879e8c503576694a4eb55495284e544607d665a4586a390c74d8af7df546ad22

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13.40 With Bots.dll
Size 656KB
Sample260801-c3c8rawbkd
SHA256 879e8c503576694a4eb55495284e544607d665a4586a390c74d8af7df546ad22
MD5 5adf3628eb4123b889972db704c131bc
SHA1 85b98bec3a82e0f62d1e6aafa81791b86c7e14e6
SHA512 953077856e04ea9cd01fbd043a2af44384109bac7b2d9898edca95e0770d18d2bbd4a952d312cca3211b13d42d24f220345d2adc3d6effb703f25b43de38064a
SSDEEP 12288:SGs8k2wbwSH4FPmyTPPb9k/wk4ph0lhSMXliI9SAu:DhMHUvTPPbWAh0lhSMXlQAu
TLSH
T154E4073E96B240B1D4A7D279C9AB0527F63B780893725AFB03C111196F72A74F637E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300253901643953"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
1896	chrome.exe
1896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4416	4076	chrome.exe	95
PID 4076 wrote to memory of 3228	4076	chrome.exe	96
PID 4076 wrote to memory of 4568	4076	chrome.exe	97
PID 4076 wrote to memory of 4568	4076	chrome.exe	97
PID 4076 wrote to memory of 1804	4076	chrome.exe	98
PID 4076 wrote to memory of 1804	4076	chrome.exe	98
PID 4076 wrote to memory of 1464	4076	chrome.exe	99
PID 4076 wrote to memory of 4468	4076	chrome.exe	100
PID 4076 wrote to memory of 1464	4076	chrome.exe	99
PID 4076 wrote to memory of 4468	4076	chrome.exe	100
PID 4076 wrote to memory of 1996	4076	chrome.exe	103
PID 4076 wrote to memory of 1996	4076	chrome.exe	103
PID 4076 wrote to memory of 3928	4076	chrome.exe	107
PID 4076 wrote to memory of 3568	4076	chrome.exe	109
PID 4076 wrote to memory of 3568	4076	chrome.exe	109
PID 4076 wrote to memory of 3700	4076	chrome.exe	110
PID 4076 wrote to memory of 3700	4076	chrome.exe	110
PID 4076 wrote to memory of 600	4076	chrome.exe	111
PID 4076 wrote to memory of 600	4076	chrome.exe	111
PID 4076 wrote to memory of 2960	4076	chrome.exe	112
PID 4076 wrote to memory of 2960	4076	chrome.exe	112
PID 4076 wrote to memory of 2980	4076	chrome.exe	113
PID 4076 wrote to memory of 2980	4076	chrome.exe	113
PID 4076 wrote to memory of 3508	4076	chrome.exe	114
PID 4076 wrote to memory of 3508	4076	chrome.exe	114
PID 4076 wrote to memory of 2136	4076	chrome.exe	115
PID 4076 wrote to memory of 1492	4076	chrome.exe	116
PID 4076 wrote to memory of 2136	4076	chrome.exe	115
PID 4076 wrote to memory of 1492	4076	chrome.exe	116
PID 4076 wrote to memory of 3780	4076	chrome.exe	119
PID 4076 wrote to memory of 4608	4076	chrome.exe	120
PID 4076 wrote to memory of 5112	4076	chrome.exe	121
PID 4076 wrote to memory of 1896	4076	chrome.exe	123

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\13.40 With Bots.dll",#1
1⤵
PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa8475c728,0x7ffa8475c734,0x7ffa8475c740
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,8597400818483857320,268423694608930245,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,8566750288738469653,4978442838232514243,262144 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,3258868152741038336,2556472596348371169,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8837448198667202654,8156611271560527333,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,13565005390500510261,12901652281672576081,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,7205074782151004914,18261650713934269877,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,10933662690950017882,15348910731370653110,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,10148768098631364072,9698011868395254291,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3348,i,17769058751453087829,14425812840773197817,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,12102106174927500179,7839057674320562411,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,7104787555951761108,17879597476806483851,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,968891202923217838,6068394586610818074,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3532,i,4677269508002610062,3942556552135759272,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5928,i,10429202516068160808,3337154320307126014,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,742046102577736535,737757696958263661,2097152 