hxxp://www[.]mediafire[.]com/file/g9d53e2wv62nfkg/brawhalla_upd[.]zip/file

Analysis

max time kernel
900s
max time network
893s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.mediafire.com/file/g9d53e2wv62nfkg/brawhalla_upd.zip/file
Sample260809-as16qaga73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4368	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307089979734219"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1280	2376	chrome.exe	81
PID 2376 wrote to memory of 3724	2376	chrome.exe	82
PID 2376 wrote to memory of 3724	2376	chrome.exe	82
PID 2376 wrote to memory of 4368	2376	chrome.exe	83
PID 2376 wrote to memory of 3368	2376	chrome.exe	87
PID 2376 wrote to memory of 3368	2376	chrome.exe	87
PID 2376 wrote to memory of 4112	2376	chrome.exe	85
PID 2376 wrote to memory of 4112	2376	chrome.exe	85
PID 2376 wrote to memory of 3236	2376	chrome.exe	86
PID 2376 wrote to memory of 3236	2376	chrome.exe	86
PID 2376 wrote to memory of 4876	2376	chrome.exe	88
PID 2376 wrote to memory of 4876	2376	chrome.exe	88
PID 2376 wrote to memory of 3136	2376	chrome.exe	90
PID 2376 wrote to memory of 3136	2376	chrome.exe	90
PID 2376 wrote to memory of 3964	2376	chrome.exe	91
PID 2376 wrote to memory of 3964	2376	chrome.exe	91
PID 2376 wrote to memory of 1684	2376	chrome.exe	92
PID 2376 wrote to memory of 1684	2376	chrome.exe	92
PID 2376 wrote to memory of 3892	2376	chrome.exe	93
PID 2376 wrote to memory of 3892	2376	chrome.exe	93
PID 2376 wrote to memory of 1556	2376	chrome.exe	94
PID 2376 wrote to memory of 2180	2376	chrome.exe	95
PID 2376 wrote to memory of 4300	2376	chrome.exe	96
PID 2376 wrote to memory of 5036	2376	chrome.exe	97
PID 2376 wrote to memory of 5036	2376	chrome.exe	97
PID 2376 wrote to memory of 1776	2376	chrome.exe	98
PID 2376 wrote to memory of 3784	2376	chrome.exe	100
PID 2376 wrote to memory of 3196	2376	chrome.exe	101
PID 2376 wrote to memory of 3196	2376	chrome.exe	101

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.mediafire.com/file/g9d53e2wv62nfkg/brawhalla_upd.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd18fdc728,0x7ffd18fdc734,0x7ffd18fdc740
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,14799644233610363621,4761061910779592279,262144 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,14123159207023142286,7675198539459977450,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,6732205037200035711,17130186470887479553,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2696 /prefetch:13
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,14680659575098407569,4806654393501468473,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,11970042827710605589,2791170171885322381,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,5950406102632905823,16310103647083521072,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3908,i,11067384905844340617,12617396793433372776,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3300,i,15108411249825280433,7057207853980036088,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3248,i,1032820108430229081,15048857744