f25a9d98c26930beeda3cf692ce18ea201414b4c4cc3094bd844470f91c797d7

Analysis

user interaction
yes
max time kernel
899s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ram_ui (1).exe
Size 13.6MB
Sample260729-23ffjsvand
SHA256 f25a9d98c26930beeda3cf692ce18ea201414b4c4cc3094bd844470f91c797d7
MD5 e373182679d2ffbad015f122978271a5
SHA1 4f4500df40b52b62e8d80b0251177f55f319bf2a
SHA512 0de51f6e0b6ef55cd3ca7f9619d656e48af90c7866b2c0f0647dcd0e15c6fca55bcbfb12d165e1f025b5610d1d0ce63cb341a0f741052a613d785cc4d6eb209a
SSDEEP 98304:7niG9D9VmhTyl5YuD0dApvLUwEcz4/JaT+SsydAC+bytw+2wxx:7t9JVwdcLUwzgy+Cftn
TLSH
T131E65A22BB8A99ACC05AC47483468A735A3170CB0B35B9FF45D456393F6AAF45F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298399985994066"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe
Token: SeShutdownPrivilege	5292	chrome.exe
Token: SeCreatePagefilePrivilege	5292	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5188	ram_ui (1).exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
456	ram_ui (1).exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 5996	5292	chrome.exe	90
PID 5292 wrote to memory of 5268	5292	chrome.exe	91
PID 5292 wrote to memory of 6056	5292	chrome.exe	92
PID 5292 wrote to memory of 6056	5292	chrome.exe	92
PID 5292 wrote to memory of 1432	5292	chrome.exe	93
PID 5292 wrote to memory of 1432	5292	chrome.exe	93
PID 5292 wrote to memory of 5524	5292	chrome.exe	95
PID 5292 wrote to memory of 5652	5292	chrome.exe	96
PID 5292 wrote to memory of 5524	5292	chrome.exe	95
PID 5292 wrote to memory of 5652	5292	chrome.exe	96
PID 5292 wrote to memory of 5776	5292	chrome.exe	97
PID 5292 wrote to memory of 5776	5292	chrome.exe	97
PID 5292 wrote to memory of 5400	5292	chrome.exe	99
PID 5292 wrote to memory of 5400	5292	chrome.exe	99
PID 5292 wrote to memory of 3348	5292	chrome.exe	100
PID 5292 wrote to memory of 3968	5292	chrome.exe	103
PID 5292 wrote to memory of 3968	5292	chrome.exe	103
PID 5292 wrote to memory of 3376	5292	chrome.exe	113
PID 5292 wrote to memory of 3384	5292	chrome.exe	114
PID 5292 wrote to memory of 1372	5292	chrome.exe	115
PID 5292 wrote to memory of 416	5292	chrome.exe	116
PID 5292 wrote to memory of 416	5292	chrome.exe	116
PID 5292 wrote to memory of 4452	5292	chrome.exe	117
PID 5292 wrote to memory of 4452	5292	chrome.exe	117
PID 5292 wrote to memory of 2176	5292	chrome.exe	125
PID 5292 wrote to memory of 536	5292	chrome.exe	126
PID 5292 wrote to memory of 536	5292	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\ram_ui (1).exe
"C:\Users\Admin\AppData\Local\Temp\ram_ui (1).exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc25c5c728,0x7ffc25c5c734,0x7ffc25c5c740
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,6512627934841174708,13281671343954829354,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,14371612025310960237,9544405588878389572,262144 