d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quantum Entropy Candle.exe
Size 4.2MB
Sample260804-3a5emsshje
SHA256 d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1
MD5 69a61ed3418dc78a7aa0c64ec9d7ac2a
SHA1 da6093aaa72e25f7a6135be1e8dcb6a2ed97d9e0
SHA512 d88fde32894374b39de728eee110ad5ab0e6bb14603a9a6dffdce1fb7f9d179be4901b4f52c32eea2f3823101a0dde1c6d6c9f963e5c12f84f2e1124a90fe4c5
SSDEEP 49152:0v0IUvRAg0JLSccJBJzJ87HwJ3FcfYOpyrFPEaQ95dJvNoWHtBBP2xCsYXf7cGiM:sUqJLCXJzJLOWRnO3oOP2w/gGiAjRCEb
TLSH
T1FC16CF43F6A350ECC01AC174875AA623FA75B8894B107EEB5680D7363E75EE06F39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2564	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303592092034465"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
4048	chrome.exe
4048	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2572	2432	chrome.exe	90
PID 2432 wrote to memory of 2564	2432	chrome.exe	91
PID 2432 wrote to memory of 4904	2432	chrome.exe	92
PID 2432 wrote to memory of 4904	2432	chrome.exe	92
PID 2432 wrote to memory of 4476	2432	chrome.exe	93
PID 2432 wrote to memory of 4476	2432	chrome.exe	93
PID 2432 wrote to memory of 3800	2432	chrome.exe	94
PID 2432 wrote to memory of 3800	2432	chrome.exe	94
PID 2432 wrote to memory of 1684	2432	chrome.exe	95
PID 2432 wrote to memory of 1684	2432	chrome.exe	95
PID 2432 wrote to memory of 3940	2432	chrome.exe	96
PID 2432 wrote to memory of 3940	2432	chrome.exe	96
PID 2432 wrote to memory of 4656	2432	chrome.exe	98
PID 2432 wrote to memory of 4656	2432	chrome.exe	98
PID 2432 wrote to memory of 3656	2432	chrome.exe	99
PID 2432 wrote to memory of 1960	2432	chrome.exe	103
PID 2432 wrote to memory of 1104	2432	chrome.exe	104
PID 2432 wrote to memory of 4276	2432	chrome.exe	105
PID 2432 wrote to memory of 4048	2432	chrome.exe	113
PID 2432 wrote to memory of 1664	2432	chrome.exe	121
PID 2432 wrote to memory of 1664	2432	chrome.exe	121
PID 2432 wrote to memory of 2412	2432	chrome.exe	122
PID 2432 wrote to memory of 2412	2432	chrome.exe	122
PID 2432 wrote to memory of 2868	2432	chrome.exe	123
PID 2432 wrote to memory of 2868	2432	chrome.exe	123
PID 2432 wrote to memory of 4312	2432	chrome.exe	124
PID 2432 wrote to memory of 4312	2432	chrome.exe	124
PID 2432 wrote to memory of 1424	2432	chrome.exe	125
PID 2432 wrote to memory of 1424	2432	chrome.exe	125

