05b00539dc85b2aa540e65413da36b6e2a99edcb717cd935419b9f3d4ff8a28b

Analysis

user interaction
yes
max time kernel
210s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zenith-fix.jar
Size 21.1MB
Sample260730-pdscla1vbv
SHA256 05b00539dc85b2aa540e65413da36b6e2a99edcb717cd935419b9f3d4ff8a28b
MD5 7e8c7a47c04a0918e357637129e0f466
SHA1 c2877424fc555b5c3d25f4503a7b1b15491e6a28
SHA512 15f04bc719fc4420134cad714c451f27acc55f584ac028f6bfa60d8985d6406f86ed01a3c3d5b59b03a1d88827c8d77260f4aec8e0ae7a21ab9c93cbf50bb390
SSDEEP 393216:rV3dY4b/O4NSHTmBjAwtFDbw1JjtiQmfwWETejtGY9/VPWJ8w0009Vy9QsEWt:rV3O4brNqSvtFnwZzm4WEijEYXOJ8w0s
TLSH
T15B2723293E95D16EC247E0F016419877782C3ECAE5D5A01B96B508AE2C2BD9D4F0FFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
219	camo.githubusercontent.com
216	camo.githubusercontent.com
218	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2912	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298873203722773"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeCreatePagefilePrivilege	2092	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4872	2092	chrome.exe	105
PID 2092 wrote to memory of 3164	2092	chrome.exe	106
PID 2092 wrote to memory of 2912	2092	chrome.exe	107
PID 2092 wrote to memory of 3164	2092	chrome.exe	106
PID 2092 wrote to memory of 1064	2092	chrome.exe	108
PID 2092 wrote to memory of 1064	2092	chrome.exe	108
PID 2092 wrote to memory of 2832	2092	chrome.exe	110
PID 2092 wrote to memory of 4440	2092	chrome.exe	111
PID 2092 wrote to memory of 2832	2092	chrome.exe	110
PID 2092 wrote to memory of 4440	2092	chrome.exe	111
PID 2092 wrote to memory of 4800	2092	chrome.exe	112
PID 2092 wrote to memory of 4800	2092	chrome.exe	112
PID 2092 wrote to memory of 3948	2092	chrome.exe	113
PID 2092 wrote to memory of 3948	2092	chrome.exe	113
PID 2092 wrote to memory of 1236	2092	chrome.exe	114
PID 2092 wrote to memory of 4716	2092	chrome.exe	117
PID 2092 wrote to memory of 4716	2092	chrome.exe	117
PID 2092 wrote to memory of 4144	2092	chrome.exe	122
PID 2092 wrote to memory of 5028	2092	chrome.exe	123
PID 2092 wrote to memory of 5072	2092	chrome.exe	124
PID 2092 wrote to memory of 2608	2092	chrome.exe	125
PID 2092 wrote to memory of 2608	2092	chrome.exe	125
PID 2092 wrote to memory of 3280	2092	chrome.exe	126
PID 2092 wrote to memory of 3280	2092	chrome.exe	126
PID 2092 wrote to memory of 4972	2092	chrome.exe	128
PID 2092 wrote to memory of 4972	2092	chrome.exe	128
PID 2092 wrote to memory of 2180	2092	chrome.exe	129
PID 2092 wrote to memory of 2180	2092	chrome.exe	129
PID 2092 wrote to memory of 5708	2092	chrome.exe	131

