2f135cfbde5fdf185a8a0f3fa19a049285b788bbbf9aef61edce95ad5778df40

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KaizenInjector.exe
Size 56KB
Sample260729-e1bcgswwft
SHA256 2f135cfbde5fdf185a8a0f3fa19a049285b788bbbf9aef61edce95ad5778df40
MD5 7dfb945531fe55bc58cd9d69abfe0654
SHA1 8aecdc2521c673e87280afe663303099ce4586c1
SHA512 bb7441f6f754c81ca19ea1023da5ae61cacd0b5c9b74bdf4a2292bfb866062c80b3eb943476bcea8a320e55e7c103b694b9901845d2fe0d662e2c38acf4cd45a
SSDEEP 768:e3cMQuJ5pabfYHgEyXwgKEL1Yw+Ic36X03JfQgCWvdY7MSXtpf7DfBvFzhs:2wbfYHYSFJfQ/ASXtpzDfXzu
TLSH
T1F843091ADE1A606BD29ACD78CA424D05DE73BC864B91B5CF67400DE60F667E06F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
468	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297726660358326"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6108	chrome.exe
6108	chrome.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe
Token: SeShutdownPrivilege	6108	chrome.exe
Token: SeCreatePagefilePrivilege	6108	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 5900	6108	chrome.exe	101
PID 6108 wrote to memory of 1240	6108	chrome.exe	102
PID 6108 wrote to memory of 1240	6108	chrome.exe	102
PID 6108 wrote to memory of 468	6108	chrome.exe	103
PID 6108 wrote to memory of 4432	6108	chrome.exe	104
PID 6108 wrote to memory of 4432	6108	chrome.exe	104
PID 6108 wrote to memory of 4828	6108	chrome.exe	106
PID 6108 wrote to memory of 6116	6108	chrome.exe	107
PID 6108 wrote to memory of 4828	6108	chrome.exe	106
PID 6108 wrote to memory of 6116	6108	chrome.exe	107
PID 6108 wrote to memory of 5476	6108	chrome.exe	108
PID 6108 wrote to memory of 5476	6108	chrome.exe	108
PID 6108 wrote to memory of 5124	6108	chrome.exe	109
PID 6108 wrote to memory of 5124	6108	chrome.exe	109
PID 6108 wrote to memory of 5312	6108	chrome.exe	110
PID 6108 wrote to memory of 3504	6108	chrome.exe	112
PID 6108 wrote to memory of 3504	6108	chrome.exe	112
PID 6108 wrote to memory of 5220	6108	chrome.exe	120
PID 6108 wrote to memory of 5220	6108	chrome.exe	120
PID 6108 wrote to memory of 8	6108	chrome.exe	121
PID 6108 wrote to memory of 8	6108	chrome.exe	121
PID 6108 wrote to memory of 3040	6108	chrome.exe	122
PID 6108 wrote to memory of 4032	6108	chrome.exe	123
PID 6108 wrote to memory of 3380	6108	chrome.exe	124
PID 6108 wrote to memory of 5776	6108	chrome.exe	125
PID 6108 wrote to memory of 5776	6108	chrome.exe	125
PID 6108 wrote to memory of 3340	6108	chrome.exe	126
PID 6108 wrote to memory of 3340	6108	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\KaizenInjector.exe
"C:\Users\Admin\AppData\Local\Temp\KaizenInjector.exe"
1⤵
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcdc9ec728,0x7ffcdc9ec734,0x7ffcdc9ec740
