a19d399f6b88b06fa369d896027b563dc5668241c8d9098516af2858303f8055

Resubmissions

02/08/2026, 09:55

260802-lx88nsxvcw

02/08/2026, 09:49

260802-ltdmlagd237

Analysis

user interaction
yes
max time kernel
1049s
max time network
1027s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Maxey's Visuals version-145f189a6a974303.zip
Size 7.0MB
Sample260802-ltdmlagd23
SHA256 a19d399f6b88b06fa369d896027b563dc5668241c8d9098516af2858303f8055
MD5 f0fa95490be4d3375110d5622c17f065
SHA1 cfed818f060a13fc8793867b433fab06c1b44683
SHA512 1800cbb6dd47b09bfe86eb178d03d6bb71eae6694d75b482c9950e7d48c0a710c17e9b1ae772f5cf4dc6c9858b38c078eda1d349e46dabb101d876c58db60ee6
SSDEEP 196608:Chc9kMfKETYhENzTOm3o6KXMRtuWASlVrPZ7DD:Cy6y/J4d87udEx/D
TLSH
T18E76339D5ECEF217B62111D1119F3B4C9A32EDE2411D8AF2CF939649C51D2CACCC68AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2604	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301379405539789"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
1732	chrome.exe
1732	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1596	4296	chrome.exe	101
PID 4296 wrote to memory of 2604	4296	chrome.exe	102
PID 4296 wrote to memory of 1448	4296	chrome.exe	103
PID 4296 wrote to memory of 1448	4296	chrome.exe	103
PID 4296 wrote to memory of 2624	4296	chrome.exe	104
PID 4296 wrote to memory of 2624	4296	chrome.exe	104
PID 4296 wrote to memory of 1004	4296	chrome.exe	107
PID 4296 wrote to memory of 1004	4296	chrome.exe	107
PID 4296 wrote to memory of 2468	4296	chrome.exe	106
PID 4296 wrote to memory of 2468	4296	chrome.exe	106
PID 4296 wrote to memory of 2416	4296	chrome.exe	108
PID 4296 wrote to memory of 2416	4296	chrome.exe	108
PID 4296 wrote to memory of 3096	4296	chrome.exe	109
PID 4296 wrote to memory of 3096	4296	chrome.exe	109
PID 4296 wrote to memory of 1772	4296	chrome.exe	110
PID 4296 wrote to memory of 1104	4296	chrome.exe	113
PID 4296 wrote to memory of 1104	4296	chrome.exe	113
PID 4296 wrote to memory of 2152	4296	chrome.exe	114
PID 4296 wrote to memory of 2152	4296	chrome.exe	114
PID 4296 wrote to memory of 4808	4296	chrome.exe	115
PID 4296 wrote to memory of 464	4296	chrome.exe	116
PID 4296 wrote to memory of 4732	4296	chrome.exe	117
PID 4296 wrote to memory of 4776	4296	chrome.exe	118
PID 4296 wrote to memory of 4776	4296	chrome.exe	118
PID 4296 wrote to memory of 1732	4296	chrome.exe	119
PID 4296 wrote to memory of 2780	4296	chrome.exe	120
PID 4296 wrote to memory of 2780	4296	chrome.exe	120

