075f6eb5de7ab4e44f9d991a8d9e5b074e460a56b879ad3ed43177d6df7ea873

Resubmissions

08/08/2026, 03:47

260808-ecfmaszbrc3

08/08/2026, 03:47

260808-ece1rszbrb

08/08/2026, 03:39

260808-d76arshj6y3

08/08/2026, 03:36

260808-d57e2sswdy3

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
albert.png
Size 168KB
Sample260808-d57e2sswdy
SHA256 075f6eb5de7ab4e44f9d991a8d9e5b074e460a56b879ad3ed43177d6df7ea873
MD5 0c90765bb7e27a93ea9fdb026bb2d396
SHA1 ef43c80a91de4fc02912000e0e21e4cc058819a6
SHA512 e255ce3cc7683626b3ab7e94a0778abecf880fe4472bf5b3de11957761e30a7d9c457cd7fc682e03d34bb7a33da188b1846cd195b4466d3b052e5f553526f91c
SSDEEP 3072:Bs9nYTljOoOed3KhqW4p5JdaehAFkNZU0u4Hzv3cIwMz:q9nQjOoxd76ehAFkFZvcNMz
TLSH
T135F3124248E49C5F35EF2CFCE4BA640050DA3A95B45BFE768F80611213EA4DE54AB7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306338198690230"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2908	mspaint.exe
2908	mspaint.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	mspaint.exe
2908	mspaint.exe
2908	mspaint.exe
2908	mspaint.exe
2248	OpenWith.exe
2268	OpenWith.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2816	2500	chrome.exe	95
PID 2500 wrote to memory of 1928	2500	chrome.exe	96
PID 2500 wrote to memory of 1928	2500	chrome.exe	96
PID 2500 wrote to memory of 4232	2500	chrome.exe	97
PID 2500 wrote to memory of 4884	2500	chrome.exe	98
PID 2500 wrote to memory of 4884	2500	chrome.exe	98
PID 2500 wrote to memory of 2336	2500	chrome.exe	99
PID 2500 wrote to memory of 2336	2500	chrome.exe	99
PID 2500 wrote to memory of 3048	2500	chrome.exe	100
PID 2500 wrote to memory of 3048	2500	chrome.exe	100
PID 2500 wrote to memory of 1620	2500	chrome.exe	102
PID 2500 wrote to memory of 1620	2500	chrome.exe	102
PID 2500 wrote to memory of 4896	2500	chrome.exe	103
PID 2500 wrote to memory of 4896	2500	chrome.exe	103
PID 2500 wrote to memory of 5112	2500	chrome.exe	104
PID 2500 wrote to memory of 624	2500	chrome.exe	113
PID 2500 wrote to memory of 4356	2500	chrome.exe	114
PID 2500 wrote to memory of 964	2500	chrome.exe	115
PID 2500 wrote to memory of 3796	2500	chrome.exe	116
PID 2500 wrote to memory of 3796	2500	chrome.exe	116
PID 2500 wrote to memory of 4116	2500	chrome.exe	119
PID 2500 wrote to memory of 4116	2500	chrome.exe	119
PID 2500 wrote to memory of 2152	2500	chrome.exe	120
PID 2500 wrote to memory of 2660	2500	chrome.exe	132
PID 2500 wrote to memory of 2976	2500	chrome.exe	133