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,261184372376675548,3028602856327426137,262144 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10455517689372280264,10620704799451246282,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,234718053875768567,2686406224178917201,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,12165434481637804241,17859041465904177721,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,14431799023467486451,7989098847884587359,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,5546810518498807956,14325301717148127477,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,11397383161083428614,14641033666118685533,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,876450311508705907,10253208332057834469,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5948,i,50156127213666101,3394848093538492061,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3520,i,6773299857213124053,551886948638859094,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3288,i,7238758891476519441,12883783546467216989,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6500567753340261111,59359254031159092,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,1866208434939053205,13660625593261944281,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,3827100000984267533,2365417352072167757,524288 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6072,i,6983481956323986038,9070673532303126333,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3452,i,10624753201832406738,14166724892136659978,2097152 --field-trial-handle=2040,i,10470087739495695808,11691022934108890739,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cc1474b5567fd57faae8b26b823c052722d8a3855481e72c06b7c2d824ae14ae
MD5 03a2235d107107597e6750f7a472b988
SHA1 4f2f61306980bdfdebf2714083ecb39e1614b2d7
SHA512 4408feec098266f9d0a31b1b4c7a401076f3879d27997c8b28200c6a4eda3b56dbe285b322e063760a5fdeaa533921fa294572640d7ee06afd64bcd81b53bf86
TLSH
T1F3E0E5AAC961DC6709F9071960501646E65523173A80845E3A3D89084FB422A4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 378KB
SHA256 c62da19a188da6b016c00811a929667469f9d4de64a05d6476a59520fad20a4e
MD5 f1eca6b889a37ff8230e6c011c951e7c
SHA1 be4bf796ec25837e8b5116f37edc31ae5a169ace
SHA512 a6859b02dff22fe0accd830d800081efa12f502a3a71d5fea888e29a6d59882663b94296ad3201e860a8d54337b5c0fe60f110a7d92a98e34542fbb1fc76dfaf
SSDEEP 6144:oElXM2wwgUY4n3nK4uta0tWRLguLL8xkuA8LfAwxAu4IjtAE1KgLCPpc7dI:G2rA4Xr6aykgu38485GIJK2AR
TLSH
T1F484225AD321C669FF120F39F2AFA74AA961F06DAA07054637B8C552C4E58F40C0FD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 329KB
SHA256 25c687205b96239fde86a8fb8805adc440b8008a51b96397cc0503823b75945e
MD5 a01f0dd08c4c8b95a71ffa9120e3c4e2
SHA1 80e22597f43ce9719699cbeed1d897da3d0504b9
SHA512 758955b28d24aab256cb9f601233d9bc7ea535051d93bb17152ee19e605e57e8ef267ea6b58bc2d9cfde5af9af12008024e494e35081923ee4c65ad57a02327f
SSDEEP 6144:RyZkZ2PTX36XV6mALDtvFBHu8xlqOsUpu22CFHZsNTaoGEbx2cGhj:hkD3Pz/tvS8DlE22CFH0TZbAci
TLSH
T1D574234ACFC914EAE5B4F930A1B163821D68CDDB429E9F3F115A3138DECD8009F6D668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 bc4057b2aed029761f8e79a1695370f8c254fb4e868e415958d8eade94c6395c
MD5 956f2450aebd666712e952feb1e5f78d
SHA1 8a8921d08c4dd6137558173053464ee5c8e966f6
SHA512 cc23e787a50605f37d33ff7881b9650994e47e6f134d8989e650264159b2f4e1dc913706e0d5d580903f2ece9075d1d3fd765ce6788e3fb0a126c830bece8379
