2b1bb5707405183995575b1261936855c07a7b162176379b33cd6320dc721a49

Analysis

user interaction
yes
max time kernel
39s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BUILD_EXE.cmd
Size 133B
Sample260804-ve97paszew
SHA256 2b1bb5707405183995575b1261936855c07a7b162176379b33cd6320dc721a49
MD5 6aafd32b28a826b436adf05a45ddc646
SHA1 83c27b7e43bc5358249e7551e0f2ddf95eb68581
SHA512 e739c7d401d5ea485dd3858c8ec275332292a2095312bcbbc107139f34b6118e6a85af73e424ad9f8d4252610edd53519d26fa057890a5dc4a3aea5e18c8fe81
TLSH
T16BC02B15A31C834C10D3A81614C548F00A0F018773818A427031032FFD5D054C324285
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3868	XenoDumpInspector.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3676	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2224	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303361453880824"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3676	powershell.exe
3676	powershell.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
2056	chrome.exe
2056	chrome.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe
3868	XenoDumpInspector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3868	XenoDumpInspector.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3676	2224	cmd.exe	87
PID 3676 wrote to memory of 3044	3676	powershell.exe	88
PID 3044 wrote to memory of 456	3044	csc.exe	89
PID 3676 wrote to memory of 3868	3676	powershell.exe	90
PID 2056 wrote to memory of 1756	2056	chrome.exe	100
PID 2056 wrote to memory of 5064	2056	chrome.exe	102
PID 2056 wrote to memory of 4136	2056	chrome.exe	103
PID 2056 wrote to memory of 4136	2056	chrome.exe	103
PID 2056 wrote to memory of 3788	2056	chrome.exe	104
PID 2056 wrote to memory of 3788	2056	chrome.exe	104
PID 2056 wrote to memory of 440	2056	chrome.exe	105
PID 2056 wrote to memory of 440	2056	chrome.exe	105
PID 2056 wrote to memory of 4828	2056	chrome.exe	106
PID 2056 wrote to memory of 4828	2056	chrome.exe	106
PID 2056 wrote to memory of 2472	2056	chrome.exe	107
PID 2056 wrote to memory of 2472	2056	chrome.exe	107
PID 2056 wrote to memory of 2208	2056	chrome.exe	108
PID 2056 wrote to memory of 2208	2056	chrome.exe	108
PID 2056 wrote to memory of 3980	2056	chrome.exe	110
PID 2056 wrote to memory of 2564	2056	chrome.exe	117
PID 2056 wrote to memory of 1952	2056	chrome.exe	118
PID 2056 wrote to memory of 4860	2056	chrome.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BUILD_EXE.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\BUILD_EXE.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /optimize+ /langversion:5 /reference:System.dll /reference:System.Core.dll /reference:System.Security.dll /out:C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FAB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC46A04A6EE5FB43CF9A5DF67DAE6C288.TMP"
      4⤵
      PID:456
- - C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffba41ec728,0x7ffba41ec734,0x7ffba41ec740
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,8539734438699012032,8797544905623443192,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,12539880117990059459,17447144002373320735,262144 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2045879501643368064,694204781601006536,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,13233345576736979737,8463323076343043297,2097152 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,1964060405018875173,11836226273208929397,2097152 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,4951730868211191526,14490952922634098528,2097152 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,5729822752200318041,2086314793903204994,2097152 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,17077850554242295077,375278176522464175,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,15193891909773569261,16655495441732627528,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,10913681609995499982,14549022349037947416,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,3578444228469185699,11498043454111475563,524288 --field-trial-handle=2116,i,6392042858455805986,1594373541878072307,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 72abcdee19c9daa1813e6df357f73462d46ac6f6f62c06a884cf401719f27795
MD5 2f073759c91ed2697003e87c34450bab
SHA1 6413a6d9178bc65c37dece072c19961d3ff9806d
SHA512 6741ad02eaf340638cd2b9890290ecee57839086bbd6c320e07ef44b5125342d126f5ad2f4c8a15fc260265a86e9ae3025b2211aa7ca6960328c009cbf39474c
TLSH
T16FE061B9C920AD2F09FD071824590746E79423172B41456F3A3CD30D8FB9A370987C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d44ad9f1c919880b3d169a06bc81b869c613c292f1a30fd711c555cf7e6f4664
MD5 9af89f7c2e9b06fe6b8bdb25affc46a6
SHA1 b280f190f1d064d317353db276d10218f4a24582
SHA512 194893e0dd0f9b2071452eabc4462f7bf23013b244fac8b9d9ca7257f1b09017371eb0ecf1c04e0012f161f3830de25ca8d961584dbe4611dfb8eb5fa4c407c6
SSDEEP 192:5RmgHYzXnnYv72ympAPRp2/95Hsb+WNnet0Q6e7zeFN3SaVyIsnAUgtaJ:5RmauEQUXo7wA0WzeFP8
TLSH
T10C42D92EEA10657F5CDBD31AF9523753E7F6102225941E84EAFC9A3C19E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cbde2c447f93a683457c4ec081fb03cfe62647dc7660970015694d72a8ce9b25
MD5 cec91cbdd79ac4ad8f135ec790e9befe
SHA1 4200274230a878818718942c50bbaef2a0fff94f
SHA512 7ab2f3deaa4d37be4298032704bca340fbc04049d7d6bdc74191dbffc668042a258b617afb49ba8d750e856ba1dbb41162a9251ab0c84153461dbc031a0117bc
TLSH
T133B012C180016145C01306F42143149872149F20970B170543F06B22C83A6528034250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f121.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f121.TMP
Size 96B
SHA256 88d72b16de418d5835fd74bbceffbbf7567dec2db88b03c9359b92b9c65a07fa
MD5 b6e1c38e0e300dd36eb86a4b4da55a0f
SHA1 b7ea8e255f8f6197197bb71f9f3716b6141923f2
SHA512 a7fb48a05257df723602bc63a60370bc9a81f8f8c307f6487be4906caf9f320a589993edc3b20addb4d71a647702c4abbe3724fb0e8bc96bfea6454a738c88e5
TLSH
T158B02283C082220BC0C203F028C080CC3A20EF32C20322038AE00BB3CC203F08832C20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f3221c9b9206356c427555bcb96b6364e3c1064eb2a8b30d2e70b676e9bf64c2
MD5 53eb78bb702ca215c85e5ebdcc47047b
SHA1 1251c6dc7121e5247f898bc4a6ccc27e8621c905
SHA512 57a51036db143568fdbe2cd339c774f6736626a619e6772ed7eb187486a8c3f800b247806636c19e4c40a83df6046a5a03e3a89337f99ff6085d061a746057a0
SSDEEP 1536:TFQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Uqfd7NtZL8cHQRZEQ6Spsk
TLSH
T16EC30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c0d25124bdc3584f142c181fc926087cf79f406c4fe531b55f19eba80023edad
MD5 3b0522dd76fb68631701edccf3789c6b
SHA1 c333850603b07158565dcce1f432b045690d2e47
SHA512 9f19b028e61d8f20c014b5b801c440b31cc592b29aac7644092ace5b03c8c463dfbcf954b748c0000346d4dbc91b9eda2129e8caea314d1ca4a9493aa85641b8
SSDEEP 3072:56ccucgpxv52FDTBrqpFGFEiBWqfd7NtZL8cHQRZEQ6SpsM:5KuUn19F3WqZ/ZLW3ExM
TLSH
T118341222DD6A1E376EE5CFBAB0630DDA53B74B95D0384345CFB93BBB2821A11185711C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES7FAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7FAB.tmp
Size 1KB
SHA256 8b5e8b30302a0c7c0d38820cc639195c25323aef47a8960f89c41cfb89f7b970
MD5 ce3b13172430cf31f6382a5d9f4bab4f
SHA1 ece6ed734506af170b2bf362c8e4b6dc96a1561a
SHA512 173e887381f0ea6560bd911a243dd31037248e2fac367464a84c8280b4ab97eee3e7c6c752616a6526d192116475dc44efc3fe9869def842ee9ed20e828c556b
TLSH
T19441444093EC4B1AE271473129F79719623CBE55AFAA575EB184122F1F12740CDC3672
MD5 SHA1 SHA512 TLSH