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\albert.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9150dc728,0x7ff9150dc734,0x7ff9150dc740
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,3940054152515589526,16128678556439524686,262144 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12118062386407318984,1513233961799423059,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,4310705463971784486,5467907777455955848,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,8868708565441055120,1675054640328807526,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,9022991483636073765,4262340311469893261,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,15917419871569240391,5986674358714128052,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,12904955672160282295,4056343116622968662,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,7353632072985281764,11794104505298461306,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,3010966701722005518,17325483876395307133,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,4564633121748476103,13900699666936593287,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,7246371454370141986,3105691052465326055,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=252,i,11195501989284572728,4327351208826813053,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4544,i,14890525578140201034,14328269058645856251,2097152 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,3750494622142302107,4656879395711010574,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,17748564856452907355,16034113658509926861,524288 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3240,i,14478416212621207196,9370695566748859125,262144 --field-trial-handle=1916,i,12592222602460817025,4118244314009637067,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4accd089-51cd-4ec2-9d1d-70a7a1728660.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4accd089-51cd-4ec2-9d1d-70a7a1728660.tmp
Size 293KB
SHA256 ab0bbe1bc28142e1b7eb61965d66eb949864f4c375ace8bf609e946f1b61e096
MD5 3a8913840c2cc27ab39962b0af3f33ff
SHA1 1e3e2786b4722720947be838469c8d4f70117f27
SHA512 2659315413405180a6e5cb2871ca280694cf20a463f485274d244badeb15ef70c41d71f53ca4e3f1d59e124fb246646eb895eec2b70f6c227777781d39086023
SSDEEP 6144:D9BY5z9hWPKO8VY/v/3uukrVEQ0nEdm7Rkm1tYpBeh2BAod:rWB0Z8VY/XznE09oBGcAod
TLSH
T1AB5423375D86583B58F12B5E708E162A5DF04EAAC228CDDB94C87B08B3DF5D40F66A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d63abcdc0e7a49e5047520d9644f55d9d48a909eee3b280e4290bb1680ff55b0
MD5 cdda42fef8ce54396749c0f76737396e
SHA1 6dc8e5f2449242bb4d490711ef65f5bf3a72347f
SHA512 de25649c3eec3f16e96692d212bf3f29b3b8d475b278ff4a73368b565e463094ed4f79707ab0cc30aa96158d71cb3fd6d42c7a26b0acb179ece4024f30bc5552
TLSH
T1E3E02B69CC21BC2708FE075950140789EB54575B2A94556F3A3D611CCFB062642D6CEC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 f1f840fef2a82ea34a8fa88328f2dfb43618d46d3d2f4b3f9d95a79e06637eb6
MD5 0af79560a7d3e7cc639536cdcd6432d3
SHA1 0681e809c45682b8634de2e2d8ee5aa998cb2bdb
SHA512 b9cde1c862691488d58ad9c0121c54aafbe0303d79cef7ce4f97de319f047d9b70e8a1431d30ea0943edfd2c8f60ac32c528a5834855488010aae2ec570342cd
TLSH
T19BD0A717D2AD6483F79C117150C06D64E23B876E51439B1743551EF90CA7BF7010A232
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1030e375dffbbc4a35472cdbc0e788dfbad8cf6c01a4641f45c652b24721fcd9
MD5 7513ddb5c356490528a7436229b188a2
SHA1 8af28ffbfe00e6d2bdd8b2d4fa8f40c8a79b979f
SHA512 094f961d3f32fbe8350723c93c00980bde80a37e4bed1699c8bab076beb9ebe3db819483362366a9b83d84a44d4d7815f9907491ab43a6d7fca99a1fda84e8bb
TLSH
T1D071ACF7C3E4896DC55196F4EB146E2FCE290918526C3C56C9E4EE4B93E2872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f86973ac29d6a302febb5a4a6273aba38bcf27e5282db8950162457b8245255d
MD5 2f1dd6c3f2de4415fe407e8de02c10e1
SHA1 4ea9db0d1da121c13fda8c24c3f90c19da135eeb
SHA512 d9d05c42428365769e6cd52a0265726d898f053cd07a558b6a10b18c165f0bc8f0497563fdb3f6c7979c09a2c3c864f7e3269842fad5eae4073e8ff211962f17
SSDEEP 192:uRMKy8IedfdGv7shAPRp22F9wHsb+WNn4O0ZX93s5lPMx+VyIsnAUgtaJ:uRTt7yY8X/FKw90R93sLS28
TLSH
T17042B63DFD14693B5CC7D22AF9227B57D7F1102121942E94EAFC992C65DBACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f6b679acd096be1b13534cc45caab4a69f75e422171453cc89ccf7cf5307e8bb
MD5 39124698bc40ca17d851526765acc96f
SHA1 d2c841e1e8ab2efeb19d097bb95bbd0f6f1ff3bf
SHA512 1d5fefb2f4f4fc73358458795b5b9637dbdf889647f336d58ca94acfd1e282be3ab3eb1928fdae45643bbcd9c1842c2dd79a9b45e8df320107507b995d32a6f6
SSDEEP 192:uRMKyfIedfcBv7shzPRpb2DaY9wHsb+WNn4Olw8ZYZX93s5lPMq+VyIsnAUgraJ:uRTIORYBXyOYKw9vYR93sLz2e
TLSH
T1A152D82EFD14793B9CC7D229F9127B57D7F1102121942E98EAFC992C25E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f48061f35349cafbef3341368b8a733c37434b0da9951bf3adc41fb4cfc29f36
MD5 cbd1464cec9e15fcf83414c23b840d46