TLSH
T14411FDBCA5B07852C750E0B9A4E10043383B1B9395A31FE11EC99C32331FBE2B1F0941
MD5 SHA1 SHA512 TLSH

Submit Download

404972b8-186c-4074-90d6-3994a6f319ae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\404972b8-186c-4074-90d6-3994a6f319ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7b3e9587fe6197668c53a87b2c3c7570701e53999a43f65575945c92d3d98d7c
MD5 34403c87ef0e10465a33e141ccde005d
SHA1 0c50c7a45c43691bb7e8ab7e8197cda592d0ada9
SHA512 c567c861e78840d4134ec4cc9917a4a53145020ac5ce6020322248b70d2aa90a71660a847b38a6c9ea71498eca33e713ab9f0eee687a26127445dd7cac60dcc6
SSDEEP 192:DdXONhLUHDQvaaJFRt3f2rGggGdQEAGV6kH5fMfdlc:DdXONhLUHDQvaaJFRt3f2rGggGdQEAGZ
TLSH
T1AC027BF3C3D88A6DD81162F49B246D1BCE691D24532C3C6AC8D6AF0B63E15B1E28574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 c1fc2b830edbcdae77c524bb4e08f03b68268e068a7ab7417b9086d3362b4d36
MD5 01fe770c701aa0e72cdc569bae55b3ed
SHA1 0646e5e25beb7fd85c343c5f9aeadc77ed19c3c2
SHA512 0d6babf4dfbc7aec045945d2ffcc0898865a6565242dffbf1581bba15bc693bf22ff593769c802664f6a8364d0c3d58198036b3aa6bdcce52780fe8c542879ff
TLSH
T18A11CEE3D1BDF41750A94AAF4E10B846197BA830054268F4CBAB82EDB0C08BB0F12493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 05b3ef523ee5719f92d1fcce55114ef5bbda6868a2c54ba03cfa1bdbb47584ee
MD5 75260dd903bba2dfd91845d0b18e7636
SHA1 45a79cd14f249280432240ae5689bf7287dc7b39
SHA512 659f95ec9970685ae71002efa55511af10b634eda9be339b172b25cdf550a54877fafcfddeb5cf615e98293b23b4a2c803a5dd7ebca8df2d1d3290c8990d4349
SSDEEP 192:eRWblJrIDWv71hwAPRp2hc/t5092H1wb+WNfHWMFJX1dr2PkEL2qwIkwGVyIsnAq:eRWbciBhBXqQK97j2cEL2qr+e
TLSH
T13652C56FA92469FB6DDAD216FD117B23D3F1102561E11E88EAFD8E2C04D76CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ae790501308401e58fe7befce1d51edef7764ac6c8ed3818778b057d4e13f796
MD5 44a0bc1a6fc9471aa90d2eed9464df4a
SHA1 3068731124a5723a3ef5904fb892f2ed759a6046
SHA512 c48e731ea34bcf45b7cf89230b7624b533dc0e60ccf464b33ae4efe89a862a07d80ff98a167b35684826c3824cae3ac04fa83bff4670634c49b311cc0b7ddc76
SSDEEP 192:bRWblJrIuov71hpAPRp2g92Hsb+WNnZv0skkEL2qwIkwCVyIsnAUgtaJ:bRWbd0BhUXDQw10stEL2qri8
TLSH
T1E342D56EA92465BB6DDBD21AFD623B13D7F5102125E11E84EAFC8A2C04E75CC222710F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f0f87515700069a985fea57edf3da6229ee6fb88d997bc9ee2d87740a877d88b
MD5 feed6d63c14a5c50de2bf0a042992a72
SHA1 63bf33a53cc0d5b1e5c9546d7e3954573dd7b434
SHA512 d48bf6468a7cd699d812780d1dd67c088084995917fbee04a7da42a32708b38bb55c14b48de74ec313d306336fa654010558ed2b6fdf630bc652b3da7dd0aa62
SSDEEP 192:bRWblJrIuqv71hpAPRp2um92H1wb+WNnZvsBf2wkkEL2qwIkwCVyIsnAUgtaJ:bRWbdmBhUXCQK1K2wtEL2qri8
TLSH
T1D252E76FB914A9BB6CDBD21AFD617B13D7F1102165E51E84EAFC892C04D76CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f3f71d2bc214f778fe9d8097a0887cb7f4aff91a5474b7cc51dbf019c1ec73db
MD5 18ede7a5fbe55d64e1d66debafc28af3
SHA1 d3b62aff4fe6dcb68991d34adcc7cf20189a9515
SHA512 7a9a86ec96d8a2aa9da96909d56ed4942b4cffc33bddcf3a21625e7cc8a6f0b40e3e40ae80be38d580ad665bad856bf6e18c5071a1fd3e95e83c3e00658791a3