430773909,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5080,i,2400136543421480892,10001198922702901378,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,4903636199601980185,6799975509497867055,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,9463137369857360966,9909460695793542005,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,10713848528571065955,10182774700303168310,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4324,i,1690385742389985808,3160755596761515501,2097152 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,13181523496821989403,11016395115291074049,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5684,i,7430982788575080954,9072841030881424231,262144 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3160,i,9984871757751006499,8149895296668086610,524288 --field-trial-handle=2028,i,16933099647853912923,7042589908412355561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:14
  2⤵
  PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8b97ac5ce5d5dd30f99a61c6c0ab16bcb9619aaea412d524215bd3b383ea204e
MD5 8ea65b8c9db60cd75cd25a11ad70bfe6
SHA1 aeec6f80d4943d80853d992b01fafb1679f8108b
SHA512 99057e13a99c979751e702270fab996fb444a7504672ce7ad5eb6ce912d893dd609cbece74e81880737d02b276a292a5b1d54d4594cacdd635640db8b6174f56
TLSH
T1CEE022AAD926EC3B08FD3B6960508747E79013272680591F3A3CA21C8FB263B458795C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 d8ed163ac07c7c20cac1e026a3565af784c505d4c1d5649a43ad819e4c03bb90
MD5 633fe5dcf3af5dcfa070eb61746d9e41
SHA1 03690c5263b14aeff59cd812721d837243d4cfa7
SHA512 1549100bab2d2a5f1529e36efd4a512e7f6d064f4317780c22479298d0de3e463696fab7a4b1159840b8080196aedbdcf2c722dcf6b0bb16bd6b80c6b8ef7740
TLSH
T16911223294D6B082CF10227361EBDD027536424BD453AF2BE3736C3C6A9BB9AD011CB9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 991198de98ad7d3d4ec1d0992f7832bfcc7e2b05e597fc54c1ca93d189633f0f
MD5 fdf63b9a510c34f506c5d9906b70fc97
SHA1 677efd663ee598f3daf3ed5f91eedcc2b8ddfaea
SHA512 5ecb1ae1ab6a4bb8d82a883ebb296e3eeb2623bf0ac865d9466ee0673704d16c54e9c9b2bf80dc05c7de272cc808dc5b68a5d589166e155ac68898df6784d18a
SSDEEP 192:DVuc12bRee+u7aIaEdGhXyKYEA4bwYgrY+FvrKH8VAuQ6JrH4IfwSZffO+NRHb:DVuc12bRee+u7aIaEdGhXyKYEA4bwYg9
TLSH
T1EB2289F383E5D62E89115BF896106E1BCE1C0619832C3C26C8D5EE5BE3E3472E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 fb7ea37ecdc56586cc11d1d7d23b502336aeccba8f7ba048c41ea9feff4ffc49
MD5 38b08d9f864eff4137566ee7746c0e40
SHA1 197f2ddbe00ca8d5b4f0594d3d1e14bcaa58f239
SHA512 88ba70662fa80f5944528b4ac1aa13831048e6d6db0b93e0f3a4c6dce3ab2def5bf7a976238cdb04f298e368df44ac0e5d234a45654a11fe52eadf5c18ac4652
SSDEEP 192:DYdl04tf4egX/baIaEdGhXyKYEkwYgrY+a9xKHmVAuQhJrH4IfmSVfO+hrjhnsHb:DYdl04tf4egX/baIaEdGhXyKYEkwYgr6
TLSH
T1901299F783E5D56E89005BF89610AE1BCF1C0629432C3C6688D5AE5BE3A3473E16D64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6c1b6aa45aec41749b1158bb3e12a37e5cf8dde0114ad60ba458cf2bf4e1ec15
MD5 fdd5950f1fb43956d1c92dc7e1a318e3
SHA1 dca3faec61224b29d90c90543bb4130a20efecf1