C:\Users\Admin\AppData\Local\Temp\Quantum Entropy Candle.exe
"C:\Users\Admin\AppData\Local\Temp\Quantum Entropy Candle.exe"
1⤵
PID:1060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff92e19c728,0x7ff92e19c734,0x7ff92e19c740
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2803207704704653330,990826900027943562,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,13100933563939667177,8729346969571187471,262144 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,4898679395517045419,17446824034969951328,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,12687748571372646293,15359763930564583356,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,15033900888271421093,18151477666177136441,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4048,i,12818692691662995232,12034156991043989159,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4064 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,6233188262082940060,11937111638007418800,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,4273487558047425453,977454902113198653,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,2831922590706668243,12502927879653326848,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,15329120212630161482,17344187284016879034,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,2289423940487615625,1564575164318011781,524288 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5748,i,2554230317981697671,9224818116375009310,262144 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6020,i,5229209407201555121,17350148526477384766,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4776,i,58202111682914751,4182550493736922639,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3284,i,14893312811142273792,18103906139362811919,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3396,i,3623192269702269468,7295226548028131534,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3356,i,8206179074249527259,15076763816110344999,2097152 --field-trial-handle=2160,i,8046270539340890235,2091859811226631261,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 aca3d1be88f7b1d9931f5d381c81ebc0f41bdfb3e66aa47c36dc6f98bdf83697
MD5 5e09da36663235f33b29ecb2432a87dd
SHA1 04e47eb7e8bbe63a327b81ee28136c85627821e4
SHA512 5a0c7d10933018c3d4555be618ebae16dd3f05332bd0943d720c97c962b731858d2755f1496282469a908c907bd55a2a7ee49f0e4fc2d7988858f303f386a0cb
TLSH
T1ECE0AB65C922BC3728F8131864654305E75123072741980F373C500C4FB537E4182C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ab4ec62c174dff381007ea5bdb40484cb21eb0cba6b5a7370674fb1878ba5eec
MD5 4e6f3f7c39ba76ff3fd22b76c761834f
SHA1 f5b86f773f7cde4731da2a92518531cea7f9b7fe
SHA512 a08a0a54f728a8f03471cf687521448f713a76688274d30e26979b122c24b9e34cd79cbaf2d60e1bc337397f7f050cf91b8777036e8f6143034777c7fa701f2c
TLSH
T1AC518DF7D7E48A7D851156F4EB216E2FCD2D0A24131C3C66C9D4AE5B53E2872D201B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 995159de75f8c45bf536fa0912c542999e751bab8a11462583ca7a37416f234b
MD5 715d38d0de17850fb1a85829c1b10ce8
SHA1 af4f0e2c967c77b99340017e4bef142bcac13a80
SHA512 1312649c2ed1a999ff7074f601a3ebffeff455537d150612df472ef39849a90a651b5abed9d44a0506d8c1b7d422fa9c8b2c6a8380827130188f0d72249ef514
TLSH
T153518FF7D3E48A7D891156F4EB256E2FCD2D0A24132C3C66C8D4AE5B53E2872D201B4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 14e5b1ddfcf153f6a74621e69af12a8d9416bead19be9f75bd8023fa69deca50
MD5 0f25d87e446833183f3ebeea8f0aa39c
SHA1 b4462bdee4665bbfcb0e4e783841c3982bb65a5f
SHA512 be1119baec61ce80f6004585fabb044842c25d5570d47d1e6c564f2941c87f38205dbd29a86cf2a6fc22a58962e6d7c0fc93a71e098d6255f7fb2fb171877ca0
SSDEEP 192:eRQ7Y0iQukWmv7MF+pAPRp2S9HHsb+WNneV0oPNb2zeEi+VyIsnAUgtaJ:eRQ70QqSgoUX91w80aNb2pi28
TLSH
T1FF42C86EAD116D7B6CCBC229FD667B53D7F5202221D02E80EAFC892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 07a3b727b79d950effd67ff1900d5e42b09fc5523fb603e72e7b12f6ddd76018
MD5 14fa871429b09155cb02bcae07817ff5
SHA1 b205bc9d1068d810eeeabef8620d7942620ef5a6
SHA512 6fcc0e0a9ad2eefb5e5811d47cf8b26cd44205938fb69cf9f90f7a91b287fb1e5b8ae53e5508e77ff93ccd5dac146af53db9465151cbe7edf63d2fef57ef90f6
SSDEEP 192:eRQ7Y0iQukWUv7MF+pAPRp2S9HHsb+WNneV09PNb2zeE2+VyIsnAUgraJ:eRQ70QqQgoUX91w80VNb2p22e
TLSH
T1A842C76EAD116D7B6CCAD229FD267B53D7F5202221D12E80EAFC892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 199a92105c01b41eb43392ba992df83fd4f228cba3434bcabca45be5d04dee76
MD5 86a2aacd41ea87253a5deb5119d4102c
SHA1 7307cdb5203f32cde917c7a41bc761c410ffc270
SHA512 aab84b4501d8bfd34790077267f185e6c79c40f56ce003854d15fbc58951cc36f801413655cd7ac43a86c812e3565ca87cd002429b1e7add9d1fa561c0b302e4
TLSH
T1E0B0120180016241C08702B01A8214C871346F10F60B274593E06963CC651A18526060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c927.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c927.TMP
Size 96B
SHA256 befce9dfe8043ed6f7fe6e0e26d37b75c3fd6a676a79fe7c5cfe7d4dfcc3199a
MD5 9cadd1e497c8c86e9e8b55ef52416ade
SHA1 f49026e1be5bc1381dbc4e792e47c63afd8269d6
SHA512 21fc2c36cff271d9f21fa8957504e95e7c68ee2cc745b2bb1d50c854183bdd3cd47c40c8693d3627dd1c2336e01f7bca2c03acc2c3b01741a271a4ae56a70ebf
TLSH
T166B02220C202B202C00203B020C8CEC83220CF22C203020282E30B22FC202300820030
MD5 SHA1 SHA512 TLSH