SHA1 777b06049828143b2725ab66bf4826bd5745306f
SHA512 0638f31ea27e199d0b4b7fcce8cbab7b20876d5fe15410bb73918efc78003f593cc802687b10f6d9503aa74a1db46a606fca88e88d434ba5369c582d25ea837b
SSDEEP 192:uRMKyiIedfcBv7shzPRpb2DaY9wHsb+WNn4Ol4eeZX93s5lPMq+VyIsnAUgraJ:uRTBORYBXyOYKw9veR93sLz2e
TLSH
T1F652D72AFD14793B9CC7D229F9127B57D7F1102121842E98EBFC992C25E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e6e3cca492f4491489540a2cf291009afcafb5167a0ee7d7857944fa708c86ce
MD5 f206b63002f62ef1638951cfda285303
SHA1 b68b1abad713a4566549ab4efb353f73f89c099d
SHA512 fc0e61d4294c443479dbbaef7fb6114f0a12167212f56d8bcb9d48dee260e2f89d6c0cf1618ab0ee51d5f9b8238a4ae49380d4bb8b30c8eeceedc6996829b516
SSDEEP 192:uRMKy8IedfcYv7shzPRpb2DaY9wHsb+WNn4Olxn2QX93s5lPMq+VyIsnAUgraJ:uRTtOEYBXyOYKw9X2m93sLz2e
TLSH
T15952B729FD14793B9CC7D229F9127B57D7F1102121942E98EAFC992C29E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5762750d3292ece6a38912334120f2b39c818184c43084830b19bfbebe73f0fc
MD5 a1e6d79b9b41c2777e63d470ab412102
SHA1 2330d35784c9d1d97d0ea2129b1f57d0b6af6206
SHA512 de7ccd56fe2851d3909c2debafa543970c372e054a763dbf9a665185726fcf48afeefc6611976cf3bf0107be1f5f59a497c9ac7cf48b2f953a5d3a9eeb5da509
SSDEEP 192:uRMKy8Iedfctv7shAPRp22F9wH0eb+WNn4O04X93s5lPMm+VyIsnAUgraJ:uRTtONY8X/FKp90e93sLl2e
TLSH
T10752A62DF915793B9CC7D22AF9127B57D7F1102121842E98EAFC992C25DBACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 74fdd3fd1319cac92c57e38afbd9acf44132b58630ecf6f4b05979a3e047b000
MD5 8f8b274305b29177bed2ed8f68871861
SHA1 4fa93d14113c7f41ba2e7e87f5d48cbf4056c8f7
SHA512 9418c9e5dab56798e8a38d00280966b6cd7a0ec0290b30fd54815ab01d2c9d4c4468cb4b691e1a0e4e8ffdb3597a982a70918b06a7f09772489f64bc45b339c1
SSDEEP 192:uRMKy8IedfcRv7shAPRp22F9wHsb+WNn4O0ZX93s5lPMx+VyIsnAUgtaJ:uRTtiBY8X/FKw90R93sLS28
TLSH
T1D442C63DFD15693B5CC7D22AF9127B57D7F1102121842E98EAFC992C69DBACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 8ae98fc9a5d26f3e6328865a2b5272130876374a389894e67909e1c8febf533c
MD5 4247bc9dcd10eb0be40501c15a3edb9d
SHA1 1cb19c7c5e56067b2bc96ecc76b0aeaa26a0eb2e
SHA512 75a7d846909241a4be1ab074096e5373c6d2432b29012c9072a70c9227fe7deb258d0098e051763a5501dff5628f4d35b72e1fd0e4a01cdf552ca635de6a2e0b
TLSH
T133B01200C0019242C84702B06282248CB1185F18B60E2B0543E06972CC2A9668014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585407.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585407.TMP
Size 96B
SHA256 22a046396d39432783d48b6e9b1d715f34dabfdbe156c3b13884e3cc0a108e2e
MD5 c4c426a6a1625cbc49e26eb9ed424748
SHA1 e448af483d75b23ae8d7978fed70b9e2a63ddaeb
SHA512 05a2d5d6b50a2ed6f3044e271d2544b2af1adce7240d79b16aeb58ccbac22e96bdb0c8b1368144c4c7ceec080a724d2650a5d3e0d4fc1e5e16939b9be781ac49
TLSH
T12BB0029AD102B256C04203B06AD795D9B6B4DF25C603232392E01EBADC25A7245292E5
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f3409013fa27aef44abca6212cc9811fc9d938fa890d61446f8184a2196dd8aa
MD5 cd5a418c58ff6eee07a154d05710034b
SHA1 5887ffd48d3663e185038f1f1de6da4c8855246d
SHA512 8f1e4bc7ac46dc9e353ef9009735e5a2515abdfefdb6dd7adf5eaa358314c21be69554fe922bb3915fb5f4b21d18f535137d385d229d3a8617adb750a1dc3343
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:4m7Rkm1tYpBeh2BAoj
TLSH
T1CEC3123B5D75F83759B5BB5EB08E0A1F1EF249A6C920DE92C8D85B0437E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d5e47b755286f6397673568efddaa73269fddddf53d3e8f1bcdda5b886a458aa
MD5 b467e38c7b41faad91e2a30f881a03e3
SHA1 e90c8e91397a62cbaf5a45b8cf91e54c486df3d5
SHA512 44e41a59ac2a4196c75de6fad1cacba3b48d79de11d0bf9f782c898f7f8f6410eec16bbe4164a4abda009aa431188bad470b8946cb27d44f1aab106c0ae79611
SSDEEP 3072:EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:nm7Rkm1tYpBeh2BAoj
TLSH
T165C3123B5D75F83759B5BB5EB08E0A1F1EF149A6C920DE92C8D85B0837E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c5b2268ea3dfa4def013b44e10deaf3a36fdf697106c43ec85183e9acbcd5770
MD5 d8e83c3184c017050cc4cabe07acb4d3
SHA1 e4a1b59dd5ae75e683e3b6f162872df323061565
SHA512 8d5da79c71059d0ff7701acf37bb4fd2dec2ad08f2d029eb605bd4e94b4395618bdb9ee2f88ed5944659049592b5aa34b60ef75209564f31a591587fd88dc004
SSDEEP 6144:XPKO8VY/v/3uukrVEQ0nEdm7Rkm1tYpBeh2BAod:fZ8VY/XznE09oBGcAod
TLSH
T13E3423375DA1983B1CA5371F70CE1A2D6DF1097AC2259DDBA4C9B70873DA6C50792E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 408af6211dda393605885ca606045c2a8df7f52668fbb7a80fb60bdb4a6aed02
MD5 50cbb906493abc87f709357be2bf3d65
SHA1 2c5e173f8cbb33a1c525dc13271bd07cc7a38c3c
SHA512 de12825564aca02d2eccbe9eb8c844a7ae2be4aad13435c8126e0c94e38ef454732573f6b65aa6459cef52da8c9af36107585e0d8b7dabfd98f922f109762773
SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:7m7Rkm1tYpBeh2BAoK
TLSH
T1C5C3123B5D75E83B9979A70EB08E0B1F1EF149A2C920DE92C8D86A0437E97CD0A04D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hydroxide-main_ROGUE.tar.gz.crdownload