SHA512 4f385606be0e90e7683c54db0377efaf7f9d873afcc7d95c5039fe0bea21a828729c324455b495374ca158074bbfa72242b31b0ca3046883b96aa50da768bb69
SSDEEP 192:DYdl04tf4egXwhaIaEdGhXyKYEkwYgrY+a9xKHmVAuQhJrH4IfmSVfO+hrjhSLHb:DYdl04tf4egXwhaIaEdGhXyKYEkwYgr0
TLSH
T1D71299F783E5D52E89005BF89610AE1BCF1C0629432C3C6688D4EE5BE3E3472E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 38e5619cedc312cffd0e37390dec68e1b4cbd3fb5b9d3edbc3400d1e1a051e76
MD5 395646f99b282593e4994238f5b17102
SHA1 1442861db82f995c5c2f14761434e8cdf5918071
SHA512 6c97a9b4dd1afc504295ea364356d7541d2639fe7451a2d5ac420934c6d3a18cfe1be1aaae3b95da6abb2abd52a72b650763962c526f1ba2d27d1339b81146da
SSDEEP 192:DVuc12bRee+GaIaEdGhXyKYEA4bwYgrY+FvrKH8VAuQ6JrH4IfwSTbffO+NUb:DVuc12bRee+GaIaEdGhXyKYEA4bwYgrG
TLSH
T1E7228AF383E5D62E89115BF896106E1BCE1C0619832C3C26C8D5EE5BE3E3472E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 11a7c98f9281c155dccbc9cf00eeedbf2e3f8f2dab79092f0b5918227148e13f
MD5 6805fad3ad5c1a3a3862e83370acab1a
SHA1 c75bb689002adfc5eeb4244e55ca4d6cf6ef91b3
SHA512 bb19c1df49912884f132cdcf2ce96a7ab1d5bf8df48e397b6195b5b3fd11eb92641a86c6c705049e8e81a8a83252ced205e472332011be8e1f527b834cea6552
SSDEEP 192:DVuc12bRee+uHhaIaEdGhXyKYEA4bwYgrY+FvrKH8VAuQ6JrH4IfwSZffO+Nrjhn:DVuc12bRee+uHhaIaEdGhXyKYEA4bwYS
TLSH
T188328AF383E5D62E89115BF8A6106E1BCE1C0619832C3C26C8D5EE5BE3E3472E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 852B
SHA256 72ec8b41266dadd8c6d13cc4c750472331de34eafd2ecb1c4b2db5efc0505fe2
MD5 5ec1f26d0fa494eccdabfff6a62a42a1
SHA1 f32ddbb0368a4b511e1580988cf8596e4a0fbe12
SHA512 f92a3599953e6343a9dec0f4e395343d0cbff70325accfa1a351eba659a0c8807397c1c73e264a19bda0b6467760a57164cbfa70e1f805fa4be09b6aa921466f
TLSH
T1350148EBD67EB46B116E09AA1F847C0518BEA83112806CF8CF56826CF0C54F31B1286B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 51ee88fc62adc4b6075036e2cf9faa7fb391257b76e607accb9f95e574015197
MD5 ef0ccb4d977e411d5485d629bd894c6f
SHA1 e2680889759927b29bfaee0246904ca0efd067bc
SHA512 46c133ddad85c84e2e6560459553b1351337ce5ced47ab55ec5002159becf4ba81d990297e30eb149341f8e4b0c95e0ad4e6a2b7b5ea5779aa4b3e4414950c36
SSDEEP 192:pRHv5LoqehHgdv75pkPRpxTR98Hsb+WNn83IoUw2t1P2/RJKkw7EVyIsnAUgE:pRHv5e4VMXXuw5Y2H2/RJKsE
TLSH
T14052C62AFD10697B5CDAD229F9157B67D7F6102225E01E84E6FC8A2C25E79CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3869f3368045b82246cfc7c14973dfec731793e889618a66b8253fcc1fa0771
MD5 198f42ab120f16af4d63090d4d77aca6
SHA1 b8ab9a6c9d150461a0b6d16df76e73927d1b1262
SHA512 b109501fecf69e5c62121de1b8f7f2b257e9570fd0b9d228084079b1107478d6fe5f03d6643a318611b03eb11abeee84c25b4ba0b73545069d366f823f2de944
SSDEEP 192:pRHvrLoqehHgdv75pAPRp2TR98Hsb+WNn83IoUw2iP2/RJKkw7tVyIsnAUge:pRHvLe4VUXSuw5Y2Y2/RJKne
TLSH
T10442C52EFE10697B5CDBD229F9257767D7F6102225E01E84EAFC8A2C15E79CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 985397e85b6d800b89dcc92e417aefa018e30ba890693e70452a1bcec5500160
MD5 79c7c3b16ae95de17beeba1bff17343f
SHA1 b64f5a10cd86690137e3c724d3a740d109eb2590
SHA512 d6d955b64e724f90f0207d9467d90ee5a4aa7de96416c37e31330901ce8f07026cbbfa49ac7e84a7a3160045d1a442a128ed6b3b97edda63472f3aa19abfc262