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,4924716901656448902,8095698474007949722,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8833387958160729793,18270173926377411502,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,3403475534025806194,7487268033474379322,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,2984182627206435010,14095507602293459517,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,2543786673277403115,9121942228084912824,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,13146871904344157773,11357136593348078158,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,11059465851227208079,11725980389151600360,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,193549054525888103,14535836428015533354,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,14483179173280283475,433485852220453024,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,17715255456498940093,4076333185704795282,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5668,i,1074238531540766045,15785212828630848182,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5960,i,8291312725761513287,14694023250088524229,2097152 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1136,i,2844900668150728297,14948417380963241394,262144 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,15033489884972465482,18090443761657044366,524288 --field-trial-handle=1976,i,11121453745075232531,12880364810089156391,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1312 /prefetch:8
  2⤵
  PID:536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2064

C:\Users\Admin\AppData\Local\Temp\ram_ui (1).exe
"C:\Users\Admin\AppData\Local\Temp\ram_ui (1).exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 17c8b4a7cf4e6a82e7f6ccc356ed0ad88d94af45147852945123b19cfb612eaf
MD5 dc96e6edf40b9c0a49d6541ca81c2709
SHA1 b8b8722135cf00f493fdfe05f2d585561cd706d5
SHA512 c837d5c47d08876a30dfaad394e3c9de4b9b28b4a749c4834f65528208a0dceb6f34beba7263398ab34baba9a053b7ea52821ddde5c645dc004059840a0354d3
TLSH
T1A5E022AECA62EC371CFD076DA0510B89FA5513473B40958F3A7C89098FB523A4296C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 8a652ba5108555f760584359707e35c4ecfe788138172f3394d49f4e196abcf7
MD5 ef870826b9bc4e0e0982fb3cf14d995f
SHA1 9a7045cbc884fd69a025fbacc79bc1fcf2d27c18
SHA512 1c2430095bba5793c3e13ed6f4b0a691e99723c30a4f060088f6edbafe69bc74e517b90cd917a225136a765e22b018aac6d44773e57caadc445aa13d8ad01617
TLSH
T171F0AB4E30C7C579CFEB70FE44F78AF42CA8067A614ACB0E809064B8AC52A747054040
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0cfd01e3d19a5809731aa41c2907581c73b26e3cd7bfa75080292eb117403ebf
MD5 6030576e20d65d80e24220735810ddaf
SHA1 29e01d1b16d41c6d03a9105684ab77e12c081a63
SHA512 9a3800180b9ce4d4a2e6d3e9678b22cf1fe623a40641bdca24639e7bdd7777cde09167cc7a915d44ae8947fa0c5be6568bc640b9dad9605076094bc07b25fcb4
SSDEEP 192:D6RPHAgJ9UYaayb5+wj1NNmaLdoNPS1aPAfPL46K:D6RPHAgJ9UYaayb5+wj1NNmaLdoNiaYU
TLSH
T1F9D1BFF7C3D9852DC90156F4DB256F1FCE290A28432C3D26C8E8BE1B93E2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 833d0eca104914d73fe1ecacaf45681901eea6f8bd8a1d2177fa97d36f4e6438
MD5 f09f59938f7d4fcc24dc9505bf494cae
SHA1 a97cbb9d11575cf8469b6afe077f3a6c29eed921
SHA512 8db4f3eadc0b0332fbb309ccc2beaf3c8d7d03ca26a007b8405e4f19531e5526762e806dbd4f64db55a69f67ca632564abd60a67ad8861627345b69af64e7eb2
SSDEEP 96:D0uLhWtxwwaaybEdZl/tNSmkZdoNPS1aPAfPiNlejhq:D0uLhWtxwwaaybEdjtNSmkZdoNPS1aPr
TLSH
T140C19EF7C3E4C52D890196F4EB15AF2FCE290624032C3D66C8D4AE1B93E2972E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 36bb44e39e1e41cb977357fff767c8d62a4a05ac3eaa364adf9d675a191c6143
MD5 0d4befe813a9c9e4b1c6bcef50f7f5a1