Submit Download

XenoDumpInspector.exe

Path C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe
Size 12KB
SHA256 3b804780118e75533ae51c0046300be00845a881972fe43677f98f27ed18324a
MD5 937aa76cd79a9c4383fad072d414fde0
SHA1 a19cb80634d251649738ec9fe5131f0c4aceabed
SHA512 ab0147e9ec66426d4c50e9586d68836f46a489b5a10fd280bc30299455d072b42d9400ddc6d7e49ceaf9deae12690915901153b95a956663563fe335de45cecc
SSDEEP 192:reD1rWhU+WM9E1WhLiDbol6Rp1yrEmjKswIXsNcs8BfJjY+:arWhU+WH4MbW6Rp1yrE/Jcs41
TLSH
T12E42B404B3FD4618E5FD4B7599B282540AB2FA239932DB0E1DC901DE4E36B404E92BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w0s3ku2s.2c4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0s3ku2s.2c4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC46A04A6EE5FB43CF9A5DF67DAE6C288.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC46A04A6EE5FB43CF9A5DF67DAE6C288.TMP
Size 1KB
SHA256 0de4aaed3c8e53f6817db7fcf3827487b234968b7f9a27b4ce5db28849155ff7
MD5 6f17457befd21ec9bf6ba3d0e76ab988
SHA1 9749213a8baebc21ae1c0629fa3c9028e6ad4b0e
SHA512 a5d072cf897f327f708ddfe85ecffb16f7ac8b1ef855ce2bede05bc398b5dea9fd916977cdbe36068d9b91253c9f821577e484070a4ed43cc6b3f576c69207ad
TLSH
T18B21C041A3F8421DF2F34B707AF2D363916C7E669D7A47DC3488171F5B15A0085536B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3676-31-0x0000028FF99B0000-0x0000028FF99C0000-memory.dmp

Download

memory/3676-55-0x0000028FF99B0000-0x0000028FF99C0000-memory.dmp

Download

memory/3676-1-0x0000028FF99B0000-0x0000028FF99C0000-memory.dmp

Download

memory/3676-2-0x0000028FFBAD0000-0x0000028FFBAF2000-memory.dmp

Download

memory/3676-0-0x0000028FF99B0000-0x0000028FF99C0000-memory.dmp

Download

memory/3868-19-0x00000000000B0000-0x00000000000BA000-memory.dmp

Download