hxxps://cdn[.]discordapp[.]com/attachments/1526419697191485450/1534151045263921172/The_Midori_Files[.][.]pdf?ex=6a731500&is=6a71c380&hm=f19e0a2d2c97c3d178228b3564a1c632a7953f814ad43aabd0cdd808199e7de8&

Resubmissions

04/08/2026, 23:19

260804-3azjdssgrh3

04/08/2026, 15:54

04/08/2026, 15:54

04/08/2026, 15:51

04/08/2026, 15:41

Analysis

user interaction
yes
max time kernel
899s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1526419697191485450/1534151045263921172/The_Midori_Files..pdf?ex=6a731500&is=6a71c380&hm=f19e0a2d2c97c3d178228b3564a1c632a7953f814ad43aabd0cdd808199e7de8&
Sample260804-3azjdssgrh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303591809600895"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3164	chrome.exe
3164	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3144	3036	chrome.exe	85
PID 3036 wrote to memory of 4488	3036	chrome.exe	86
PID 3036 wrote to memory of 1804	3036	chrome.exe	87
PID 3036 wrote to memory of 1804	3036	chrome.exe	87
PID 3036 wrote to memory of 2128	3036	chrome.exe	89
PID 3036 wrote to memory of 740	3036	chrome.exe	90
PID 3036 wrote to memory of 2128	3036	chrome.exe	89
PID 3036 wrote to memory of 740	3036	chrome.exe	90
PID 3036 wrote to memory of 2232	3036	chrome.exe	88
PID 3036 wrote to memory of 2232	3036	chrome.exe	88
PID 3036 wrote to memory of 5080	3036	chrome.exe	92
PID 3036 wrote to memory of 5080	3036	chrome.exe	92
PID 3036 wrote to memory of 880	3036	chrome.exe	93
PID 3036 wrote to memory of 3772	3036	chrome.exe	94
PID 3036 wrote to memory of 4796	3036	chrome.exe	95
PID 3036 wrote to memory of 4796	3036	chrome.exe	95
PID 3036 wrote to memory of 4728	3036	chrome.exe	97
PID 3036 wrote to memory of 4728	3036	chrome.exe	97
PID 3036 wrote to memory of 1612	3036	chrome.exe	98
PID 3036 wrote to memory of 1612	3036	chrome.exe	98
PID 3036 wrote to memory of 1524	3036	chrome.exe	105
PID 3036 wrote to memory of 4132	3036	chrome.exe	106
PID 3036 wrote to memory of 1796	3036	chrome.exe	107
PID 3036 wrote to memory of 3164	3036	chrome.exe	119
PID 3036 wrote to memory of 2192	3036	chrome.exe	127
PID 3036 wrote to memory of 2192	3036	chrome.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1526419697191485450/1534151045263921172/The_Midori_Files..pdf?ex=6a731500&is=6a71c380&hm=f19e0a2d2c97c3d178228b3564a1c632a7953f814ad43aabd0cdd808199e7de8&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c6a8c728,0x7ff8c6a8c734,0x7ff8c6a8c740
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,16259984841998228595,10786512391198173404,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,12058920072239516704,7452485996113597041,262144 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,6289188985987426982,12207846746828665701,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,12330771042264394369,16697630688646121497,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,1744469709769090060,2107178609730175174,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,7901693982032419460,1416891691309552554,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,17516640271958743888,12037775063104361882,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,9582378032552664954,13091013100746193644,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5652,i,1495798645137884233,12770591474268141677,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5868,i,5181052850530602877,5616224625230526179,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6056,i,4074732439951873464,8922758313684576553,2097152 