eb57c8fe7f0de703c650d5e26e35534ea4057ca68a233dd8b1af67ba3d64ee42

Analysis

user interaction
yes
max time kernel
269s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_manifests.bat
Size 6KB
Sample260729-ca9fgssbna
SHA256 eb57c8fe7f0de703c650d5e26e35534ea4057ca68a233dd8b1af67ba3d64ee42
MD5 3bf76a96350d5d9fdaeb21359a3cd60b
SHA1 9e475e7529b6e960d32597dfe32094a5d1d6590d
SHA512 5f97a8c10271fbe2aa15768e2263816e7cafe69ef7c670a50a0d2eb9eda27d3a9c7a26b95954e63ee9a8c332b9cb45124404e6b4a3ee8c128eaf726c964fc0ae
SSDEEP 192:6I54Nr7Dq8LDlF+xA8OPStJSCoygQyiH+og17CZSMR:34Nr7O8vo4Pac1bMR
TLSH
T18DE17820FCE141659192136629A7913D7B9942BF91091F50F9AC83C0BFD673D8FF4276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
156	4160	powershell.exe
163	4312	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
156	raw.githubusercontent.com
163	raw.githubusercontent.com
155	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1464	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1880	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297637496158541"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4832	powershell.exe
4832	powershell.exe
4160	powershell.exe
4160	powershell.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
3980	chrome.exe
3980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4832	1464	cmd.exe	87
PID 2220 wrote to memory of 4160	2220	cmd.exe	109
PID 3760 wrote to memory of 4048	3760	chrome.exe	114
PID 3760 wrote to memory of 2016	3760	chrome.exe	115
PID 3760 wrote to memory of 2016	3760	chrome.exe	115
PID 3760 wrote to memory of 1880	3760	chrome.exe	116
PID 3760 wrote to memory of 2420	3760	chrome.exe	117
PID 3760 wrote to memory of 2420	3760	chrome.exe	117
PID 3760 wrote to memory of 3608	3760	chrome.exe	119
PID 3760 wrote to memory of 3608	3760	chrome.exe	119
PID 3760 wrote to memory of 4064	3760	chrome.exe	120
PID 3760 wrote to memory of 4064	3760	chrome.exe	120
PID 3760 wrote to memory of 732	3760	chrome.exe	121
PID 3760 wrote to memory of 732	3760	chrome.exe	121
PID 3760 wrote to memory of 4436	3760	chrome.exe	123
PID 3760 wrote to memory of 4436	3760	chrome.exe	123
PID 3760 wrote to memory of 900	3760	chrome.exe	124
PID 3760 wrote to memory of 2060	3760	chrome.exe	127
PID 3760 wrote to memory of 2060	3760	chrome.exe	127
PID 3760 wrote to memory of 4920	3760	chrome.exe	128
PID 3760 wrote to memory of 4920	3760	chrome.exe	128
PID 3760 wrote to memory of 1984	3760	chrome.exe	129
PID 3760 wrote to memory of 3204	3760	chrome.exe	130
PID 3760 wrote to memory of 4892	3760	chrome.exe	131
PID 3572 wrote to memory of 4312	3572	cmd.exe	136
PID 3760 wrote to memory of 3980	3760	chrome.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install_manifests.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -executionpolicy bypass -command "iex (${C:\Users\Admin\AppData\Local\Temp\install_manifests.bat} | out-string)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc0e75c728,0x7ffc0e75c734,0x7ffc0e75c740
