99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094

Analysis

user interaction
yes
max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample
Size 18B
Sample260808-hadlpsbj2s
SHA256 99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094
MD5 53af239ee5d3e261545dededcb6ffd57
SHA1 04ca7e137e1e9feead96a7df45bb67d5ab3de190
SHA512 c734e4a5ff5d335a91518dbf47861bdaf8012af49371dcd2e3350e269c9a5a1cc094114d17c4f5b053f3757b4b07487ebd0d309c91ef97acf4665cc5d5c9a2d3
MD5 SHA1 SHA512

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3800	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1992	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306443490493990"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1848	4072	chrome.exe	91
PID 4072 wrote to memory of 1992	4072	chrome.exe	92
PID 4072 wrote to memory of 4972	4072	chrome.exe	93
PID 4072 wrote to memory of 4972	4072	chrome.exe	93
PID 4072 wrote to memory of 3212	4072	chrome.exe	94
PID 4072 wrote to memory of 3212	4072	chrome.exe	94
PID 4072 wrote to memory of 2812	4072	chrome.exe	96
PID 4072 wrote to memory of 716	4072	chrome.exe	97
PID 4072 wrote to memory of 2812	4072	chrome.exe	96
PID 4072 wrote to memory of 716	4072	chrome.exe	97
PID 4072 wrote to memory of 3840	4072	chrome.exe	98
PID 4072 wrote to memory of 3840	4072	chrome.exe	98
PID 4072 wrote to memory of 4456	4072	chrome.exe	99
PID 4072 wrote to memory of 1320	4072	chrome.exe	106
PID 4072 wrote to memory of 1320	4072	chrome.exe	106
PID 4072 wrote to memory of 3504	4072	chrome.exe	110
PID 4072 wrote to memory of 4112	4072	chrome.exe	111
PID 4072 wrote to memory of 4320	4072	chrome.exe	112
PID 4072 wrote to memory of 4500	4072	chrome.exe	114
PID 4072 wrote to memory of 4500	4072	chrome.exe	114
PID 4072 wrote to memory of 1892	4072	chrome.exe	117
PID 4072 wrote to memory of 1892	4072	chrome.exe	117
PID 4072 wrote to memory of 3684	4072	chrome.exe	123
PID 4072 wrote to memory of 3684	4072	chrome.exe	123
PID 4072 wrote to memory of 2408	4072	chrome.exe	124
PID 4072 wrote to memory of 2408	4072	chrome.exe	124
PID 4072 wrote to memory of 320	4072	chrome.exe	125
PID 4072 wrote to memory of 320	4072	chrome.exe	125
PID 4072 wrote to memory of 1852	4072	chrome.exe	126
PID 4072 wrote to memory of 1852	4072	chrome.exe	126
PID 4072 wrote to memory of 3968	4072	chrome.exe	127
PID 4072 wrote to memory of 3968	4072	chrome.exe	127
PID 4072 wrote to memory of 3996	4072	chrome.exe	128
PID 4072 wrote to memory of 3996	4072	chrome.exe	128
PID 4072 wrote to memory of 1724	4072	chrome.exe	129
PID 4072 wrote to memory of 1724	4072	chrome.exe	129
PID 4072 wrote to memory of 404	4072	chrome.exe	133

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
- Executes a command shell one-liner
PID:3800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeb5d0c728,0x7ffeb5d0c734,0x7ffeb5d0c740
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,6872220007512045805,15876188616660080828,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,18173789880808840478,5861262003440304885,262144 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,8432958402246601956,17790526007923034420,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,13203833829623055980,3738768158563344256,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,13323215267867297131,7937141623597080095,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,1324455673573740392,6320907374156783166,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,5716257958490449782,6304884729492344583,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,1498054068525478406,17373574243055114529,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,6031286198842798046,3230849199773337128,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,8575034975749667073,4032731098253439449,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6646352159244876569,1848111505621077585,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=240,i,9733307409540087480,18154235305598807354,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4568,i,11252625068070482568,14059559737850045646,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,2315010539945587690,6903964886822673835,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,10527965226851555485,3186665791637505238,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,11104845502303829730,8911151315482030078,524288 