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Maxey's Visuals version-145f189a6a974303.zip"
1⤵
PID:2652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff88da2c728,0x7ff88da2c734,0x7ff88da2c740
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,13812625598432224991,8140009135782712432,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,15376994962875352531,10908576478240065509,262144 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,6846591786484312717,15020992286058607821,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,17686032416686072032,4473360926748659234,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12160857734610428050,7933319387975563521,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,10758174984293673745,7911636032573752367,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,7437712226754759276,11538326182234318269,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,6804464866197900138,14842394363245635271,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5864,i,697786515543991494,7922393668601557533,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3932,i,13694872992272944683,15173719736566578642,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,3734278270291795529,4281594159709341054,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,10731703834537845707,8805311519024738040,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,4159604306394749194,13668426862559122292,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5776,i,750403836954053802,11054556362227701735,2097152 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=868,i,7297607364340890300,14612198143718688056,262144 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,1837151957258475782,15065031028700719775,524288 --field-trial-handle=2028,i,7834106634134531271,9403812934443772382,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:8
  2⤵
  PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf622e287d7ff8cef3fca20640d4ceb53cc7346669720208c0e6ea681792f616
MD5 896f12d34e92c889e368e740d386cafa
SHA1 5df6becfdd97358b1e5dcdc94595dd29f1973fac
SHA512 a81fc06ab17f152bbe473f604cdf27b717fc09557461bb88c82461dbd0df4e5c8a3b6ddc528f247d6693faad2b4c40b9362a7b446ec394e924f9e9b522a9dd54
TLSH
T1A0E02BB9CC21AC270DFD5B2920144646E74003167F91C81F7A3DD2088FB5A3A4166D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1c163fccdd23dd8bc6d1615495b268537b5f77e6269f2e3f85dc3d1f6a62074e
MD5 3eaf0c0b54eb5ac41262b69344a0a413
SHA1 bed0114e51322eae69eb6f794a0f22fde634b200
SHA512 27dab91dbc0715dcd246a74d9e5a26e11d53c983d24fb13a3e590c8383cf07c74712bff425fab0c9b5b83d21c77014e8c223b0416761526cfb91e211f36159b0
TLSH
T1DA2157C8D4912B52EB544AFDC0F35948F3208410C5532BDB394AC2B330167F5AD08857
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f252a893fb007e8f53a80aa847699a52ab2e10a95302fd0601f1d10095109937
MD5 fd1412b63e7d0f6dc8ec08b3f187b087
SHA1 783785dcef7de90fbe706f947de02a858ad01cf4
SHA512 e25301a4cf36fe405f047ba6ae719141568b6f7feb50b0504fb01b95e2689d34a69920c883f0e85e0e8e77ae2166b677672f08e0ad83e5683af6d6e72807a880
SSDEEP 192:DJ2XZvoIJPJ8ussaIVbmG0hAWx2dpI0I5I3jaPTv3fPxNPPI/nIG4UTKzBnpGQ/x:DJ2XZvoIJPJ8ussaIVbmG0hAWx2dpI0Y
TLSH
T15722BCF7C3D8862D895156F8AB256E1BCF190A28432D3C36C8D8BF1B93E2471E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 504f5bb6176bc54182f9aa767dc7826a3712c38418acefee2a14f68cf805c109
MD5 d430f85e00edbac1631b8daa30f46143
SHA1 39f8316ccfa63cf890d654716c7d7f0efe5bfe26
SHA512 9460e7404f4d283f649d5be2980c42575688baf5f61ac887945a32eb0bfc0836dfea6a3594e6d5596f3a093ff35fa763d2301cf10f4a77d2e25153a797b21d7a
SSDEEP 192:DJ2XZvoIJPJ8uswNaIVbmG0hAWx2dpI0I5I3jaPTv3fPxNPPI/nIG4UTgnpGQ/wi:DJ2XZvoIJPJ8uswNaIVbmG0hAWx2dpIH