TLSH
T116B01280C4029602C00702F41242189871189F10A70A170243F0AA26A82D150801D860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a3ec.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a3ec.TMP
Size 96B
SHA256 154a311c42e48b93ee0852ca1f61e40791c99f380d06de489bbf8a26aa715e34
MD5 75306668fbc08d812a5da23b1c0fa9af
SHA1 43ebb44ab3c283100d58cfa7ebde709492337e43
SHA512 a82da770c71c190878e402c416b6104a75db59d362030c0fff290ad0720f6b25b81bc1d8e2b95ec65675e150c4ecb96c0bbd724503e1d1a80489757266e537b3
TLSH
T1A9B02200C2822203C00303B03E828EC8B020EF30C203CE2383F02B2AEC202208C28020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 d5462e261228b16fe29bbaf709f0e351f7f4972662faaf999940f68f842d2f2f
MD5 f638029b6634a305715328ac6151e63a
SHA1 db990c5fa9e621dbe6d5c6352e51ccd4e9432e38
SHA512 4fe6a6cc32fa75c728372fd01eb838e714a82a2b3d18628a3fd61ab634c76d6d46e657be8db276fbad078bccf59e8385774ae7a4f7dfea044a11c6561015dfd9
SSDEEP 3072:NRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:NAm7Rkm1tYpBeh2BAoF
TLSH
T15EC3123B5D74A8775DB5BB5EB04E0E1F1DF149A7CD20EE92C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4a618c4aaa32ee6b66e37e663bc94bf08b390816a972051d8b1da00167d95cda
MD5 1a0163071c5f8bc59d8b88a8b3c499a3
SHA1 a8e9a9cb40e6e98f14bb9b7aa4d670d65ebbcc76
SHA512 84a45cb7f53a8d9b7fb45d5ad51097370de2d20ca9f15d9504628ba7b5005ffd90e85fa467100512562220d81480dce9dd23b47cf4ce515905e70ddb9fb5a244
SSDEEP 3072:QiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:QVm7Rkm1tYpBeh2BAoF
TLSH
T191C312375DB4A87759B9BB5EB04E0B1F1EF149A3CD20DE92C8D89A0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5d3aa1d8b1854b9a58e40ad28608460d92bc39a9ad7b090f004b93fe673fac2f
MD5 f0f8f986d983364d8a38eb693552cb03
SHA1 75e9826ab81899bd7e3c9d6127452e56c9478dbd
SHA512 6347b14e5c7c022191c826523a332396809985f748a6732d38c7e06588b622fde72b3d82d6a3a442b995cb8996aec721e5c4bd1fc35327d3fc61488dab0a44c7
SSDEEP 3072:HiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:HVm7Rkm1tYpBeh2BAoF
TLSH
T18AC312375DB4A87759B9BB5EB04E0B1F1EF149A3CD20DE92C8D89A0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9419d19ca2cbd0eb7011e7577aa672082854914599a7778f2d8659c965bcf00e
MD5 f206e308ca2c58f75deb7164d57f957c
SHA1 b7c5a8434ddeb6898418a99717adf37b7525bece
SHA512 d1d230a8f5774f60064572c4b1579afff05332082cd6459e3be1f89a25456d00ff446f335761cc04ccfa20eba096e0c4f915134c09dda6c402042055b600acf8
SSDEEP 3072:JRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:JAm7Rkm1tYpBeh2BAoF
TLSH
T159C3023B5D74A87749B9BB5EB04E0A1F1DF149A7DD20EE91C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c40cf2b5cee8f1e010ee4014b023447eda07638ba35b9b90a6fb6dbba08e1963
MD5 e1cc7bc0cbf3c08e658fbcec59887eb1
SHA1 201a484d46446e1abde7f23b37aeff876dcd8fd6
SHA512 78dbcf34652623963706179b5d2e847ef42936ea12e75c95d6eb9bb4eb337756c3c7ac51c34412a28a805c977f559bc078280eb00574725fe89c70d27f407f8b
SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:9m7Rkm1tYpBeh2BAoF
TLSH
T1A7C3123B5D70A97759B9BB4EB08E0B1E1EF149A6CD30DE92C8D85A0477FA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download