6b516be9159bf42beab5e6a8da801c09459239b58984aaf820548ba0ec13a333

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lumen.exe
Size 14.7MB
Sample260809-y6wp6avgjf
SHA256 6b516be9159bf42beab5e6a8da801c09459239b58984aaf820548ba0ec13a333
MD5 13752a54ce1b0bf59d17ce50010e4f91
SHA1 d5c693664196c5b3276d382dcb2a6003ab71eafb
SHA512 30bfafde5295515c975393a00c7051cfeb50b4d4a5bd387302e8502234f3da64a34c933ef2896df5cecf39a1086bcfc5f6efae55e6c25434e2d976f7c2cdfd4a
SSDEEP 196608:qODm8w8XF+LJ/+ti9TSa1nkEGo//4adjF5U5RgGKCPudT33uyf3chWv:zmkF+Lt+U9TSa1nkEGq/4dNKkkuA3e
TLSH
T14EF6CF9974FC00EDEC22D0B8C6559263FB717C580330A6DB6AA489B62F379E51E7B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3804	Lumen.exe
3804	Lumen.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307807192060871"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{0B6CE034-79C5-43C0-87BB-B9673528723E}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe
3804	Lumen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe
Token: SeShutdownPrivilege	1464	chrome.exe
Token: SeCreatePagefilePrivilege	1464	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe
1464	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3720	1464	chrome.exe	91
PID 1464 wrote to memory of 4284	1464	chrome.exe	92
PID 1464 wrote to memory of 5000	1464	chrome.exe	93
PID 1464 wrote to memory of 5000	1464	chrome.exe	93
PID 1464 wrote to memory of 4556	1464	chrome.exe	94
PID 1464 wrote to memory of 4556	1464	chrome.exe	94
PID 1464 wrote to memory of 1196	1464	chrome.exe	96
PID 1464 wrote to memory of 1952	1464	chrome.exe	97
PID 1464 wrote to memory of 1196	1464	chrome.exe	96
PID 1464 wrote to memory of 1952	1464	chrome.exe	97
PID 1464 wrote to memory of 1756	1464	chrome.exe	98
PID 1464 wrote to memory of 1756	1464	chrome.exe	98
PID 1464 wrote to memory of 3156	1464	chrome.exe	99
PID 1464 wrote to memory of 3156	1464	chrome.exe	99
PID 1464 wrote to memory of 2964	1464	chrome.exe	100
PID 1464 wrote to memory of 2964	1464	chrome.exe	100
PID 1464 wrote to memory of 1604	1464	chrome.exe	101
PID 1464 wrote to memory of 1604	1464	chrome.exe	101
PID 1464 wrote to memory of 3372	1464	chrome.exe	104
PID 1464 wrote to memory of 5116	1464	chrome.exe	105
PID 1464 wrote to memory of 3372	1464	chrome.exe	104
PID 1464 wrote to memory of 2652	1464	chrome.exe	106
PID 1464 wrote to memory of 964	1464	chrome.exe	107
PID 1464 wrote to memory of 2932	1464	chrome.exe	108
PID 1464 wrote to memory of 2408	1464	chrome.exe	109
PID 1464 wrote to memory of 4540	1464	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\Lumen.exe
"C:\Users\Admin\AppData\Local\Temp\Lumen.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffbf52c728,0x7fffbf52c734,0x7fffbf52c740
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,10325587671884121959,1684923041509946005,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,17130954457124183753,269681717040470474,262144 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,10733363681126041087,8578581083471179878,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4763417671104284511,17993392860969210579,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,28099554438209765,8570107454798000204,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,5718517786200930236,8690381742792541592,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,17282644011558285377,2792285284569664404,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4900,i,4764710805489677761,10758719207138002702,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4772,i,8186021918816172569,13218667364257017422,2097152 