Submit Download

d8a538d56c56b976_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\9bc0970e-83d0-4591-b0f1-856d8d63cea6\d8a538d56c56b976_0
Size 2KB
SHA256 51569b61e4839dc29ceef16d78a30ed65e8e04df399ad5759cfc3beb6a7add56
MD5 a33a880e704190c94e40d8cc6ec3c9a4
SHA1 59e7024b17d213be8aa2152fcc93671c37d6b3e5
SHA512 c1cd3aef5847e696ca744ff69a21a786d46218bd0d44a221b39711046512f5939a7460ef8d45e1129ad279f1d0e4d9d50b29b71fdbfae028ad3826832ff2c82b
TLSH
T1E9513CF32E1604BCEA23D3D0DA96685A2653C01CE707A0DD4087B02F65A95EB1BB64C3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b7b3f46c99b0bd94ad1495681819cb7eafaf781061b39d9b0f9152042e7ab036
MD5 3a1113933f51d8a7cd37d622235fe762
SHA1 25c4d36cc221334016e467f218514c20a7b41cbd
SHA512 2475ddd17f6bf2296887a49866ce4253bc7fdb46f6562c54e6d7e6873e1473bcfe6b78febe27784d3f6ec6727dd7e012daeed0fa2a82ecaa4950fccf9da50150
SSDEEP 6144:OcVVUaITEmQhw38JBrkBjTm7Rkm1tYpBeh2BAoM:OcVoTEmQhwEBrkBu9oBGcAoM
TLSH
T14134122ADE66AD3648E0AA3F680A0B0F7BF20E59D474EEC1CCD557007399CDA7705971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 0d009f83b54f67210e74abb6f16f5346f29d1612334ab7e2b4bf908612e2dac1
MD5 4ac788f08374010c5574bcb4ca238eb7
SHA1 b337bc6cd0caf5c46d7d6f606dfc387f3cb95415
SHA512 9c773855477ab9578b5515ba655d1fc1f00d05335f6dfb0031355c634c38ee89315377a845e48a60b72abbc6b71dedce014ab35457582917be08484e559a3e82
SSDEEP 6144:zcVVUaITEmQhw38JBrkBjTm7Rkm1tYpBeh2BAoM:zcVoTEmQhwEBrkBu9oBGcAoM
TLSH
T17D34122ADEA6AD3648E0AA3F680A0B0F7BF20E59D470EEC1CCD557006399CDA7705971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 969a51ebbc1be231cb4bd385130a9dd499a84c1dd0ff8993253b26d75acbe39c
MD5 c728ded1b16de3776d4a58caeaf97cd6
SHA1 e644d45a10bc2195203b91f33b99601d35933c79
SHA512 dc47a9a5af6c48d455178a4936eb52df488097da01fc0312fc135a32309e946d12365b2c72bb3a15b43873e8279ec77378d52b57184471295818812b60c1d77d
SSDEEP 3072://Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/um7Rkm1tYpBeh2BAoM
TLSH
T106C312275E75A9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86A0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 51e6a5a6ae1a8c926b778cfaed9d685138cdd12ce31a0ad08cc3e785d16eb5ac
MD5 a3e8a546d6ad26e3fe80bc92b0418fff
SHA1 64c7bff3fac5a8af048952d6c0cdc8388085ea1e
SHA512 d454b4bb3dfe1bc39932f55072d32fc4caf9034b56e3fad5c1af940e33f229bf19093ee394577b3cf4201c3866fb65a7992f7c675cc52f6e354c5ad57d8c7342
SSDEEP 6144:OE0VVUaITEmQhw38JBrkBjTm7Rkm1tYpBeh2BAoM:OXVoTEmQhwEBrkBu9oBGcAoM
TLSH
T1B434123ADE629D364CE0AE2F640A1B0F7FF15F5AC464EE81C8D96B00739E8D66A05570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-0-0x0000000140000000-0x0000000140894000-memory.dmp

Download

memory/1060-41-0x0000000140000000-0x0000000140894000-memory.dmp

Download