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12861989812081823510,6769195358280841225,262144 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,430869720340123769,7707977401929149496,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11966993452886065162,9968944440466321412,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,339983579995343599,10770270887242200209,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,8769662167564746687,13685743124369656507,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,6446421944184950298,13472401969468277455,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,7369325105302150377,11424610839586424900,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,10365074236650805382,7369530832999780512,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5636,i,6895092808746862533,9659312506408559113,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3516,i,5666347939806777776,18211981131698494164,2097152 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,13312520704693994777,8646441795629393165,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,12291034616912859861,18355322940708363291,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,17650737722890477510,13182020680610451680,524288 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,6702514503986889164,1283645083513263227,262144 --field-trial-handle=1908,i,15354121386227562499,2317628504790996051,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b652e994495f45f5a373a546479d7e048c35f558c90f5f65aae1fbfa342a6a8b
MD5 687a63e2aa8c5e734aaa03e2cc91c1d6
SHA1 b53ee4dc4cdad372654c21b394281f83a7d0e66a
SHA512 97f3b6a5806a44e15d84a74a5549b4891632236f9e86f5ff0a665a7fd8490c1e20da39c83cda829056d066f9b1795d318096f4c42eadaf05da1abdb37c791831
TLSH
T1BFE02B99C821EC375DFD871D50950A46EA1113671761845B363C9108CFB0677068585C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8357398e8f9570e16241d42e8e3cad952e8de21487966782b296ee13c2c3de17
MD5 a64362f185a25bf032bcdebe0d7a48b6
SHA1 7de86743c1619e382cb737da83bb2d514e1f3a80
SHA512 edcc69ce3100c85933620f142c939f1a550b23abe98f4d9ab98b7335f91940fbefeb3f8aa0b611c05fa3963100a0c29325d7093ffff6e09b456a89503bb187b5
TLSH
T1758170CCE8E6B09CD34CAE3437964740BA348B5842471EDA1393FC363AC4B7BD240544
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0a76895a5241dafc24b6ae5759137b3e6cdd4603e0d5c9a58533cc76d6998deb
MD5 aac3d31ed167d9f93797fb699e708fe3
SHA1 b2edfc9f7012358b656a082e186f3f3064a0befd
SHA512 9f1ee1df41351783bce05d1bd0386e673f532f697b3ff484e176f0429d359b53969c446a19af79810b31edcc26e7d20fab11f50b86bed248613edb3edbc00656
SSDEEP 192:De8QZ87Jm7muUaIIRMhzhOiVPQXIfIZKxTmmmtmcmDmzmH:De8QZ87Jm7muUaIIRMhzhOiVPQXIfIZ0
TLSH
T1B4E1AAF3C3E8C62D891156F4EB15AE1FCE290A24431D3C66C9E5AE5B93E2872D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8bd01113f35b753ff9f933d810b392a7ac0e0103af0ef9f4b230d0d79a759489
MD5 e2553d83c643a51c0785039e928bafb1
SHA1 b098e1a20060984de30a4677961c394837f0fec6
SHA512 82b63801d558c8b5163114f731263d73fcae28ec24783e8e94b82a772c4acfb57bbe39068d8baf05bcaeb0823372efe826ff9920358a09225b8bff22120a5d8d