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,10635540179083859893,17407294652996969984,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,7077272522519121392,4218847261790071697,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,10152028250841142427,2642762316481731160,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,8766439705822165373,2733291630770281050,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,14109070847358907271,4236229814958870160,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,12640344045081484242,17776780909285591234,524288 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3524,i,3860969004847605820,15668744954259204451,262144 --field-trial-handle=2120,i,4692911005655598566,2134105700840826558,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1148 /prefetch:8
  2⤵
  PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0f2b1bfa56cc79496b12972da67a208dec30a32370f3d18b3c638f7cef41898f
MD5 2cb8f7ce10359e8a1318ed80369bbb1c
SHA1 783eb895a28898797dffb855225b662e6c047e38
SHA512 7dc907f1a2aaa8cf055344cb39ead59a5e33fed0e61d2ff8c3e09cd1622eb2360cd01310824d443eb827ec88a1aa42ba2b4b182a0850b72a5366ff6420441cab
TLSH
T175E02BA6CD21EC772EFD075810924709FB6533162A80991F3A3CD21C8FB162A8186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 79e96d5dd4c0cec052cf9174a38bcc38ff1d3842b83d2c183eeb0be795596d52
MD5 82dabf3d03b85b3c105f40450701c894
SHA1 91f220f72c53e9c9da2e5b6307b893f0aa477637
SHA512 f62f00b4d4977db33b9fd8e292fdddcc999d47cf4d7f3ee204ad3d722fd327a99f0200f2956eaf025f52f644c965a813d2d1adea191fcd39fe4b1b2ca02d5013
TLSH
T17F511E16DDE0F010CF6863B40DE3DCB2EA26E577018BEB5B9A437D2160A3AFC114664E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9e2192fadcb66dc1f143fe183937019336cd919cfa5871540e66c5f1dafa64e3
MD5 6f26017de82bf3ad04d510a57d25efea
SHA1 9283dc1b4ffbd09adfe920efd7877792cbb67b79
SHA512 4c8fad95459da6467fbb4966c2b0185e33855640086d5529b1e62ce6d355808c32db9385f5998629da4620bcaae07b5a150468168d082a49e80477b8a9332b18
SSDEEP 96:D7Or9IfDaILDsdW7G4Hxqg8KjQH9fOLjhbQhTaC:D7Or9IfDaILDAW7G4Hxqg8KjQH9fOLji
TLSH
T163C1ACF383E4CA7D891156F4AB156E2BCE590924032C3C66C9E4BE5B93E3572E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ee1046892758aabc841b32589bc0aec361a009ba84c8e20391c58074fc267e1
MD5 475d2f662e023709898164f78ac59af6
SHA1 16b2d60df47943b160d9e03d01d3c197c9a21e14
SHA512 cb3506cf2e83f1f03bbf600c4a7cb80c217a02e85d6744edb09db74e0f16175ffbfdcaa2854fb8e4c169816fdaa18833760edaf4cdf53afb7db026deeaa6573a
TLSH
T178416BF3C7D8897D894156F4AB156E1FCE690E14536C3C5AC8D8AE4F53E28B2D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d26743855d103e390fd38c7ca1deb646e92a1f09983289ae60f93327a2c8228d
MD5 bb67dfb44bb731ed838b842e75563f47
SHA1 993d516f2e6ffdbdf140dffad7e6b0a60a60c823
SHA512 3faee9dd6a13d4283f015f32269e19df4a0605c3cfdd1ee5ba0ea6ca03d5ec40933fcd69b1d58bbe6569659692b4c5962f2308c01680263694dc146b25d08871
TLSH