TLSH
T1A5B0124180435102C00207F82257548E7155DF11A70A1F0643F0A9668826291C418050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c53f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c53f.TMP
Size 96B
SHA256 eb99221019986c407af023c9963dc47808b37fddd49de3af610481bbbe8f9f20
MD5 99bdf02356eb865b79460c9152b96f89
SHA1 ec994d2095a71b8441878b42e48399967f51c4ca
SHA512 951e5d29e35693004d8a19a3fad8a99c05fa57a57cb042fe1c7c460610e43042459051c47093eddbe2262a10d71c3095aff673a3d77af087c9b695861723ee71
TLSH
T175B02282E0022202C08203F02AC088C83220CF20CA0302328EF00A32EC20A202032023
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 dc1708f9e7b90bb10d95fbb9ce4846ef122555c7f5b69bffcb9efb55b589534f
MD5 98f57981c39fa2aab3a8eade9204e982
SHA1 885e5f6cb90636281ee0629709dcbdd17dd6e680
SHA512 6a101b38bf2a133f6c5fd35ac72888dc5c78c82384e4ce4e03029904fc3788965b35b087a1d6a9d66d112635f61bd19ae59b933df7c4d0b46e47572d27059ac0
SSDEEP 6144:KkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAoB:4BtdRAoeYCx9oBGcAoB
TLSH
T1373422276F3CAD3229E9775C60CE4B1F9CF16AA5DC21AAF582C47B08A2D34D51D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8c3724548d13d801f7681ba58dab7c03dc9f34e11ea4c203c512d55b14871725
MD5 339895a029a4df69655a54fab3bfc380
SHA1 7b8de4c75e36964aa42831d36000f273bb6290de
SHA512 89475d68950c5cc4f44da91279dd5e917eb2b77aa15d7bdef8d489c38f2ff597e192092b133c1292a11734f1956a9185fc81738abcf51f8fd19299e9484597f3
SSDEEP 6144:dkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAoB:RBtdRAoeYCx9oBGcAoB
TLSH
T1A43422276F3CAD3229E9775C60CE4B1F9CF166A5DC21AAF482D47B08A2D34D51D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f22390c2dc57d8c1c95b8bba22d8ed8d3ae5b6e6f245b889b88a884ca1c9e960
MD5 942d513ac116ed89910ad20006d9702a
SHA1 c67254d1414b375980eaf883db39b86a103138ca
SHA512 3df67ba4a0509df46677a8bf5cf710ce15079b63ab0f86ae4b5ff1e7729ef29a8b846c8b6e11b2ea7a0bf03ea0031b907f433d38108ffbda31d6c376c6e9d7c3
SSDEEP 6144:wkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAoB:OBtdRAoeYCx9oBGcAoB
TLSH
T14D3422276F3CAD3225E9775C60CE4B2F9CF166A5DC21AAF482D47B08A2D34D52D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 60174512637724ea0ef574dd54c6e21e449da6d0f6169f4acc247f0bc210b23c
MD5 e4cf45c1f11d41da1800a48bdcce46e3
SHA1 134ead4ac25b4351732aabb22579516bc2ce3828
SHA512 ec2660a10835cad127412c23db14b1bc2d56cd0f23749d15713df9dc685713af418166ee63301b26ffcbc78f47afce3abce702cc2d7f3dc05da5d9eb7e04b654
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:km7Rkm1tYpBeh2BAo3
TLSH
T18AC3122B5E75A9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 f8e6d71e7e9209cd867b497064e582690c25b161d2c94da006a0e07cb2b4f00f
MD5 2eeb0e7f6701e528385e625374b17095
SHA1 1fca4997a4d024f83d306b4288c3d3386b58c11e
SHA512 691d84f55b5419a7db97b395cd187129f939be549e08d81bf6ec178ff985d2507f1cf0269dd5ed7d8a9a5db2a565ba8d5cd005fc1cb5e156df2b0bd0944e36ab
SSDEEP 3:MsEllllkEthXllkl2zEklpT:/M/xT02zn9
TLSH
T1634404047FC14405CD105030C411C3505774F410071157433C510413FCC57401CC1000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download