1ab77271b649c98933703f1b8d91978f06ea3ff4fb26eadf2ea75555a6e992cf

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.exe
Size 22.2MB
Sample260801-k2cjtsgd49
SHA256 1ab77271b649c98933703f1b8d91978f06ea3ff4fb26eadf2ea75555a6e992cf
MD5 754ef84c5efd2e22fab8a480a60a3da1
SHA1 1a6d7a29b9f24fe0564861b023866096a670bb62
SHA512 bbd1444630423a49b72ee07d402f006e985c2ed40048ea6479c093e0e141eb564f81b21d3111f00b0cfb3dbb51f29fd06f1263b9b68c4044fdb5d6975363b687
SSDEEP 196608:SX6EZqJATgGtEW5/znJjhRqrm6rSnlix/QarHKO0VXHHz2Mz:SX6wNTh5/tjqm6lQaWO0h
TLSH
T10A3723DE1A6FA398DC6855379406D32B38A2F03DC7CAAF9B4D8920A16BF06D4453C717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	drive.google.com
42	drive.google.com
43	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5936	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300488626630563"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{627A0C1C-2AA1-4D4B-A93B-4A56DEC70B01}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3840	3184	chrome.exe	87
PID 3184 wrote to memory of 5936	3184	chrome.exe	88
PID 3184 wrote to memory of 4776	3184	chrome.exe	89
PID 3184 wrote to memory of 4776	3184	chrome.exe	89
PID 3184 wrote to memory of 4260	3184	chrome.exe	90
PID 3184 wrote to memory of 4260	3184	chrome.exe	90
PID 3184 wrote to memory of 908	3184	chrome.exe	91
PID 3184 wrote to memory of 908	3184	chrome.exe	91
PID 3184 wrote to memory of 5496	3184	chrome.exe	92
PID 3184 wrote to memory of 5496	3184	chrome.exe	92
PID 3184 wrote to memory of 3728	3184	chrome.exe	93
PID 3184 wrote to memory of 3728	3184	chrome.exe	93
PID 3184 wrote to memory of 6016	3184	chrome.exe	96
PID 3184 wrote to memory of 6016	3184	chrome.exe	96
PID 3184 wrote to memory of 2992	3184	chrome.exe	97
PID 3184 wrote to memory of 2992	3184	chrome.exe	97
PID 3184 wrote to memory of 660	3184	chrome.exe	98
PID 3184 wrote to memory of 5604	3184	chrome.exe	101
PID 3184 wrote to memory of 5604	3184	chrome.exe	101
PID 3184 wrote to memory of 844	3184	chrome.exe	102
PID 3184 wrote to memory of 844	3184	chrome.exe	102
PID 3184 wrote to memory of 5792	3184	chrome.exe	103
PID 3184 wrote to memory of 5792	3184	chrome.exe	103
PID 3184 wrote to memory of 924	3184	chrome.exe	104
PID 3184 wrote to memory of 924	3184	chrome.exe	104
PID 3184 wrote to memory of 4636	3184	chrome.exe	105
PID 3184 wrote to memory of 3408	3184	chrome.exe	106
PID 3184 wrote to memory of 4636	3184	chrome.exe	105
PID 3184 wrote to memory of 5704	3184	chrome.exe	107
PID 3184 wrote to memory of 2100	3184	chrome.exe	108
PID 3184 wrote to memory of 4176	3184	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
PID:3076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa28d8c728,0x7ffa28d8c734,0x7ffa28d8c740
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,7593681647938549445,8555554754088498095,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,5442781218699417634,12333054224892704837,262144 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,99017801153036153,1177745334497244873,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1816 /prefetch:13
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,15442693474761575324,6503794583612600443,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,18441230847905286758,13160279173958567938,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,8048408209488056190,14559279249009715663,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,6336404156930961488,14204850243280863636,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4288,i,10929168495316050527,4392382538624253067,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,13672772661220372945,5044193491823949360,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5712,i,1126138928105946166,3915720460516024883,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3644,i,1346860160504394121,7676396486590658916,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3408,i,4272787224566193534,9035597481944425430,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6088,i,15635534552350561962,11032173132806383425,2097152 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,9310400897867323789,428154495849633235,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3692 /prefetch:12