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,1575078090628983772,14139005404308429648,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,2081882021857707120,3779818638674357535,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,11617964002939745448,812361496458711783,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4140,i,12593750069311172078,13630189754206536519,262144 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4172,i,9174028480214031564,2194200411350843649,524288 --field-trial-handle=2092,i,6203825820076525025,8145867600256835816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:2192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 69c8006bdb944591adec3fd8e8d848e38d9043ddcdb1a8dbb2d51529d405cca2
MD5 2926a9da40464e48b5ead80e22287fb7
SHA1 a245136b661f606d33c87016c5c92190e2961df6
SHA512 5b89bfd6551ef0615684a967eb2e806163fd65a82e35c708a68f6cf400910112b5cee2b63083fa06bbfe42750b6fe8429faa1a13437f5a641336ecfc715f9323
TLSH
T1AFE02BA9C861AC2708FD5B2824540745F75113273FA0D81F3B3D92088FB5E3B8166C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 c3da9ef9fe246eb2315301a4178e26b1be50023318d5fedbe14991cb752c69d0
MD5 c373094c7affab532abf6fa29e814bbe
SHA1 033679877b833943dbd558267ea3c5d06c9f237a
SHA512 86ce47203947c84009b7060ab568f61558450233256f6afbcb7418141aaf6ec87e21dea69fca2d376ff735a2d316d2bbbefee65e22b676b2b97e6cfb061c4105
TLSH
T190C04C0236C070D2CF823F791485AD4439D13690B35503D3A5FFD355995FAE9A049572
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3b2361218601a5fe943cc94c7360dd105974ad548fcb9005a591c7ee88314696
MD5 b532e89fcbefc03df15b03178d08d1ef
SHA1 c00cd0e6ba05cc2e37912ea13da9af39857c3959
SHA512 5c88dffe57780d1b1d891fbba231735a151abaf000daf06f91fee29134e09dbfbc2955742dbecd0b1ca740ec2e53b995ae14fdc350d98abe2325fde08356f6a1
TLSH
T10C41A0F793B4897D8A1196F4EB156F1FCE690514031C3CA689D4AE2B83E2972E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d94dfc0386ca90801c17e4e2c1abacaa6a50c2d708e67affee2c6a680cf96fb0
MD5 2d3f9a1af0071aed58b77b767408e5b5
SHA1 9e46d7b9b53dccf4386faa7cb816df69efe3f935
SHA512 3e22b3af2c9899573b5b44429127035fe12a0ab0045c9d41ed85e88c7be6925c8f34846f328f87953a8bb54a5b4dea113b38f015addcce19d1f9f1d2d79df547
TLSH
T1B0418DF793E4897E8A1192F4EA156F1FCE6D0524031C3C6688D4AE2B93E2972E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff105922c1a3f98cdc3102f04504cce8fd1a3f1f58f15ec911a5039a12bce0e0
MD5 12ae109f2561b3a1d5773524cf88645f
SHA1 f5ebb301b35cc389c3592804240f64a0d4c58cea
SHA512 024ab19f16e2fd0223900d791c139041222b2241c39ee3336ae924eea3129fac14308838d58060a4f16ddb8aa4382385865ebb9d98f1b9c99be5a91b6c06de19
TLSH
T1B941AFF793E4857D8A1196F4EB156E1FCE690514032C3C6688D4AE2B93E2972E140A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fba301fb7d1bada191c33fa6331f5c5cecfe28be45c4a1d4f9a57f34754278ba
MD5 e542607028c313c4ce33d402529394af
SHA1 2fc751acbfc238ff8aebd98a1abe0dff08ff760e
SHA512 e34cf1ff72a7bef27b831d18b687940c82c7b8a72343c065d883f5abe2e950ff47dade607b5eb7ca9e7613779fd6977f5ad69154bdc6175ac31dbe3ebb27d5a4
TLSH