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3920,i,12965071966776178871,8096839179386393261,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4544,i,2342238448181366493,2568259477683034894,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5788,i,13473576742829462571,5747207370244909277,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4572,i,3289061942105983477,13965864707126807108,2097152 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6004,i,13133656507144140560,17300768441130822633,262144 --field-trial-handle=2132,i,4092027686543184895,769114672426277826,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 13305b3b6dfbe8fcd2bfb739a2d14daa91b6cb6ea99ecfcffee56439fab3006d
MD5 268462bf7474f8634a7b1666f4b3272e
SHA1 b2b0747c317e92136c5a62d91e6bee057d59dbe7
SHA512 ba862bcf15e06ffc71f3656d8667e63aa824b50daf7958683582a3aff371ba0252af530bedf3a910e682b9ca2bd4caf9e98a1ff20c5e63eff6441932963a8dbc
TLSH
T18AE02BFACDA1EC2B19FF172960614745F61013AB2A42594F7A3D950C8FF1A3A564581C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 754b869af22f6743f97b5c2c0be7f90b22fb53379b3d522ecfe4f88362b650e4
MD5 43cb6ea6fd48b35a53f106bb7a794d00
SHA1 05b063720af6568e75d49d0622374e70f02087d6
SHA512 4ac63272b68c15ca71d000091497e0bbcf6ac655a10534d7fc0b7c2c2ba365f6f67f9265f28f75d98ea07f05193f56974014c759bb583c031494c6ba5ed04485
TLSH
T145518BB3D3D4857D851156F49A21AE1FCD6E0A18122D3C22C9D4AE1B57E2872D21139F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b1d0d168639d5f9d93c9f2f939221d8010c5a02f3078ca040af0e6f804289e5
MD5 2bdf5cc211cd7b525abfbe1cb7ee5f98
SHA1 ca476295553de1037a21eef197dcca049a5f3b8a
SHA512 3ff046cbd110b49a880fa4670041586eeb135f0061336a38a3d18dc2bf5e2f40725600d545a8d44aa152e7bb3e450b5c5c85a040e2a8c462e8a6dce1351bb2eb
SSDEEP 192:WRwSHgyv72HJPRp5/A9THsb+WNnrBnhk+72pkG1mkwklpSVyIsnAUgE:WRwSAeChXOFwzp2OG1m9E
TLSH
T14D42D76EAD10297B9DDBD21AF9617B27E7F6103165D12F44EAFC892C25E35CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c595813178942a7d6b86f61366eeec338cbc797264f0bbd298b2a60dbb391b51
MD5 f56da8d4ffda892c31c885bf042bd899
SHA1 5df98296909a66df9f1c5cd745b143639e650156
SHA512 c8815f957088c1b41f5c2697598fcd0f4aa6b0a62d0dd7fbbb5cf7a196c1a451880b382a4da74183044fe4229596be90e35922138b136eb801a9a72f87bf0caf
SSDEEP 192:WRwSHYdv72HAPRp299THsb+WNnrBnhdhGkG1mkwklpHVyIsnAUge:WRwS4dCCXuFwzd9G1mAe
TLSH
T1FF32D52EAD10297B5DDBD22AF9617B27E7F6103175D52E84EAFC892C14E75CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81bd830f67c9f12795e85805b03dc1593df4717e69fc773de551b25257b39cc5
MD5 0dfd1f4d8c6dcd92bf9e8b4dbdc3d3db
SHA1 4c202d3950f81d5eaf171f754f07a37b289a0e69
SHA512 a5242f00aa1593f9851128a7c11dcee33eb9fa142af5d6332644c22476831b2e0b2738919cb0fb6797833af980245d056f200cfe462b70e7d420330bde793638
SSDEEP 192:WRwSH0yv72HJPRp5/H9THsb+WNnrBnhkzkWkkG1mkwklpSVyIsnAUgE:WRwSUeChXZFwzBWtG1m9E
TLSH
T19A42D76EAD10297B9DDBD21AF9527B67E7F6103165D12E44EAFC892C25E35CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9c22c44e66aa553e3f84b3a2a54735e148da4b8e5e30634c4668b5bc1d1a8b38
MD5 465c7d99f2ddbf9a5ed06af022cc4eda
SHA1 33501fa91fe33ecbe6933f3650c82b0d76723f94
SHA512 3c86145308b68391c4b4444c89e265b871dfa4eb2896740e6a28e75ff84e077c4f85012f44082bb4eb74a4641f74130a5d0a74b4ff2a9692c75e6f16b62622ba