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,17490016912606368320,5575344563940018671,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,7159006837299161034,13474259118935699921,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,14231125084186632725,16750684916176620754,524288 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3276,i,1373211717560648693,7385756416856818423,262144 --field-trial-handle=2028,i,17980954711623896590,2710842349022729763,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2ac795899ed8ebd799f0007cf3bf08a07e9ad84abee941c8265b43d7539a91d3
MD5 b9e1e82ed1d55673a37fcaeea8d62c91
SHA1 29e83eea030292bc4ed571a891b8202bfd2d7f98
SHA512 9e951a1c83478047c2e44ad2b3670e8f998eca5860e20265ec49668e73abee60192b6c4cfff7c30548ebc3847ea65646a5b41beba018f84ba37b0da06b77b0dc
TLSH
T1EAE02BBACD65EC2B28FF076860558746E650135B2640895B773D990C9FF0B3A668AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 6146ce55e74f94fe4c511ed4cbf8477bc66e38aaa7d17788f6e26a3ac40b184a
MD5 dfe4b5191e8cdc397eb745f19e8d52be
SHA1 19608331258f091932b57138e45d177aa0766a88
SHA512 11230ec6e4020e82d96ff1c5176982c8b64f55d935adab733fb4920b64cd33ca0d676314c81595a86438848366d42ac1c4e6e0ebb5585faed519f85d94889a1c
TLSH
T14C11CBF7F1B1882CFFE46CBE6AB8ED3823785A580502224F8D404760218653DA1C5370
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 915180a2589094128e34659afaccd896fcebd9a0b58df24765807e1d76d411b8
MD5 98a95c8f5efa057803858ac088bf1fc4
SHA1 cefaf3dd784ef30bf1ff3764dfb6bcd1060b7bd6
SHA512 bab63e59703754c2589f8d89b58028c28ef2266c446eaaa9d095455116de1b8d14a829b0df7a759bc7654ba42bedf6739de0ec53e7bf832e9f7b28a3f740dbe2
SSDEEP 192:DKyZZiVKxCgiJjuJjuC6/IL8xh6KkJaP3xQvtfPENP+aBInQIM/K:DKyZZiVKxCgiJjuJjuC6/IL8xh6KkJaI
TLSH
T101F1BDF7C7D8852D885156F4DB25AF1FCE290A28021C3C27C8D8AF5BA3E2972D25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 39215d522b43206ad16bbc9098334350b520f9ace4e2fd029d5535d2b8d9467a
MD5 43e82a33054d01c1d463b6d8f74374c2
SHA1 538f8d7121692c7aaee47ba83690ec3d17059e8c
SHA512 0cdf5dadcae0a8bdf4d089ad4b57101a1b585ab51e6812078106864cfe6218dbe7f3ff2efa71ff04a88d709f9db8bdcdee36fe3c11ab49df0d06be3bbfdbd0b2
SSDEEP 192:VRicBzMHn4v72vAPRp2+CECY9THsb+WNn4P40r2TtkglPgW4+VyIsnAUge:VRimzMHkC6XfFwkT2RkWot2e
TLSH
T16B42A46EA910693B5CDBD25AF9217B27E7F2103175D42E84E6FC892C14E79CD322740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 287e2a1a1e14dccc74fefb2dbfedac96a4f4cebd4aa3ad081c33fd8dcd04710b
MD5 3af98e31bfbf20ad5168a7cf6f6caef3
SHA1 605e10d37e63a39c9070c9e34b4b7dae0982aac4
SHA512 47ed4e42835cb8d7020a627f31f59f1eab29bf5c67d580f74f830c2dc3d48bb9b8538adc865b304bf201008450ea94b4f77fa4a0b8529ccd939c267174e9bf7a
SSDEEP 192:VRicBzMHnIv72vAPRp2+CECY9THsb+WNn4P4lqE7tkglPgWF+VyIsnAUgE:VRimzMHUC6XfFwkjE5kWow2E
TLSH
T12142B46EA910697B5DDBD25AF9217B17E7F1103266D42E84E7FC892C14E7ACC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff08efd95de499b37079e01e22cd558133ff161aef5ca188477e0311034764fd
MD5 5795f515bf80ce4f1f05654a6821a65e
SHA1 10eb8d8f2bd046314f34ae0f2eac1a3f41b4a147
SHA512 4318f38d4fb82711608c2678d3e27eae9231d35cd085095b5edbc91648f99eb2ecb86005e8b89bd3659d3a86dfa589b8b66078ea9c99cd2605a7f1903c6406dd
SSDEEP 192:VRicBzMHnIv72vhPRph+CECY9THsb+WNn4P4rmW4JXtkglPgW5+VyIsnAUgE:VRimzMHUCxXsFwko4nkWo62E