T1F451AFF793F4857D8A1196F4EB156E1FCE690524032D3C66C8D4AE2B93E2872E140B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 8b340c0b9e25ba51907e3c8a4105986c40a7d4a5771f778e993b801b50614617
MD5 9df3e2c14c20d6ae7bd89d09e2e144ac
SHA1 615faff91cd81f97066e92d4bdacfe17c7144d1b
SHA512 a342898e58436e6423eaaa98dc192996ed98ee4b95ec230b0117e6a67dc4829bd1e7097392d91732377fbd900bd1809949ea040ca9f13fd8fd4c2e42af678405
TLSH
T1D5F059ABAABEB467007945BB1D057C0965B5B43402C078E8CFBA826CE1D24F31B02063
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 791dffb3b6387eb553c86689355e9c510b57945dc2b72fb99369bf5c96419e75
MD5 cf568c2d8d9f59c3021db24a696ca668
SHA1 9a3e5537480c3f907af6d8adc2ca298c9ea8cdbc
SHA512 a4adc6e1a90738430e155c8ccab9f07783e1af8d5b15fbc9e8772b33a280a30a26eff650299a3b44010238228759c66cfbc2bd9358366af6023dbf3e31d4cdc7
SSDEEP 192:4RPHYP+AoPOv7cpAPRp2qOU9BHsb+WNnHlPI6Fv32x883VyIsnAUge:4RPHm+JqwUXlnrwFPIyv32xxRe
TLSH
T1E642C72EA914667B5CDBD229FD267B53E7F5202225902EC0E6FC892C15E76CC321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5a4f2115def9d7c8f9e94cbc3035471227a4c0c20a4612e28cb09b8fed9c563
MD5 9f7bdfee98739d5f0151dd52cb60e866
SHA1 5acc0acd87181451666bd714088eff459d967c44
SHA512 257f62b37e3f1d794db92a1529f2edc11f62bc5e214827cc92c32192982805502de06dd741ef3d893c6ab638ba0bfefe0632d156aa375cfc33117298fa916e95
SSDEEP 192:4RPHYP+AoPbv7cpAPRp2qOU9BHsb+WNnHlPPFv32x8I3VyIsnAUgE:4RPHm+JjwUXlnrwFPtv32xtRE
TLSH
T19742C82EA910697B5CDBD219FD267B53E7F5202225902EC0E6FCC92C15E76CC321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9c3ed0b3da3ab1043938557a79e4a615e493ee014c11cd500af529a0e9d7b496
MD5 7f832322c49670acd45f68af0a40203f
SHA1 beb6c0d3a69b871086ccac4b682fd152567fa961
SHA512 55982b22c45efcbfdb23dd1856f16d5c46aa96047b789ffc563cec6e6b47e5408a913641d355b0308617c36cf430bd0e2da870cc5a74597740cce1167cc13456
SSDEEP 192:4RPHYP+AoPcv7cp8PRpWqOU9BHsb+WNnHlPbFv32x883VyIsnAUgE:4RPHm+JIw8XFnrwFPxv32xHRE
TLSH
T1CE52D82EA9106A7B5CDBD229FD567B53E7F5202225902EC4F6FC892C15E76CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5ff4972ea20a9c0eba65638470dfddc5d9fe1f852ede33ca6afc634909356e34
MD5 b1964ba49cbc86cc84f525480c6fffde
SHA1 b6ada710c29e64e6e1f8982820a0a5e0eb7b62ef
SHA512 e350fb51141fa712b298d966434033a7bf8f337ae85cd271d0d94e14274a1c8b1a230e7d04ff636528aa9da841ab810cf0a6e6b8c05fa534d37b75504b721ff6
SSDEEP 192:4RPHeP+AoPWv7cp8PRpWqOU9BHsb+WNnHlPbFv32x883VyIsnAUgE:4RPHo+Jiw8XFnrwFPxv32xHRE
TLSH
T13752D82EA9106A7B5CDBD229FD667B53E7F5202225902EC4F6FC892C15E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c08e9d9d59c39beb258cf863426dfcdea055bfe0ef32f071a94b313654171692
MD5 8a2346f3a9e861553a9359bfe668a13c
SHA1 ed9d6250644662fb6ee1651bf684bbce47e977e0
SHA512 9d946b98f5f7fb68ce2428b52beabeed5bae3639b6a0fcedd7de1eca1dbc0e346a4c81e63f5a5c61cd0323588b6610fff17b47053e1bfba7f6f9b80d3f226124
TLSH
T161B01200C0037241C04602F0214B18C871546F11960B2F0157E06A26C8355618414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58efca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58efca.TMP
Size 96B
SHA256 e3a4b9962e2ee315aaec205db585e9c60e49f8ea4f09d44b40a13d00818b7461
MD5 e4a51b87160b940885c7fc2095687cb7
SHA1 8c019012d45bdf48cc292060497bc773ee6fa2ba
SHA512 971f86ebc1b1f004bd55e35b06ad5d76155d298cd47155a2e69f734b712f836dcdec6d33d18b8a52a93cd989c11438a76d89e19f3423c8b844d8afde7c360ba4