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\zenith-fix.jar
1⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffef364c728,0x7ffef364c734,0x7ffef364c740
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,8470597307617114953,12102611913655873197,262144 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,7553778158107361243,5837880148011251161,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,18110186366639926551,5736225060962860258,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,6931273849297983495,8921026075442858211,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,6507864301090942885,14369824148763292776,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,5055216185235991574,13202545745569552228,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,8044866979105474406,17234419743288712605,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,9824171396600901020,18179732803221769870,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,8366640259602832586,11399729592039040422,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,13913167168649758161,15806313317927364450,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,6550015547139338216,12511875745138901181,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3284,i,8661786963049434841,1584462975076092326,524288 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5988,i,831552060927114114,11467835521371266316,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3456,i,2769928394127340348,18089294872021507330,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5816,i,8833617808909957198,1441365502084859666,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5828,i,7170753398192098631,4973170509539181020,2097152 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1196,i,15743523631727076491,2497571008213195349,262144 --field-trial-handle=2060,i,10544292841670023699,10174913343797606458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c2589784c461af82a55c3d1e5a1025b09ac21c252dcf82c1e013ec71d4d8a1d1
MD5 5df3a5b6efcc855bcaee7fe5f71d70e5
SHA1 3dee18ad58005324b106cb87e0d030491f20a12c
SHA512 1e4cc38465f83eec986974c0b697daf02dfc84fec23c00bb5bbad6b345d36bfedde0ed3ac3e3e3b6f2c5318ea97b890895e27001cf16f70aeaf41e03aa0df052
TLSH
T190E02B69D961EC3714F90719A0201745D765135B2A40C95F7B3D810C8FB1A374685D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 1.7MB
SHA256 34933f1478daec32d4aaeb33ccdea6fb6ca0b66d40da81fe4eba7a454a9ac442
MD5 8461eaa8559e4f232a0e7151cd94453a
SHA1 937607fe7b77e94580abad16f52217202cc8e3bc
SHA512 7d2b3cacc64c116ab1eb0fa132c8194cb936dafd53102bbc11fd13ddd7cc7fe3fbc5e1e7c5c2e2506d3fb7e13e6bca2522fb7a7146aeb51901145f964416e167
SSDEEP 49152:txJ0+fzMxpdze+Tu+2Sv3ee04WEt+1cX2v:txC+ApdHS+2SfeexN4
TLSH
T11F853306F003F2576FB758F43ADC68FE9B52C3D11ED8F14968B94422468A1912E6F1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 1.7MB
SHA256 03dd86fc602597f8a889a7ba9b0cf02a967fe4b0bd51c1d646af786ee0a62a9b
MD5 d1c5ed244504f69e3a3597e22ddb13b8
SHA1 372e7373dd94c0a3e91d1a0340737208ac629614
SHA512 1be3a67f3d554b7dec732430878470cc10690af83f1365e4f9122db48180be38baa2c9a5fa6ad7de8a38640aa7c4483ae31c5a0161ca62e1f502be8289c3fb16
