	99
PID 3712 wrote to memory of 4732	3712	chrome.exe	102
PID 3712 wrote to memory of 4732	3712	chrome.exe	102
PID 3712 wrote to memory of 3836	3712	chrome.exe	103
PID 3712 wrote to memory of 3836	3712	chrome.exe	103
PID 3712 wrote to memory of 3776	3712	chrome.exe	104
PID 3712 wrote to memory of 3776	3712	chrome.exe	104
PID 3712 wrote to memory of 3840	3712	chrome.exe	105
PID 3712 wrote to memory of 4292	3712	chrome.exe	106
PID 3712 wrote to memory of 4040	3712	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\CamelCrusher\CamelCrusherWin-1-0-1-x64.exe
"C:\Users\Admin\AppData\Local\Temp\CamelCrusher\CamelCrusherWin-1-0-1-x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3168

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc87bc728,0x7ffcc87bc734,0x7ffcc87bc740
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,8196748466190891175,1962167016631872762,262144 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,15214697524389436455,1701235750487353791,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,15123600686968866799,17905750468585408988,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,1414827740457922118,9799613467114043004,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,6617837362799643108,10791579969391171218,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,5797465545165560136,8048949116440545307,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,4826239931634711690,13932009992935405240,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,18162615854248998252,12601050914191316625,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5732,i,3728738581339353337,18271736916377807362,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4736,i,12544522246968802389,10047734878917617936,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5752,i,18255031910922465619,5119517514121988111,2097152 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,12414059774143962934,6349922062748202054,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,7994788153176471928,9916567950266388229,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,5594291522265120982,11568455165100730942,524288 --field-trial-handle=1856,i,4125457261608706491,2452704546559632969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:4040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f182d6ac780e450db0bd1089bd5e45dfdb96ca325c3526220e3129759541cdcf
MD5 10d01a232e360ffc52942b878b0b02f8
SHA1 014ee725bb10832916d4d2c38a278474afba94cc
SHA512 75b085b7ad09a989c47fc98e31b1696bb858c29866cf76017e92e2746aa6b5d4a2ad96005f248a75e527e5f7e1a787704c8e17bb71fe0439f89c5d04d42715db
TLSH
T129E0ABAAC826DC3B08FC275960405742EB4013271640490F3A3C91088FB053A858281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 060ba5d522dadd832ee1249cdd283f0cab23a2c41363cc6cd29134ffd2b129eb
MD5 8f372545354dff34445aa5b5ab57594b
SHA1 1498c6d40b6969ef1b4a4ea852045635a673d439
SHA512 c32cc93a42cd1db411340a3cfc2577fdf9c93776d40de08c7e458150e4d6dd3ddb31da0a44d0d1a10e29a9c9f73a15be4cc90e18eb946c6e90e184496e150aa0
TLSH
T1C421B417244A90A0E3B4DAB087FAA76C36B14A3401078DD82C3272BCF4533F8B0E8E1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0a8f8139a1203e48547a56479e3c37d2ab3bedee6e7600de0e7d195832024e17
MD5 723c65ce649d6972d4352eadde6fcb20
SHA1 733e322f5dc4f168378d0f7cf34f7489d0387b0f
SHA512 03cd1ba5663b358cba02506d85c5356d8878aa15592a02e84419d9d3ffd304760d368590ebd85cbf610006b39cba5eb07fba78478ed00bcf92da0620eb0c3ebf