TLSH
T1C032BEF7C3D9862D895256F4AB256E1BCF190A28432D3C36C8D8BF1B93E2471E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d1554025b94f94cc797e76dc967475f1ee61e7d55ab8abdd827c298558082750
MD5 178235eaa16325628042afd523b499e8
SHA1 e15dd62497a3f3914724ba0d5d12c35f9ceaaf16
SHA512 bb2f47d48315b3469e9de2e72482e297050196b3fd458cc91d9c48c5bb793ffef878c3352141566c092951dc70c6a1341b87111dc0f4c9b796d78f5f21ea4564
SSDEEP 192:D0uetrVJJ5J4wo41faIVbmEdhAWk2UpI0I5I3jaPTvqfPiNPPI/nIG3UUmnpHA/3:D0uetrVJJ5J4wo41faIVbmEdhAWk2UpF
TLSH
T103229BF783E8862D891156F49B15AE1FCF290928032C3876C9D8BF2BD3E2471E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a9c1f8cbe4362bfd20e21a492378c1017375e9e8c7166650f99cd2f7ff8dad9f
MD5 f838d682d2fb9bb818a937e7d509174b
SHA1 6161627d07decc9824c206317d898a8ace95f7a9
SHA512 ea8f77ab03fb405ae988669f753ce128c2298d8e0cb26018e91f2994adbd20a5a583208f3aaca02cf5fbd58d3cd41b321679862c543dbff4f0437f8f2a50f124
SSDEEP 192:D0uetrVJJ5J4o4E5vaIVbmEdhAWk2UpI0I5I3jaPTvqfPiNPPI/nIG3UUmnpHA/i:D0uetrVJJ5J4o4E5vaIVbmEdhAWk2Up0
TLSH
T1F0229BF783E8862D8A1156F49B15AE1FCF290928032C3876C9D87F2BD3E2471E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6c5d1078b93ca4e1f5dcbdcd0e4a61ac7be51130742609f782d21ad6977def83
MD5 106cf06e220b2ee38a20e6ca684cda15
SHA1 b0b327fbc3bcbd01757f88440c36b258e3473a4c
SHA512 e4c63df39d6122593f1537d13e3c9a77640bbe9be0106fe2d3d1ab1775ea53142c0446e0380dbfbd39ef4352f928f0a83cd21b305ad003a61099ea6dd93d0626
TLSH
T1A231AF57917FB057207D8AA71D447D052EBAF8360741A8F8DBA6422CA09A9F70F1302B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 85c82369f7636adb6255f6560c5f8fc6afd625093b7a2cc369ab19ebf0a75a95
MD5 0dd44b96a9f399edf92c6e88b3df9892
SHA1 85e85a4cd6fdd7f7b2dd5a9aa75dacbfa13fa231
SHA512 c9a12fd2014e9ea065142243b628dd7c609f8fa94f15ccaea7fb6f007767cc920f59ed0440ae0fb711b2b7312228e915e95fcbfeac5106986d89a8aaef63608c
SSDEEP 192:jR4cBzlGlZ+qAv7chAPRp2qF749BHsb+WNnek4g2E393kwMabdZVyIsnAUgraJ:jR4mzlUxcw8XlKrwBaExsax/e
TLSH
T1D052E82BA91039779CEAC21AF9167B63E7F5102135A42ED4E7FC8A2C14E76CC221B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ab39e06a87af9846780e0099809d0717ed167f7c8c50618d666bb77ad4ff93bc
MD5 f42ea6720254a48c46384f78e85002fe
SHA1 719f07e04552d768fdc13eb32540194f2fb6a86d
SHA512 b5c03aeed302d98f6a564a00b7b469dff86367070aef4570fbe1ea6756f088e5e2704e3b256ab92fd27806633fd2a65a978d99020318cb3547d43def3cd790b2
SSDEEP 192:jR4cBzlGlZ+qFv7chAPRp2qF749BHsb+WNnek4Wc2n093kwMabOZVyIsnAUgtaJ:jR4mzlUx1w8XlKrwBm2ncsaq/8
TLSH
T11B52F82AA91039779CEAC22AFD2577A3E7F5102135A42ED4F7FC892C14E75CC221B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7d229f437fecdba7a6fea7762b835dededde3689a391064d43873a1c92f63771
MD5 cea6e311f2eec6a3671d3e00cfec61db
SHA1 5307dae934798191a1503a96960540914ef0d030
SHA512 4768d032fdb6209aa6f1124967f25c003be2fe50bdbb02c0dde696c2e55ad99b2df68c1aa18e7416239415dae70f4b505b9207ee1234fd88222cec8f842a274f
SSDEEP 192:jR4cBzlAlZ+qAv7chpPRpRqF749BHsb+WNnek4+92v93kwMabRZVyIsnAUgraJ:jR4mzlmxcwrXkKrwB/2ZsaV/e
TLSH
T12E52F82EA81039779DEAC31AF9157BA3E7F5102135A42ED8E7FC8A2C14E76CC2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9c27551d62b369fa61978a7754f321a573bdd4b1120e4db6899cb2939cbfd0c3
MD5 aaacf59c38e1285d70607fc16dcba43a
SHA1 4cd743e7980602366a23782fb78f5267c3291abf
SHA512 769bf47e45c9c8cf6274f735b5b9244d73357d107a6defae515f6f5cb009c1d11acadcb5e2c8369ffd4eddd66b1be60056d708bece6a338e096f3e7957f48157
SSDEEP 192:jRQlGlZ++Fv7cpAPRp2qg9BHsb+WNnek0P093kwMabOZVyIsnAUgtaJ:jRQlUj1wUXlgrwB0Pcsaq/8
TLSH
T1AF42E82EA914757B9CEAC22AFE253763E7F5102135A42ED4E7FC892C14E75CC221B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bd8479f66dd20608889242c9a1420bbdb8f1938785ba78f8f9efd01b4c971cfd
MD5 5d40670582830dc11600529836e33da5