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,5256671320113337177,399381182269915579,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,16948953227008751340,1919375469213160247,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,12416554091685225713,8859649884297814457,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,11164387025447961397,59102141916935093,524288 --field-trial-handle=2008,i,4637807275994428244,6737803700328331603,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bdddeaaa7b12ff48179039b9348259c696872e953fe2782b142b2855714c260b
MD5 62821d2e9e2c6e652caeafc53efdd020
SHA1 425bee2a6a29bbd12cbc780247c9ad826dc02051
SHA512 cc40621028a84ac0c4904527a29500b5b644dd9e4cc70c3731969ca3efa6f9211e9e22839235d131e875067051c4ea2bfd9ce0b2cf8e1d4babdba35014e736ae
TLSH
T134E02BA9CD20ED7715FC8B1960844A47F74413562A50589F7A3C950C4FB573A4686C9C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 30b5beaec714a1260761450909044013ea239c883d9e88359db5a6457388cafe
MD5 96b52cd8556edc23efd4df16caee9c3a
SHA1 e298abd484f8e46a6686233a3fc002662911f93a
SHA512 8688687edfdabe13939be4d4b674d8ac288424a25c27ff6235c4727f9a55966dedc4a2969c57ecbfdd6a34253bd97b579d29ab9db26c62671b220845dc9e8e97
SSDEEP 192:tRUlTxgGZ73NWNsv7+pAPRp2i5RN9wHsb+WNnq50kveO210I5dVyIsnAUgtaJ:tRUtiG196UXXOws0q210Il8
TLSH
T13D42F72ABA50753B5CDBC329FA617B53D7F5102221991E80EAFC892C16EB5CC212B41F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5fa88671818fb14e6b83913ee3e7f9f5e1d1f0b11bd2b4f4450bb48d3ee086dd
MD5 716f4cf460dfffc9ca91dc1c8bd5dca9
SHA1 269c510719dc12ad240020d050b9984067fa4a38
SHA512 d5a743cdddd2688928c088a77d3e89eff6bd2443921d86bd0f61b5d2a1ce644a0d4411d4e78160d936454cdd2b66ffbf110830a20f9b7be07cfc08491e3852d9
SSDEEP 192:tRUlTxgGZ73NWNsv7NhpAPRp2igRS9wHsb+WNnq50+veO210I5dVyIsnAUgtaJ:tRUtiG19bUX7Ows00210Il8
TLSH
T18942F82ABA50753B5CDBD329FE617B53D7F51022219A1E80EAFC8D2C16EB5CC211B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5491441b4c3c0f5057fa0702ad51d6807ed894e8d58afbc0aa43c835a46cce6c
MD5 6fb580f48a6f58a8c0aea16135f4b72e
SHA1 ed3e8f41176426094d8c88a99e3ba5aa98df5361
SHA512 e3b8d44253b16c992e42d1979f229d3332425d0eb5132c3cdf1470486d8b0da246449cb06782069c4c70761bc66e9b09aeb51994b9b214314054837a43e14750
TLSH
T1FBB0120180456511C05F02B021571C8CB1545F14A70E2B0197E0A976DC251718014051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5584.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5584.TMP
Size 96B
SHA256 311805e295b4551ff6e1583e19cf11a48e999c3ed2601ef3cd1c8a7269316d39
MD5 87beb1e37cf30a65de87b4b7d39d4b88
SHA1 ad3da589ee2597a033d26fe1937197cb1dcfbd85
SHA512 6a4e42ce35c01278e89301ffa692ed9077be219fa44bd4efc4c1af86402fdea6423c1bc2e32bf0e5639082cd31898eb6da8b3364cacb11f75e7ce0a2fdf3398b
TLSH
T123B0220AC202A203C00203B023CABCE8F020CF20C203020283E00BA2CE2CA3008A8220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 be523fb6e8bc102b317263ece77a3cb0e07f1482196fa9e1bb9dd44d3003d530
MD5 fcdd8fe13cf4ee4463ad29c51591e25b
SHA1 e4ad875396bb3533e5415bbc590af14c65a22762
SHA512 aa26a134e0e8d9c40ac48276bfcb732324838bd1dc64e481c37a3e5b584d717f340650592a1f7df3c406dfc1d54a83b63646da82735ef1d33c2803d717310f3e
SSDEEP 3072:LzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:PWDfxA3OnjrYQ9EU0/hEg
TLSH
T17CC302A15C39BC660CB8EE98744C3F60FFF4AC9A91879DC362E91B0C24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 17a9a8782636a6d6cdd0f7aab0485d02c8c6d9de09754198a9a96b4c8fd0c075
MD5 46d947c621b209814165b57197685393
SHA1 b62988637f109adaa2d9ff1ec74a7ac9a704c019
SHA512 8fe6003e91f4417c7c17d456bae8eb2d104fbc5a2afa226b4e5cbce99c8c152a7e217410feb3cf0ceaa45e68d2080bfc512b1a0ad1e4026a64d7ff1ab926d634
SSDEEP 6144:8dmRwTDGRZ7W6exKGNWDfxA3OnjrYQ9EU0/hE2:8IOGRZ7CwDfxjjs+Cl
TLSH
T1E63412410F7ABEA205E8EDA8F44E3F547EF4EC93839B4C9641A81B4C14D51E4393B975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 94e4d8e0996fc8367aff501bb7627e184ec54844658604bce2ba5b4fea3b6ac6
MD5 ac4c1dd577c667ccae1385fd691726a1
SHA1 b8929e1ccb2a37e4e0bc794e298ff7f9eeff055e
SHA512 73a83d948afeac1e9dfb6a1e5bc878e4a35fbd7ad9b428dbc81f7b021a4036d1d1e96cc52b0ef0c88501607df2e1b331fe81b171d2a25c96e6c6bf4490e51d51
SSDEEP 6144:GdmRwTDGRZ7W6exKGNWDfxA3OnjrYQ9EU0/hE2:GIOGRZ7CwDfxjjs+Cl
TLSH
T1613412410F7ABEA205E8EEA8F44E3F547EF8EC93839B4C9641A81B4C14D51E4393B975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download