SSDEEP 96:DAxcY5aaICSITdaniWfydVuG4wNPK8stNPzH+1:DAxcY5aaIzkEi2uHPNPhstNPzHw
TLSH
T158A1BCF3C3E8952DC95156F8DB15AF2FCE290A18432C3C66C8D4AE1B93E2972D21434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 622689dfddca35411f1c9e5d7e12046819b7e1690fa2547c060f774c752a81f1
MD5 f994ba5a8a2af41bf5a2d67dca76bef8
SHA1 77d5646f7535f2bdcd223369e6bc10e48374ce14
SHA512 daecb4e272ee2f7ecc9f3621b61080a0fbe360380ff5e49f476d7271e927621d66f569efc2e9e12ce111748c0a32fb43e57d961ba839e05972aff17f245a8b95
SSDEEP 192:sR/cBzr/7IYinhv75pAPRp2lD498Hsb+WNnrw4wUMn2ZskiBAgu41HVyIsnAUgtK:sR/mzrsXxVUXjuw8tpn2ZFiBZb8
TLSH
T16152B82EF910697B5CDBC32AFA167B27D7F6202165D41E84E6FC8A2C25E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4dca0c7bc2bdaed1cc8ebd3305e0b2e821df84091796ed1a9cbe6e6a90b08388
MD5 cc22423e7c9e506c3f3c9fc864ddd0d0
SHA1 787eb49b7dce26ff6e6f6c6cdfa93e9b374b1333
SHA512 ed4d6b94d595a2af1fd64f612acd7446167affe9c6303c59bf7d9817aae97fad59d208a77ff89e9dd1ac7fc24c7d7365e0aed656afa39cd1973e5e239ed78aaf
SSDEEP 192:sRLcBzrBeainhv75pAPRp2l7lr498Hsb+WNczrw4LHeD0kiBAgu41kVyIsnAUgrK:sRLmzrgxVUXruwJMeD9iBZKe
TLSH
T1FC52B82FF9105A7B5DDBC32AF9157B27D7F2202265941E84E6FC8A1C25EB5CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 727cf77b3ec94a7e4e60ec18d3a754c68f29c17424aa5008c2a4aa4a59368f9e
MD5 e2a046e4b7c822abdcd8debd7c27c18b
SHA1 d9124755470d8b0752ed4dca635c61532ce72864
SHA512 28432c25a0fa6392b4a58fe03b6671131e86eb675ff6932ed627fc29c00ec95d32f95e72fa9cb6ef9ec26b344d1b604d0e8ba15fc326e40dae528b7513d27f1c
SSDEEP 192:sRScBzrBeainhv75pAPRp2l7lr498Hsb+WNczrw4LHeD0kiBAgu41kVyIsnAUgrK:sRSmzrgxVUXruwJMeD9iBZKe
TLSH
T1A052A82FF9105A7B5DDBC32AF9157B27D7F1202265942E84E6FC8A1C25EB5CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 453447799ac194d92449ce71f6e1a5937d12dc8f36d6b0d30064f02793a1e171
MD5 77e33282b8ace777314c2586d491c81b
SHA1 9a5104a38831875adc1b53ee4b010c0d8e470f66
SHA512 2deb13bdd47af8a93bf45aa7a6331f7e270fbf0037a9fa49041edd41fc3cd6b7c349bdd62aa616f192d041a731528540db798bf479c69297a5c861c6389c076f
TLSH
T1DCB0120180465141C19202B41242548C7158EF15DE1A1B0143F06972EC291A28014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a100f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a100f.TMP
Size 96B
SHA256 2396812c2bc668f4bf53997321a286cfe70dd5c4b696eee774ddfbc74b7046c0
MD5 26a5675ab84470d9919a9014dc77dabf
SHA1 ae0dd5044c62454ec6d05b06767576d303904ce2
SHA512 bbce67a5c45ce74f0b77bd2522935fc23bacae444eebe113a85a67a2c263f92e6bd97b38c55f75e03bd1615825f2622ad97e562c0bb0f8a79eabdd3fc11ed4ea
TLSH
T17CB00259E102A323D04203F0259696EA75B1DF2ACB03121293E55A66DC797B349363B5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 cb3b92c5d4154660cd7fb3dfba1b8863bebe1fd1640a1f95bc864261ac52fcfe
MD5 6865b762828d96333a1db194fc9ef4eb
SHA1 007c40cfe50510f85ee5bb46b025385faeaf211f
SHA512 663d58cb422cc6f48630944f2e44c42d597c2ba976d3bdd0e0c795fbe3592ebaa132979aeb92da22c9bea63bc136101c1c72f0c4c1a0adf98e10ad37c131504c
TLSH
T166B00212C5A8852BC21C137576CA8F5033682C611353811146D524D5E96A3C1569AC47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8425a45e250af2ef4a0e0177aa57a41c94e6b8794a10e02f206d248aea01cefa
MD5 32ce14d843eeffa395b2dc5cf1f359b1
SHA1 b121ee6e383833838e25221cdf707896f6325725
SHA512 40db5541316bfaa8d089199300e88cb1c8f8b7192cf053afa8f0512c6f0fa3377a3a73d2ed97c4425735a5c7275f6796fc95678a9cd303ed6c4e84e512333989
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:gm7Rkm1tYpBeh2BAoF
TLSH