SSDEEP 192:9RvcBhulwS8Ey87v7ApAPRp2Gef9qHsb+WNn0T4v82oQ264kwnVyIsnAUgtaJ:9Rvmhuu8DkUXckwIL2N264h8
TLSH
T1E852F82EEE146A7BACCBD215FD657B23E7F5103561842E84EAFC8A1C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e60749bc72e1fcdbaa049731f4fc2d35e0bbb0189f21190857ea8e33de048afe
MD5 02e297a9f56c88d033468d59a1e4532d
SHA1 4862de2feaef301795ebcfc2489bdeafd59c7821
SHA512 89c895bb43b03ff54e474ea1f69429a8380fe64bda089fc019767c09d69bdac7b13d9842d6e6b8633185e868e614893dc31547cb98f623513398d350ccd94159
SSDEEP 192:9RvcBzulwS8Ey87v7ApAPRp2GqB9qHsb+WNn0T4v82oQ264kwnVyIsnAUgtaJ:9Rvmzuu8DkUX+kwIL2N264h8
TLSH
T1E552F82EEE146A7BACCBD215FD617B23E7F5143561842E84EAFC891C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c1505991d772c454b931660e185a70578c0722ad803d7ac3916b5aff09d38f88
MD5 be1bd980a662b9381d314141c86a65b5
SHA1 1546ff98032cd53a9a837e030a6d5fdbed6e2fb5
SHA512 09e45731364290c5dff62dba1a18c041c5c852c30e0a8fbb7c05499c23165affde8e8eaebda88b52eb890e8c42185bea90c837789ec7ee12e88c1f4fdd0272e9
SSDEEP 192:9RvcBhulwS8Ey67v7ApAPRp2a/aRRf9qHsb+WNZ70Tvml+v82/Q264kwzVyIsnAq:9Rvmhuu6DkUX0RkwmoZ2Y2641e
TLSH
T1AC52F62FE9146A7BACDAD225FD517727E7F1243662802E84EAFC8A1C14E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1ac7c87f1eaee0a1f344e23a2c210c79949923e27cc585a48cc4990db5a73b8b
MD5 014fbbfc9a0677608387bad96561ea59
SHA1 74f92d099cd279510f6f7a51d952c457b9ed0449
SHA512 eeba8e09561bf286394c8ca2bd054e155d482f271127ee345404a8fdba8ec25d86978b6ed199464168a38fa7e492a3dc1a910dbeacf416013a53caf4411af8b4
TLSH
T178B01210C0015141C44242B0115224887114AF14DA0B270543E07D33DC291B28A14151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7e1a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7e1a.TMP
Size 96B
SHA256 8169ce16132f2b03c2e69ce14fdcb42c86099d7692bc402b247a40452ba26462
MD5 c5d50be0252ddea6c8d2adddaddca3e3
SHA1 42a5c2204a58bf23ddbb4c0b68f1e3c5312601ba
SHA512 f7678b071ebd870b6179eaf7fbe0ef72fe7ed42eaf615651f11d460e44ace1168cf3d31c363ccd37007bfda526048099d7299bf0c202fbf11169f4e6605a9ca9
TLSH
T17AB02200F2022222E00303B028A080C83030CF20C203230382E00F2ACC22230C32C020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 26ac1a804da2170ca4cbf9253ac5751e90ea6123a31aad3c832df1b2519c66dd
MD5 2cfc88073813e12eb63b8c7fe6822446
SHA1 18075b5fccc3a9ae7a7f35c8a98962cf9cf383ff
SHA512 c362d823cedcbc904df1c940e2e27a776fddcfb13717298e229a398fd75794fcb508ddb0b7f8efeabc42b022ccd84b7a60cc9b9a2841574edcc9b13e940bdeaa
TLSH
T1B7B02202000808BBC80233B8A3EC8CC033B00C0023CBCAC288E000F2808230203AEF20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7f826dd4291f44eb286b861c3771c2d303665785ddfc21f08064cf8b386256f3
MD5 36561e32ee8d146cc796ca3874070a42
SHA1 41613f59d4531af29e7b4d05ce31edb6f494a0e6
SHA512 e6dabd8da9c864f77e60394a41e6d2e6061d9bb633d4c0a8b876c5dd918e1edaa59b8caca574fe943961aa569bbbb5cab068e411a93115c86d836e24f1a6ded5
SSDEEP 3072:AxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:jm7Rkm1tYpBeh2BAog
TLSH