SSDEEP 49152:sBTm5alx6zP6f1/Hg2kWA31sVSNeBfZsa9qWJgYfncbkNhzDGX:sZuaQPVtsCeBfSEqVYfncbkNhzDGX
TLSH
T17A8533EBB46B4965D8F8B537C77228054BAC0551474828D2B8D7788B80C9B7EEDA4FF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7ca4e085ece59811d8642860b2e4e25c87b3f60fc54def020dafc9d1ad3540f
MD5 7ecc33fd1a3f2ca04e7ef5f1204a156c
SHA1 330de79fd4ee98b9f2c9f13ac83c203e0bd724b3
SHA512 a93606a2d15507ee44aef7102b88e3ba07048863f980984733679f260034171442f412c21df3e0fb3cfee20d16e05292d0c383ba10531fdf27ee5577b6654765
TLSH
T10281080F34818456EF9D16300FE15C8FB27F9A61E6574EFA5536087B90097BA0D7C4D8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ee5a17a2004a3852c8efc5f3706dbdfeefcf879512318ea34cda49b71c6e9aef
MD5 ae29a79baa4aef0f81f479354bcfe4ca
SHA1 38dd1490272c16a999a12b84f74fafeb9272691e
SHA512 e399b7629d35122ce5b5c63ae68e89ab79be248043fa2ac9da93fba693c42fb0fea59da4a86e882091bf01ec687b243b8cb361e9e83a399be932ac5cad6934d6
SSDEEP 192:DUFva8DJiJQmasmRaIv9hHmXKTzaPB6IKvtfPwYNPqHAIUImm9m/mvm4jhnmtms9:DUFva8DJiJQmasmRaIv9hHmXKTzaJ6Iu
TLSH
T16B12ACF7C3E8852DC91156F8EB156F2FCE290A24431C3C26C8D5AE5B93E2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 51925db5dfd8e17fd7a850f5e990620a784cc7b626f8a41f865747688dfd2a35
MD5 1705741682d420b30d832a9c85ec2af0
SHA1 0b3dec6bfba782ed36811a6aa9f51ca8bdc95c52
SHA512 e72ef35a0b00382da27fc9f5f12436c1db7b179fc01531e2533afc63f9777c4232e8e41ca069ae692c59bcc8b33743d11c00001da4c052bf83d5922895d64459
SSDEEP 192:9RRcBzXq08X+R/rPv70pUPRpmd4inUTr9+Hsb+WNdvyplCrx22N2uMkwMajVyIsB:9RRmzX98YrHgcXh8w9I20saFe
TLSH
T1E862B42EAA106D7B9DDBC229F951B716D3F62021A5942E84EBFCCE1C05D76CC321712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 72835ee22014b2519e0e1d389f5bf1cb7ceb44e76f2c2380a9ca5dbb322f777e
MD5 32a46226009948a614fffffd6dbf7910
SHA1 eaa0b64908105626e2de13c825e50fab9964427e
SHA512 6a1f01cb10b38da001b257cdc5425f7a216be811209fca68b40be009e5823caabd84c988d7e7731b56a02e14eb63f651067241a78faf956f249841199b59fab5
SSDEEP 192:9RRcBzXP08X+R/rnv70pAPRp2dAXdx9+Hsb+WNWxlCrx22u2uMkwMahVyIsnAUge:9RRmzXM8YrvgUXz8wfI2psaHe
TLSH
T17152932EAA106D7B9DDFC21AFA617712D3F61121A1942E84EAFCCE1C15D76CC3217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dce81828233829ceb0f8758ab98531d9c07b106bda3d1e7c1b5902009ca76815
MD5 ac9aba997ebb773b80051506b3bfa332
SHA1 fdf075630e11d39213e0b1e47701c867782603db
SHA512 cb96dabe51b51d6bf4e835ec1831a572848b46b4c95c4b918050d90b9d6d0e35f498f2641525dc393db34b53b952a59c627d7dfd025d743199432c1e1fb81563
SSDEEP 192:9RRcBzXP08X+R/rPv70pAPRp2dAnUGr9+Hsb+WN9yplCrx22u2uMkwMahVyIsnAq:9RRmzXM8YrHgUX18wpI2psaHe
TLSH
T14552932EAA106D7B9DDEC21AFA217716D3F61021A1942E84EAFCCE1C15D76CC321712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1abefe4eb84295d93996d74005a2bf6bea2d338153486659ef0f5545abbf3d01
MD5 13b8b9d67ec0d4b3ba34c9a38e02a7e3
SHA1 2dd627e1ea4c2e2d21d7a1d56045759d158e437c
SHA512 f1edc9ec3e2bc47b71d6a2b303fc63ae203105283a4575c645aad0cedb929b8f5806fb594b32546c7d4003ff8920b8e68b7eecb3b7dc9693439ada2eada94b71
SSDEEP 192:9RtXP08X+R/xnv70pAPRp2dj9+Hsb+WNnSn012uMkwMaSVyIsnAUgtaJ:9RtXM8YxvgUX68wI0MsaS8
TLSH