T118C3123B5D70A97759B9BB4EB08E0B1E1EF149A6C930DE92C8D85B0477FA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a9f77fb044810c8333b666e37659e2082a7f4e4672d58cd6b2c2fff4540be723
MD5 dcdd2806a41b334986e7bee08abadc5e
SHA1 6a71270390a44e1070d34a7f6b752f2bfe8466d3
SHA512 2e1e51246250201041ac72d1148d2ed3b1e3e80c9bdee3067e222efad185927c563df136ba3851b74ad08b46306b3e3c91312ff4f5d6263f9f71a062eefd4134
SSDEEP 3072:WrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:Wym7Rkm1tYpBeh2BAo8
TLSH
T1A5C3123B5D74A87759B9BB1EB04E1B1F1EF149A3C920DE92C8D85B0433EA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 42084eaa087648c12f93298927f16c4acff1e5ceca4ad5f253c69d3a9d276d64
MD5 8bf210ab443c77f72739aaea59c75fd9
SHA1 461c853902abbb299a72cea090552f31ff022f16
SHA512 0d635c379a678c93f160432f7a3eecc87ba32c959d71b48c54e5a234e993df97e4f2a42238367e45ce346d4fb0eec3b1cf4ee3a3badc9a20bb77c1c455590baf
SSDEEP 3072:PrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:Pym7Rkm1tYpBeh2BAo8
TLSH
T163C3123B5D74A87659B9BB1EB04E1B1F1EF149A3C920DE92C8D85B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 369KB
SHA256 1afd45fe5c079bdb248f24bdef5b4b93a316fe46718db5d1b9b155d10084ea5b
MD5 7ff942f9245f34af13068ec958c59705
SHA1 c61d8dfcb4373b72df575e2ad8c57da4e5601ee0
SHA512 d58c8b85bf91327e116a389094fd3c026014a4b01971d03e6bf24015e5c344e4f15ad11bf3088c53b482da859735a29a630fdd7ae7a9268bf0e894d1ffd6f0a0
SSDEEP 6144:xK1XV1ophNdlyF3AvzmtcBUb9VgUEcb4/MsIT+CvZBVm7Rkm1tYpBeh2BAoc:xWXAXyF3Avzqb9VgJ/OTZBc9oBGcAoc
TLSH
T11D8423335C21E9BB54BDA72FB48D2D1F2FE1DEA74D608C4B4D51EE0225AEAC66904C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 594e7bd592b880bc4f48fb3bd5b2444260184c4a662f25b378b0806df0f7f206
MD5 3847838d3dedd031161662501457b368
SHA1 fa5cb3bf58e9f6ab095e17568d59accec9055caf
SHA512 8ae283c76d143108bbd560f267ebbc4859faf838b13ba9c7d646cf375e9c939b7c792e25744735d3c2a6fd050c47d3c29f51af4953ac9614fb37c66fe18a325c
SSDEEP 384:PJAJGVMczkkrtuVm+grzsQOVjeQ8RJoP5ghvjUkBWa5PGm5x+GDa50XYScm3iYXw:x8GVMGrel8RJI5gZjUkBvPx+GDa50XYL
TLSH
T112A23A743AF51315F3F29F759EF1A95A643AB866AC00DB4D016202890977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4C28.tmp\AccessControl.dll
Size 10KB
SHA256 4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
MD5 055f4f9260e07fc83f71877cbb7f4fad
SHA1 a245131af1a182de99bd74af9ff1fab17977a72f
SHA512 a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
SSDEEP 192:8SEWBGgiJM4LN+xq56XdNcNz/NWdlJmlyOcROQ:8SEPgii9KTzyt
TLSH
T171221A569F3493F9F083953B595269178BBAD24180C09C072EA7FF8D464074AEEBD317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISpcre.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4C28.tmp\NSISpcre.dll
Size 164KB
SHA256 43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f
MD5 bfe060c22b44914e05d3f5367de6c9fe
SHA1 24c72b0b57b0066a5e8b235104a0502400e44b9a
SHA512 ad3a23edd8d62b198e4a2ccf03f6d607dee41fa23fd6f9dfabdc5ee424b5e22a6e00b8a28e50fe177829a2cc25ce05484423e97c682036fc5146e2adf560bc44
SSDEEP 3072:5YFyk+vtvpoYYPkoYMtXTP5V+4Km//sbJVlseEOb+Y+UT:KFyznYntXL5XKCk9MeEm7
TLSH
T1D6F38C41F887C4F2CA4B433A587D63165B38F7440BB68BCB7F845E7DBA916822D6124B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4C28.tmp\StartMenu.dll
Size 7KB
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
TLSH
T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4C28.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4C28.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download