TLSH
T1A442A56AA910297B9CDBD259F9217B27E7F1203266D42E84E7FC892C14E7ACD311700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0c826cfdb8a598f84204a2677f1ef5438d43ce2071e0a427c7d8161b6616651c
MD5 aca1feb2ab9b5fc8f235bad446ea1202
SHA1 e5afb6e5fccf566b982f07826d964bc9548b81e4
SHA512 b2fcd2533874bb6d0845f0763dc93fc5cf1e3ae0eae1027e22e27d036e450392d18ea913b4dcfb47a1d749e62425a2f544fd311479979b8aa9a518e82a38b10a
SSDEEP 192:VRicBzMHnkv72vAPRp2+CECY9THsb+WNn4P4HEe+tkglPgW4+VyIsnAUge:VRimzMHAC6XfFwkjeukWot2e
TLSH
T1B642A46EA910653B5CDBD25AF9217B17E7F6103166D42E84E7FC892C14E7ACC312740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5e5ed06d24031eee8fee18a95b1aecf742bc5fd2ebfc2c3c34a4cb46fcfe6611
MD5 df21c70f4ec2d912659b38d171d4b2dd
SHA1 9b25ece2cf9a4c7de131e88933c4057af60f35f8
SHA512 458d22253ed4ef25e0d72b8f972b622c54e9a934c8a4ce50847604965ddce1ce25152aa9aca61b79b6150d64a2ce081601921e78fe793c1aeb2d39829c412204
TLSH
T183B02208AC800832CCC8A3B823C388803F300C0003838E328CAA0280CB203B3F320220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3547367b1188c015c79adbeb284847a1991f6bb6cffd9369bdebac886e7a519c
MD5 3501981b48ced37c18452fa26a294162
SHA1 441c5714b72b60dc69da5c623843c211071effde
SHA512 199db489d34129b103aca85f722227f3a3531cee9970d8810356d1cf3f87f765e1ebe741b1c12a1277eaa53afb4a24a0fb4be5de3ae63b0da76fb54bac5e002c
TLSH
T17FA00218C3F15C51CDE04670716109C72351496A6655471764A10F49DCEF1E45705150
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 16b8ab0c1b617d461f65fe4f071dce4f0ce69f9261b2d7ace1faaeb374a4a312
MD5 50f6f925e175fa247564e3d8eb801c64
SHA1 edeca86d7ed6d9a442dfe240c8b496058d0d46c1
SHA512 04c71088c3c0c22095fb22b2b6e788f8660a0e895cdfd37897367f8cbaa8ff7fd83010f546f04f180d241b286ac0566efb6abc14971e841b631da681c895b4d4
SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Um7Rkm1tYpBeh2BAom
TLSH
T1D9C3123B5E70E9775979A74EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 dd5f0ebba9651eb75312188a1dd7a13917a0a56d4494126c3d515eb9a6ac8303
MD5 bb3ea7a731014c4e78554ae2f76b6c82
SHA1 845736d8d5cd20b20aa73b29c0e23ed0254cd33e
SHA512 cece2702922cd500d5b3107e5f0d5faf840a66c0bd95f934affd25d452c19e0f7ebf1acfa437f1e6c583645c804249fefd6ae714d77489ea1f816337529316d7
SSDEEP 6144:MLGv6q3rVULzS5Dm5yze9smOnWm7Rkm1tYpBeh2BAo4:XvrXq5y0smGh9oBGcAo4
TLSH
T1DC34237E5D25AA3358A4B70EF15A350F1EF24F93CD40DBA5CCDC6A0426ECC95AE06834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d7208ee5fa368acd9de471932593607da46371532a5d5f00065d396d21f05810
MD5 16dad2e67ee4934062cf0591cc12c106
SHA1 6a1918d8b1c81bf59f49b0f2faf1b171cf3c386e
SHA512 2310ddb937bccd9cf2ad271ab0f426fb21d15be60866b4e99438b972f6c819facef944455a5c8a6b35c7bca65bfdbfc646d61ffa88b61fded138c77c9f48dfa5
SSDEEP 6144:CPGv6q3rVULzS5Dm5yze9smOnWm7Rkm1tYpBeh2BAo4:jvrXq5y0smGh9oBGcAo4
TLSH
T1CB34237E5E64AA335894B70FF15A750F16F24F93CE40DBA5C8DC66042BECC955A06834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d945380b5a1c91316e3a431cabac294c09c45f8734b842e0c529411306bdf49b
MD5 3678bbb1e9d33d9dd9482a8cafa2da55
SHA1 eeb4aad461dcc58b17f18c3c5536262ae02234fa
SHA512 5426c8a22c50b84facc44e7c631ca850f5dcc88e987c3a7bc52fe92d43ff6b96588cadb1d870aa0300a28b9a17e03574ec51a0cda65ae90a11533952729c3804
SSDEEP 6144:PPGv6q3rVULzS5Dm5yze9smOnWm7Rkm1tYpBeh2BAo4:mvrXq5y0smGh9oBGcAo4
TLSH
T19534237E5E64AA335894B70FF15A750F16F24F93CE40DBA5C8DCAA042BECC955A06834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f80adc8-e99c-4a33-ae55-c0d25db7a99f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4076_926170585\4f80adc8-e99c-4a33-ae55-c0d25db7a99f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4076_926170585\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download