T16E42B52EAA10697B9DDFC21AFA627713D7F6102161952E84E7F8CA1C05D76CC322712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2e86b92c0135e7a12da090bf4dd1cb29a71f1c9f018d9c315e5e1cd0bafe26ec
MD5 7e2e5f12f2c8799f2b6fcb5610d127ce
SHA1 55f8f56cbd9b62a257bda9f6f5df4b464b90c0f0
SHA512 58030a31ec565013cc1902066ab8181aab2ac0d4d2551ac2c8f87662bc080fc964a5a0b73648c55c3052d6a4a89954c3944286ac2e6df75449a7af619cab3b56
TLSH
T12BB01265C0015141C04302B012561498B1145F24961B270143E4AA27C8255A280290A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f69b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f69b.TMP
Size 96B
SHA256 7a6876670122fde155f8543b97a917c5e238bfe90baad5255dc68980043028d2
MD5 9cd2602358422c66ba9b031561945a44
SHA1 6e51adec4e5d71062556f3d9850ac4e32e543ecf
SHA512 ab84e92da0c18cf905d743d175ebe5e2f867f9df2a1ad6b3382087e657a306374e86365e132ae78308b096d7deb8aeae6a3950f70e875312d4312c12b52bcdbf
TLSH
T1F5B002A6C2167312C44603F1269599D8B160DF26C703D71692E06AA7DC296755529268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c87252397047c18a2005e4437e83783cb39b29166c98a63d8b4e48e1bcfbfac0
MD5 330c0633adef740d07a774477ad83635
SHA1 39e6aaf10079c3c7eec5a2e0c1ff5f27ee1e4b1a
SHA512 26d52520e3d9e22b3b84f2eb326f3eb14eca8ba446b00719a288dea18a6fe4a3d16cee4d45720b8d989b8f7ff011cabcec9cd55815ab9c0a156968e35b1025d3
TLSH
T1E9B0222023808203CB000330AACE20CE33230C28EBE3803BA0F008E0C0B02032320200
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 270f4bfe2c7f0c88dab25e3c683363eb103dba66592ae8b6baa9d7b7d196c8ae
MD5 53c405f1f200636a0d0292a57a8fa578
SHA1 9d446358170eef6675518f41c01590dfebe65792
SHA512 af8bfcc4ddb4d550fbc475934df4cf015c95025b599fd59a543ea456a70f711009f3090f0311ca71c075379173cd46c0563f19e1a58e2ff6225c98911fc75f98
SSDEEP 6144:Pbhck6sr0vF191xGSD/itJVXYD5U1DqZ/ZLW3Exi:jmtF19rrD/KJNY61DqZ/piQi
TLSH
T11F342236BF101F335E92479031532A8AB3F18876D2B49141F7EE7F8F2C97558990692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b5e6a5344542dc324670fd2f0db8134f76b0f3d7c4ba6d39e21c129a3dd027b6
MD5 3a1e6e980ec9693543fcd9198156400a
SHA1 a9c84ce9df9e9b6a4038c129ec3705be6ae8f195
SHA512 0935307f1231d75846711190b514904b7dd4d95ec44db6010127003869b5526debf9be79c41399a50d8bde12d712729eb6f65289b2432f312b8b63250df6c6d2
SSDEEP 1536:b8LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:oqfd7NtZL8cHQRZEQ6Sps3
TLSH
T13FC30237ABC21F339D93CB64B9130FD667B644A9D034D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 718a0467eeca675f4e75564ea52a8b9e9d441d0f4da5dfdb87f5510e326f352d
MD5 3afd8450aeda6f26f32863802b7f9dbd
SHA1 5e5350a5c4c878d8a8399ffa559451b261332b45
SHA512 8064698ade69c025ac61b8fa53b540303b2e70258905a40b02e9d58c52957f76bc929691658c0d84796184f733238282e7f521214653053cf045fc1444d6caf9
SSDEEP 6144:Ohbhck6sr0vF191xGSD/itJVXYD5U1DqZ/ZLW3Exi:CmtF19rrD/KJNY61DqZ/piQi
TLSH
T1BE341233BF101E335E92879031432A8ABBF18877D6B49245F6AD7F8F2C971589D0692D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-2-0x0000011880000000-0x0000011880270000-memory.dmp

Download

memory/2372-13-0x0000011880000000-0x0000011880270000-memory.dmp

Download

memory/2372-12-0x00000118FD910000-0x00000118FD911000-memory.dmp

Download