SSDEEP 192:WRwSHgDv72HJPRp599THsb+WNnrBnhdhQkG1mkwklpSVyIsnAUgE:WRwSA7ChXfFwzdvG1m9E
TLSH
T12542D62EAD10297B9DDBD61AF9617B67E7F5103165D12F84EAFC892C15E35CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4551afcc8af7a191a5e21eb5267140ac50f85a87f4571b8ffa005a63b12da524
MD5 407f939a574d5e4ca10aa9626387ae04
SHA1 5f5db80059af2e15150fb24ee55c5e73d7e894ad
SHA512 640d305276fa3c25d0f626999e50ab9df578f592ef0c0f5a32acb9b49751789536daab7dd96befbd1d57762ea8450d473801b30bfda62761f0ebcf226c979b44
SSDEEP 192:WRwSHYmv72HAPRp299THsb+WNnrBnhdhskG1mkwklpUVyIsnAUgE:WRwS4SCCXuFwzd/G1mZE
TLSH
T11042C52EAD10297B9DDBD21AF9617B27E7F6103175D52E84EAFC892C15E35CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d4160a2e90c75990e89f6fff9903d7d2640f3bab7f8acd8b635f1d8ce9c3be2f
MD5 e9fc1631b42f9b40183b6c130c16665c
SHA1 60ec3d8a55c2beee73cb6af0833f33ad57011863
SHA512 6aabd647b0acfcf9f1703e094ac74f3a8ce6136998cc44dc45179fe5db2b91b01e9fdf6f631d721e846f9bd0c103afc133df8570fc046c4cbe690cc709e55846
TLSH
T1B3B0121180200033E58083F09050286263391C401502031A34AF5C73AD3A59C970120C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d06.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a5d06.TMP
Size 72B
SHA256 1db72bb53571592bf2d872b819af17146611cb63e46a021ddf5871659772dac4
MD5 ec5aabb5aef3a6d6e0ead08afb509064
SHA1 2215223d548e34b6817e1fa7a66cc1f1fa91c593
SHA512 5dc2ac0ee02b12687b3a0728ecb8ddcf81c9bb5d893022b143d4f6e83bc50b9aaeca2887792d137b856313ce59c280f0b5b7f9b43ad8e81800821c3b071e5cd1
TLSH
T121A002619345A211D7058376E1B1528137E2885879960793449184A99DADA845716602
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ba1ba220d9bddb478c08ce1c33cd717afc03d1b787bef87340c5899fc4ab279b
MD5 be1b3642143186bbac5bdda41bd1927e
SHA1 ca92b710d3d3680074483c8cc3ef0a4f8e53a0af
SHA512 ded66b556f9bae441fec555865dc64ad056ab1a3eda639b087031e72d8b7a8d43436336c3de5bab888a8e103560af8ab15e175f4267cfe3530c034a4219a86a1
SSDEEP 6144:qmPKO8VY/v/3uukrVEQ0nEum7Rkm1tYpBeh2BAoX:zZ8VY/XznEp9oBGcAoX
TLSH
T1CE3422375DB1943B1CA5372F70CE0A2E6EF1097AC22599D7A4C5BB0873DA6D90B92D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ecaad692d7417a34d95059227d63eeddf963dd5f71e9d292b0dd2220bc0f36e5
MD5 651afefd8510c4979393fa6c096f1300
SHA1 51db1eb9b2f467930bc257a68feed093569d5278
SHA512 9d5a459cc09b542bcaedf06faee22733e413e32fd1fb58f44bb61a7388a78df575308d290c99ae9d32ab9406841ba8f884b21110e925aa22a39b96d43f394cf6
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Hm7Rkm1tYpBeh2BAom
TLSH
T194C3123B5E70E9775979AB4EB08E0B1F1EF14AA2D930DA82C8D85A0437F97CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 3f68be6539427fbea0808590d8d6cd2288a1d71b24faa2363f0b18d74ecb1f4a
MD5 20e349c1f460324182baf6dfba032ced
SHA1 28210e5cba2fedbbc0dec2b2c3ae27c0dc26d36d
SHA512 27dbfff8b7102fbc2465b1e0dbf81e913105570f7614e2297cddd12fb491bbd546aae427aafffd9800f80ec75c57df3fe1b3fadfddb6ee920aa8722b789d2e85
SSDEEP 6144:LzTNvihPKO8VY/v/3uukrVEQ0nEum7Rkm1tYpBeh2BAoX:f4Z8VY/XznEp9oBGcAoX
TLSH
T1EC5422735D7AC53A1CB8661AB0CE072D5DF16A63C129D987B4C9AB0873DD2C50FAAD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 627a19200de63118b0f54da3eb0e6c6544ab12c24557125e567383df2be2e20d
MD5 d44152506f3bfcdb29c11871b489eb0c
SHA1 3330411ff4e121441f4bfe8a2bdb16978f97974e
SHA512 e51fc1ec5c448512b69f05f46a6d1d15e7b7f2a999cd9bef7b2d6f9702d7f8391acdb0d49761f8a1ace130d759c7c95ae8a0a6ccd7ec49523d67868ec08c0d68
SSDEEP 6144:NmPKO8VY/v/3uukrVEQ0nEum7Rkm1tYpBeh2BAoX:IZ8VY/XznEp9oBGcAoX
TLSH
T1013422375DB1943B1CA5372F70CE0A2E5EF1097AC2259AD7A4C5BB0873DA6D90B92D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74e395cb-7dc5-4bd2-9767-94a374160a70.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4072_155012712\74e395cb-7dc5-4bd2-9767-94a374160a70.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4072_155012712\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download