TLSH
T1BBB02208C3223203C00203B030A880C830A0CF32EA030322C2F03BA3CC282328020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cd594576a1ee068ea80437a846fe7b9d23ec3ae01af69270ddadd2615e9380b9
MD5 3bee25aa35b8cb38c4635eccb508abf6
SHA1 60b1175d7d7f90aba8e042b0fe56a797e03a27ab
SHA512 2234d8df4fac4c217f5125366696b3f665ef8f767263dd8527d876d5e25850765f600b66ae3bbc52d67adedb3d1ce55b55ba67f64355a4770df5168b05841d89
SSDEEP 3072:MaFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:VFmUi21rSm8uUVNSlzY/
TLSH
T1AEC3130079E7F9B3EE9930447AEE3A158D680D818291C5015373AE415DDF3CA2FAAF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 69d79910ef9f0fb2365a4b9596609915a4d88372ea1cebc5e4f32e261a6c5a97
MD5 b05533149f4cd8cccfac08609b90f869
SHA1 aaf8291437c087a49f3677c01aca98ff638bffd0
SHA512 89adadc31e191db2a450d277f41fbb1dcaa404e2883e4c5133b61e0c21e4d06439eb95c1130e1bbac18b7667fefcf96a04d5f212961906cd96c7e1ac42e0b30a
SSDEEP 3072:MdghFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:BhFmUi21rSm8uUVNSlzY/
TLSH
T17AC31210B9A3FDB3EE9931447ADE2A148D680D41C291C9015673AE415DEF3C66FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2aebb1c2545bdb326a23feafa723d73a1a55c6b4ba2ee5f255603db31ee67f40
MD5 2d3c3636d38725734caaf5cee780f91a
SHA1 b50df18409068abb1db3de1f813bf2ab8288b608
SHA512 2865dfd38ebaa7068b0baf21a1e39cf13556a3da5ef15fd2fbab849c34da5b063be4881c48c93b6524b0fafb249b70c66637c9001cfe3365648855c5fd6126d1
SSDEEP 3072:S1FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:cFmUi21rSm8uUVNSlzY/
TLSH
T1CBC31300BAE3F9F2EE5930447BEE2A145D6C4D818191C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 40a6910e2e57f2ac6f42215e279f1508bc2c78e4158f5044fcda0bbbdc9282d2
MD5 76caf728a5bbccbbae6cfd9d1f6759fc
SHA1 0ed621d734a7122045a50da099d1137b05d6a8fe
SHA512 2d80deedaa83a10ffd8f46b57d6b673eaeb9ed6ccf98b19d5e664e1c134c0c69a5c1aee2b3b3551e34a963c2ad369c751fd172aa89fe990a9d07aabc088dd111
SSDEEP 3072:M1FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:wFmUi21rSm8uUVNSlzY/
TLSH
T142C3130079E7F9B2EF9930447AEE3A158D680D818291C5015773AE415DDF3C62FAAF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 0c9642bdee0599b5d04a5b272171feabc9ae13a6a7233b1fc24bbdae307229f2
MD5 595d9081764608961a62ccc786a07b6c
SHA1 45c7dc36cb2eddfd6255418e84a8cb258bbc1bdd
SHA512 6783463da2eb6bfffdf0dc3034ccc8847d703d64697e1c93a9342ba7f61b81378ff9903b7fc0345e449dc14ca545558fefea015572df48d9cfb13ab1bf83168d
SSDEEP 3072:MhghFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:RhFmUi21rSm8uUVNSlzY/
TLSH
T1D2C31210B9A3FDB3EE9931447ADE2A148D680D418291C9015673AE415DEF3C66FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Midori Files..pdf.crdownload

Path C:\Users\Admin\Downloads\The Midori Files..pdf.crdownload
Size 486KB
SHA256 c8141f852eb6f28ab1d7593ad9e24ad935b431e8a34bccdf468356d50911f65f
MD5 555058c8044915580578f00dcbc564be
SHA1 ace2ad5e646a9638345774e5ca21ad03bdad45bf
SHA512 233ffafb070c94bca70463baf71e9bf65eec563f4dc2ffd6bd424939af9ed26475f08ff8b90d06420268c5605147f4002646c535a6105a3a81c5a89ca866853c
SSDEEP 12288:y8i4vju8m6W3AIC0l6q2dXpRZJASetuWpbdBCndj2dKlF:Ni9FCA6XRZJ7dj2dm
TLSH
T13EB45D938D04579B902987F87E070EAD6F497B4CE88576EF242A4EC77F206620CCE15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download