Path C:\Users\Admin\Downloads\hydroxide-main_ROGUE.tar.gz.crdownload
Size 173KB
SHA256 a7aea59dc99687d7a4c918586b369942ed86a67b2d5ed2460af6cd31b7a51f07
MD5 e2bb996e3b5f46ea0a0b31214a273baf
SHA1 718ddfa81752bab88ea3567f88c68574ca391433
SHA512 0b000030b01865fcb38fdd10608a69656e5e601804cfcda69454d997b8baf6eb22294ac22ab64bdef3b9fbaffd6d9df1713cec9a34806fff7da4c381bb35443f
SSDEEP 3072:r2s8cvcgI8t8lW69d80oHvVM4fXLLGDL7ap0mQKgwwVnDHCce/USC5xitZGs05jY:Il8t846iVrfXymp7gw8DicecSExitZGI
TLSH
T18A04231D61D1AD7F980BCEFE0C9CB2BD82EC6057EE119EFEDD11A59EF1874A50600642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hydroxide-main_ROGUE.zip

Path C:\Users\Admin\Downloads\hydroxide-main_ROGUE.zip
Size 174KB
SHA256 e904d70df867185d2553b0c5b9d1b4a9ed431d7b2384ab1213d6e201beef4c87
MD5 2f2a0d9ef3b7bb150f0180e9ad57a97b
SHA1 67eca67e6336c4f76bf3e1de907fca609c7ffbc8
SHA512 285c1c60cdce516e06bb63aee7877da01a6795a7c4a1679224cb07737bcf93f1c606eb773813eade98b8c2a389e6b364c25113b842f55f823e16684b0b692410
SSDEEP 3072:N/o5M16NQwTsBGw8DY5naLLGDL7ap0mlHkP+dwjz42Co0Wa/GqmKGO3RkWp43:R+QwAR8wnaympDEmdwY270R/dmKGO3RM
TLSH
T1820423364043E7AB46071BA11C9C934591CF60E05A50129B34F5B8F3B9AF6BFBB18E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download