T1E9C3023B5D75E83B5CB5A74EB08E0B1E2EF249A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5e981e4b1168a7a8c83f25fd3192bef96d58bcd10bb69b5bc7333475c708de37
MD5 e830da0be95d90bb33adc16e2ee5face
SHA1 fede3774ff7733a9ac4d76107b3a8cf00d9db2f6
SHA512 0cf4dbb3eb3d12f3b9785f236c19c244cbc99d50a10edc992f0965d7ba88428329c21774a575aceca2ba25d14fa891d2a52d70e3ba21d3bc67679a4215af8b4a
SSDEEP 6144:wAkpBSi9PrvukqxdVJL6m7Rkm1tYpBeh2BAoO:w2i1ukS9oBGcAoO
TLSH
T1003413371D67897B68F8AB5B600E061B1DF18683D925CED193949B0927FB7CF0706E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 de92a15a3358ba51928019342c74d19ea39de705f808b9e93d526bc368db9032
MD5 74b1d105792ff5eef9ed9d6d8d3ed5bb
SHA1 b2e268c06a16dca7879cdbc457722e78ab569ce9
SHA512 306a9f6ddf03d67523ad754ee2ff5bfd2f86153b5ba0fbf8b1940360938b87afca3e83699c09f58ed70388a4c19779a76e2a75341ebd24497ef95678617b48f8
SSDEEP 6144:SFAkpBSi9PrvukqxdVJL6m7Rkm1tYpBeh2BAoO:q2i1ukS9oBGcAoO
TLSH
T1EC3412371D67887B68F8AB4F600E161B1DF18B83D925CED592985B0927FB78F0706D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b167f1dc0d85d00501faeea1aac1ef629bfda10fd67cc0b2306399e720f02dbd
MD5 07ccb908d4d4f1f3c1143f518999d389
SHA1 7b706d52c90701be9c8c68025512925c56eea7f0
SHA512 2e915acce6e603bb864cfb21db8662ae63872f8e922bb67aebad68ee5435fb4047906185490b6ddc10bbffb5eea71e3f7f3c54b915956b8835207fa315c76ae2
SSDEEP 6144:9AkpBSi9PrvukqxdVJL6m7Rkm1tYpBeh2BAoO:92i1ukS9oBGcAoO
TLSH
T14A3413371D67897B68F8AB5B600E061B1DF18683D925CED193949B0927FB7CF0706E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 1b04c9be9c6cb393baef4e16517b9f2d9c93a0106371ff7dce7b1f1b7c0dffc8
MD5 6f8d65aee64fded3a022fc64c2ad91c5
SHA1 5940aadd13f9bc2c7c69d3c15755ca06dc913807
SHA512 f3b84eefc90dd8914bf79b0f6dbfc2675d7d414349ed677d8a0fcd939b19348e466566d2e9363ff275b8c3e5c50b31434cd1fcf94d91153ad32112d25ad4f792
TLSH
T17561EC17B3CC49D3D98D5735C08C9C2260EA81979466BECEAF8FC5F0621F1B5BA74164
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dsna5mz3.slj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsna5mz3.slj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 163B
SHA256 d14e9553bb5e4f15bd8ebe10cd7e53d9561cb1dc3bd91caa86b7db087c7919eb
MD5 ed9a8531077860354e434c37a9908a1f
SHA1 6b09dd27316e24ddddd0e44c39e790a5e42a4c36
SHA512 3d66e6a85dc976401cc9108717caacfc42346236c272de8d8589a0fe79832606cd9466530a4d051d7e3d44a7d581c53adc70a510826c3bbcfc891005f6b693a8
TLSH
T1E5C04CF79913151C6E35C99473216DD8587A7424DD72D4B98E3CC81DD18C693626071D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4160-524-0x0000020360AF0000-0x0000020360CB2000-memory.dmp

Download

memory/4160-22-0x00000203607D0000-0x0000020360814000-memory.dmp

Download

memory/4160-23-0x00000203608A0000-0x0000020360916000-memory.dmp

Download

memory/4832-13-0x0000016E823C0000-0x0000016E8250E000-memory.dmp

Download

memory/4832-10-0x0000016EE5A90000-0x0000016EE5AA0000-memory.dmp

Download

memory/4832-0-0x0000016EE5A90000-0x0000016EE5AA0000-memory.dmp

Download

memory/4832-3-0x0000016EE7390000-0x0000016EE73B2000-memory.dmp

Download

memory/4832-1-0x0000016EE5A90000-0x0000016EE5AA0000-memory.dmp

Download