SHA1 c8ea6923545ecacbb9f49305c2885173485acb92
SHA512 7a4d839c2f7ae6d73bb2e6d2c440d91641022329c9fefaf4a6c73809d8676140371e83b4a620fa0171463b23026b0b4e7bd92dc4f30fab3118e76823320782bb
SSDEEP 192:D6RPHAgJ9Aaayb5+wj1NNmaLdoNPS1aPAfP85K:D6RPHAgJ9Aaayb5+wj1NNmaLdoNiaYfl
TLSH
T13AD1AEF7C3D9852DC90156F4E7156F1FCE290A28431C3D26C8E8BE1BA3E2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 641d7d52ec1b38b08ac4b3f35054eb0af1b35919271683094862827d073b0ac4
MD5 05dd53bf19e4b4dad848c46a9e0511d1
SHA1 1c9cb5637b7e3eeed4339c129ec55d3410aec9c0
SHA512 18fab4f6ce2e1cd805c30c37dfb736ec2544aa4a42e004d5f38a87e6c91e63cabb6a260edb928325eb726d8c98361a5946b1162a3f125dba03935ce7c6379deb
TLSH
T155F059A7A669B423107E49FB1D047C095CB9A83546826CF4CE9BA1BCE0C04F71B03803
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f5421dccb4c5332dda1ec3e27a4a75de0f043d5fc5fd43231d03090f79bd92bd
MD5 5696313c8bf98de28e45ca39b4de0776
SHA1 db937e6e637bf1f2791288c3880af6c2893bf635
SHA512 fa49041ea63e4138d86ce2ac19934a715333d3ea35cabbdbe9a49534828aac95676883a7b05ffa4bae454038e208b3132d4e1429ff989523c163b52e422985b0
SSDEEP 192:NRocBz7qRxA+3Vv71hp9PRp5FdO92Hsb+WNn3c4g3Y4i3kw34aaVyIsnAUgraJ:NRomz7+BlBhjXMQws3YpIaae
TLSH
T15F52D72FA92065B76DDBD22AF9127B57E7F4102161E52E84EBFCCA1C04E75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 46969743b508aa588368f2a91d89ee61a3ea5e379d38230cdf60ab3f45deda7c
MD5 a0a4dc69f84491963aaae25011d4631f
SHA1 34e33dee7b744608b83e2ee93d1e32c028128d73
SHA512 93d841f8015adcb06419a4f4e3929cb645f52713a7d6465b3ab3d289cc9a1d0d69257f7809c9927bd2fefc5a1952ab9aa38c3981983a73b85e90a7d5ffadaa84
SSDEEP 192:NRocBz7tRxA+3Vv71hp9PRp5FdO92Hsb+WNn3c4g3Y4i3kw34aaVyIsnAUgraJ:NRomz7/BlBhjXMQws3YpIaae
TLSH
T1E852E82FA92065B76DDBD22AF9127B57E7F4102161E52E84EBFCCA1C04E75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7844c42add18ab574cf13b4da71b5259892ae865d6e39262874efd1cad18c6cb
MD5 e25966694443875dee8de18328352c8d
SHA1 49f9ef349e592f66d2335b4c22890905dbd4aa86
SHA512 f53a9f74c29080301e7152ab82741814a9eddcbb548a9920c347e1532dd03f29b4769d4b289c30851a5779abf1bf7b3d246cafdedf3bb0097f5ded49cbb94aaf
SSDEEP 192:NRA7qRxA+3Uv71hpAPRp2Fw+92Hsb+WNn3c4rw22i3kw34aSVyIsnAUgtaJ:NRA7+BQBhUX8Qwsr2/IaS8
TLSH
T16D52E72FA92065BB5CDBD22AFD127717E7F5102561E52E84EAFCCA1C04D75DC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f252bb5db636534e5922d7e91d45b62ffef733e2719329492c94472ede8fc93e
MD5 9853e1aa9a8f7d96c35457300b26102d
SHA1 8312c032e937308cf8ceebbcd6951e7c174aeaf4
SHA512 573fbeeeaa941bdfed161a9cbc527b751198eec6bcf3c14162132737e34cb27733907db8a9233bf314f9896f6d803ecc790d014a1aef37efad543ccda893ac41
SSDEEP 192:NRocBz7qRxA+3Lv71hpAPRp2FdO92Hsb+WNn3c4gHe2i3kw34aWVyIsnAUgraJ:NRomz7+BzBhUXjQwsPe/Iaue
TLSH
T1FB52D72FA92065B76DDBD22AF9127B17E7F5102161E51E84EBFCCA1C04E75DC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 be2e05fa4cfcfbdc02e54256b550bde730c29f3eda19eb182c758078349065a2
MD5 f6b79a772b076a3185844888c5521a56
SHA1 98af363ff878610f52f7409c34ce0c251204d63e
SHA512 4e9ae4ad4efd79edfa1e56a85d8b23a7a8f06573dd9de34055bda8cb97cffe604d4ac0011d58dd523051849566ddd26ef05e29aa9213881dd79c3a12c8f6a8e8
TLSH
T10FB01200C4425201C45202B8115214D871147F27960A370653E07963CC251B2C034050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e74e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e74e.TMP