SHA1 4b12b72b800c3813cb80ae62f2f6af32120c8eb7
SHA512 c9ff22eb8148b2dbdb5573b911089f9928546f63d6751cdb12e2eb4ef4a52965d50ace8b081221dd6f5d0abf3cdb44354ed1a5926babfb0a54a1b6dd9045e052
TLSH
T15BB01240C0415211C80202F42546189873149F30961A170293F569328839160C02C050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7234.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7234.TMP
Size 96B
SHA256 ad38faac3a21a5ac90fd5cb9b7970e8a04a6cc4da5b45485fde11bd55fcabc73
MD5 278c8bcc0b2d0eb03fd35ffd0dcabe59
SHA1 77a90b79d75cd3f980df0d4fff7687ac19c35604
SHA512 ccd2b1b8a00fa79360b8445c1078aa1986281ac10d40529a8db4e38ee8bbf1c4062f61ecb2919fb25ecc59ea76a6745a49d2958951a2ba28a2c04c38e12b65d1
TLSH
T1E6B02208C2022202C80303B038C080C832A0EF32C203032283E00E3ACC232208020820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a5d08ff494f4d12a425422fa39f725ab2c47de3788a3daf723380586ef35df8f
MD5 794922bb867fb1fa976988f5715cef3a
SHA1 7427ff585193e607d832653df12f8947a5b797dc
SHA512 e0a350fddd99faf89fddd67f239e75196810d493184311148c890fbe2a9b129f4e1ae88c64a6e0440d5347b1a1410f4e875f579a37003d2bc751b2a3a02377e8
TLSH
T194A002351A802462D4AC8270208211502718B914C1CA130141B10485C8625925226C97
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8c89740eab74710b8beb079138f08628a44ab63eca1531eb1eb94aa7060a0586
MD5 efbbfd74ba6d190ec8436f12b427e25a
SHA1 c36070377fa548beb995233837620dcbd75b7ef9
SHA512 b0e944e60cac0d7e0d6aae46ccc51dfc9a900f2eee9ad4f64bc1bc09efcd11269b92e6d2d36358ad887e9e1eca055b31bdcf8bd653e5f71b4cd86ac14408fd83
SSDEEP 6144:NaDuqWhGX9NwJUwcrFmUi21rSm8uUVNSlzYG:Na6DWKuwc5fi21b8j8zP
TLSH
T103342330E7DA7CB6FEDD1144B3EE213DDEB98D014291C052A1926A42E8CB2D50EF6979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d7dac7d7955a4b9a6c4a5a049ff66ba3854c62c445e3c9b7e0b4930653508a8c
MD5 10d21747c455aad7477e72886244bfd5
SHA1 bd80bee7c4532e89725637a9986364bcafe13000
SHA512 3734c59f4258fe8a10fbb502da1bb8b458f8d8d2089f894a45911b5239b3170bdb86f3e39b33e7edf40b79b009529e3f90021d02b02c18b9ab76279115f37681
SSDEEP 3072:SWFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:bFmUi21rSm8uUVNSlzY/
TLSH
T1BBC3130076E3F8F2EE5930447BEE2A145D6C0D819291C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 351KB
SHA256 f99651b36a776878d358cfb388f53a65cf9f1f1ae259c02253037b24e0c73dd5
MD5 b19001f5474952eca30c18426e2c06b6
SHA1 6e9ebb8b5c714d4899796d4458da6e286892aaf7
SHA512 bc76e52270b3c9369ceea9a7e5bdd77db460e94991d6e65c17eb8c0bead2a034528bdf69028fa67cbc0b535abb70522db92fdbc52e5c0f809e4e5bf5843391f5
SSDEEP 6144:bwmCBD1uXmskQqUCtiaDuqWhGX9NwJUwcrFmUi21rSm8uUVNSlzYG:bwR+m2zCAa6DWKuwc5fi21b8j8zP
TLSH
T14974233256DDBCF6AF9C1260B7CD1119CDF28E468FA1D083D4C53941A9CB29C4D3A9B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 361e26e4fe11495fdf29eb7b382e6397c6cdad49e203668ed849a5d4d8d23c69
MD5 48b780248664b975203c6dd5ecfe2273
SHA1 d071e1d4191d4d5cb60de7eb084639ed9a4ad2fe
SHA512 96012583308170cb8519ba932aaf0751b9a48c39a369eee0f050d96bc9d46dc05da06e3af71f40552a8c272252c5766fe14841572479e09d4fdd7520a0990cd1
SSDEEP 6144:AwaDuqWhGX9NwJUwcrFmUi21rSm8uUVNSlzYG:Da6DWKuwc5fi21b8j8zP
TLSH
T14E342331EBD67CB6FEDD1144B3DE212DDEB9CD068790C046A4912A42ACCB2D54EE6878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 957f656e3a1bbe0fbc3d86bd20d3d3d2d3e406dac52a1e84ac80e405858323bf
MD5 8b81bde9dae30598c7369ce01d9a2a93
SHA1 18b2038fc89f529da278eb2af6314c9c90974cb8
SHA512 134307230a869699034d5ed7b11f9d44ebb331c5f914d9e6ce80e4239815f590944dcb321710253ae1fcfabcb9155f185c07137cf0a9387ffd45917fd7ffbcb5
SSDEEP 6144:zaDuqWhGX9NwJUwcrFmUi21rSm8uUVNSlzYG:za6DWKuwc5fi21b8j8zP
TLSH
T1A2342330E7DA7CB6FEDD1144B3EE213DDEB98D014291C052A1926A42E8CB2D50EF6979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download