Size 96B
SHA256 f6bfc9a2f855925ad730caeb8a55bda9004ae5238a1625f6b5837dcb058ce48d
MD5 511ea44e01a361a5b002d90258bb3fc3
SHA1 39e46334ddc31f26a0790b6d0d5aa8014dbbee2d
SHA512 132a996a52ae186ab9c00566948cf8647a0cfb82f41e3d92d428cce81c89e4d87289c13fa872acafad3fca5d0993a100e23d88e0fd8fd691a92dce4c5fd3ea55
TLSH
T14CB00295C1426223D08207F626D597D9B260DF26C713131393F05AA6DC6577599A6160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 bb40926f0952d1fa454a023844e95f6a91e0f2dbdf07c05aaa91150efe7e8946
MD5 b91dd83d4d392779b7e56fa10ff7b6e9
SHA1 2c683ae22c7fe6c313d436ec00e9b1f7aabbc7f6
SHA512 ce72bc848f0fcd5da53891c46ae4abe8a76d9aeb42b08e8f722337cebe321543c69f1e21a16d9da5e3d8a1d7829fab71243fac409a652346c24c45503254fa7e
TLSH
T16EB0220A00C80083CA0003B8A2C000803B380C0C2BC3C302C0F8208C880E303C32E320
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 dfc993a4c063bd5ceccc420cf76db50fb4a4bc6dc6328718e4ca7f0b1de49e39
MD5 faa329bbcd55ddec4f5af7102845b1e8
SHA1 27c876ceb7f45a46c3efaca3bfb75ad49fa60629
SHA512 f6c85ad6ec12477b467ab113acdd5c96321a52ac771193282bb101c2e0e0065ac08f694ed538d49990dbae7a045ea73297e86ff76ce00a322243945da38b3d5f
SSDEEP 6144:v4uLpmIPWCT/06/2aenm7Rkm1tYpBeh2BAox:AuLpmIec06/6m9oBGcAox
TLSH
T1203423271E86ED3358F5FB0EE04E2E2E1EF11561CA69D5B39DC0DB0436AD6D90607A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 492fdae36af564cd29ac5bdbf19c3d3e619b51fc336541b5d0ba33135b2291e1
MD5 fd33c9663a7ebce066857ccc785f7e35
SHA1 236b821b825c6d0fbcd84a3f79d90c5535ba5633
SHA512 5dd4838bb47b5e175c4811254e012a4958dc0ef6cc4fa7c61191977c488cfb49d867749f43103e3b1bb5e2566a8dd8966a52c06412fc22c66accd0149e1daef8
SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:+m7Rkm1tYpBeh2BAo3
TLSH
T100C3122B5E71A9775D79AB0EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5d2a96afd2f986026a977d023c4f083cb7b859dc91e81c739e3417090b3c8d4a
MD5 280c097579c7a9589bb4a5efa8f14cc8
SHA1 3defe20d01e986932e2f6444212cb05c84aa83eb
SHA512 3c7b23cbd1e5bd03eef84eb091d83c92eefc21002b829a411de475cabe5dafab9b31df971bdce858bd1cc880a46c79e34014fd3fc30cd90c6d74e5abd7746252
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:/m7Rkm1tYpBeh2BAo+
TLSH
T179C3123B1DB5A9375DB9BB5EB04E0B1F1EF14AA6CD20CE52C8D85B0423EA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e979d3b8e4aaba0b1695b57802665cc16eb87e4fdb302f52350e51452588599c
MD5 f6c0fc8cb5f7cd74d3b8bafb988ae005
SHA1 43ddffe50e0d76bd29779c9ceea7a801a93a6bde
SHA512 3b40be1b89789b7b684845b1a127657c823fcb4f152d3828aa7b2d4c257553ecefe3347e408db83a4516c45ad9628131fd2993c876ce62b26bc635845baaca56
SSDEEP 6144:S4uLpmIPWCT/06/2aenm7Rkm1tYpBeh2BAox:1uLpmIec06/6m9oBGcAox
TLSH
T1B63423271D96ED3358E5FB0EF04E2E2F1EF115618AA5C5B39DC0D70436AE6D90607A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rm.log

Path C:\Users\Admin\AppData\Roaming\RM\rm.log
Size 351B
SHA256 3cf8d1140f37c722f71f7c2a2e8e71333b0158c271a54cf6861eedae3a890655
MD5 0a7e152945ffba0fc84ce7303366e5b6
SHA1 95a03f9f596b30a84c567602939967fb9eb1c252
SHA512 d5d2876656d94d8e2724e8cf273a88b7d88de4572413c7b1bb6061fca3183c3a81ddb43add084f442336fdc6a2abc69abaf56ddb55d0ab6296b68a2cbde5239d
TLSH
T14AE0DF91A2B0B22E38BB49D4F93ED15AC7D486BCE0929033015509A2D4828664EFE360
MD5 SHA1 SHA512 TLSH

Submit Download