T1FA416BF3C7D8897D894156F4AB15AE1FCE690E14536C3C5AC8D8AE4F53E28B2D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 73d81c78ebebb4253de6daa12f82a5696603bcc83f735f3427d03e8ced068a0a
MD5 b6553e1f1c6ead642d8a5aebc6f7ebc0
SHA1 5f7dc7a45967b5776ac129f17b304f806babdf99
SHA512 24f5fd1797fcc72cd781800657de9f6a05b1e1ed83c29e1a54b1b089e537a23b0d5013df07b2517ce9dddeb077d8717c6e686f6dc2647f6dfbba08061be14417
SSDEEP 192:8RVjypLtj8fYomv7+pAPRpVlP95Hsb+WNnOdtBWem/Ba7ku/8yIsnAUgcaJ:8RtmJoSiUX/rwQGeoaZE5
TLSH
T1BE52092EB910797B9CDAD229FD637717D7F6143121901E84EAFC892C18EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79054fc39473ece8f5bbf5b087eae733693f2a254790fa42d7fab1f910a49e36
MD5 b7f20952644d64e69b42adfb4c2a1691
SHA1 9712ad4e16d7ab63442416ee96fa1f4ae8b7dd3e
SHA512 7e8cb3a6a98500c565c93d122edc086c7206cac1d9cec74cabad3d1da7c9ef7438327a1c0ce3a5ff144500d14cd76577ae6c5366522456919d77818322453eda
SSDEEP 192:8RVcypLtj8fYomv7hpAPRp2lP95Hsb+WNnOdtrI2n/Ba7kD/VyIsnAUge:8RGmJoS9UXUrwQq2JagZe
TLSH
T1DC42F82EB910797B9CDAD229FD627717D7F6147121942E84EBFC892C18E76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f4ca907ac219a1b4de389814985fda40f94c1db29d226ebc78adaa4e1556e18f
MD5 66befbc5599c61fba021b3cc343a0efc
SHA1 d63f1f37678487730b2834794642da3be5e36da5
SHA512 2955e559c6f16bc2e4659c2d0074fcb3f1a9cbdcf4948ec8692c8208aac37509df59d460655732004052199dd25ff788f362a32ba450103a5eab3cf4ef67f0d7
SSDEEP 192:8RVjypLcj8fY3mv7+pi2PRpYdlP95Hsb+WNnOdtrUg//Ba7kC/8yIsnAUgcaJ:8Rtmc3SigoXY3rwQCgxaTE5
TLSH
T12452F81EB811797B9CDAD22DF9637B17D7F6143121901E84EAFC892C19EB6CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e83a00661966d8bd8e0ef6df67ba87a0b4167d7cda2113f0c9e7c276081035b9
MD5 844cd883a22cb5fe104a7013fb8f5c74
SHA1 a96fd5e9c165d412485b7d4fde0b4a64f54a1d89
SHA512 fea902742b1172526f13b0700d188a3eb7e09ad2f1aac0b0dfbebee80a9b5107b59e6e4595fe3794746c61c6cf0a08317e312b11747edf0e2c60bde56dde9981
SSDEEP 192:8RVjypLcj8fYHmv7+pAPRpVlP95Hsb+WNnOdtBWem/Ba7ku/8yIsnAUgcaJ:8RtmcHSiUX/rwQGeoaZE5
TLSH
T14F520A2EB910797B9CDAD219FD637717D7F6143121941E84EAFC896C18EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 572861aa64e0ed03dccc67cfab24e6bec386e7ef5a5828d6d5c0befffb13e517
MD5 9d26d711ad2a8cc485e2039ed00cb962
SHA1 eea4d17b3c144ac4a203dc912c81458f8c9c8f6e
SHA512 d05f564d06d3d22804e0bf713a50d040b23dbdcbfe8cf21cd65a70c98e1dd7562134fa1961519f46fd88574b52d770c22174324f4980496f8cf8858e8974277e
SSDEEP 192:8RVjypLcj8fY41mv7+pi2PRpYdlP95Hsb+WNnOdtoJEI/Ba7kC/8yIsnAUgcaJ:8Rtmc41SigoXY3rwQiEWaTE5
TLSH
T1C052F91EB811797B9CD6D219F9637B17D7F6143125901E84EAFC892C19EB6CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5ffc1fa276ef8a5197f43a1c86d32c884aed0755667118d6886137e23a4b03bc
MD5 cf9d0b6c94ec64f5755274b4bbbaa91c
SHA1 8af49ef9b95b23038644b5522456ff617f7a68a1
SHA512 1b1bcb5f6002ab6cea500f7ecbd1ba096752c70e18efdc1036d9dac6e360750449df6b6704524c1c39f24995c2074d8695b6e3c254d5ae88a784e73935b76546
TLSH
T164B0121180016201C44203B02982148C71159F20960A170353E47922E8652B1C024090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d82b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d82b.TMP
Size 96B
SHA256 fccf77f533a4efa2143ed83f0b90ebbd896330960635c728b8871992471ca521
MD5 304ed2aedebb5b455a9748f43d78fca8
SHA1 f3f61030ca901dfeea03f77da5d7034073c81dd2
SHA512 ab2309e51028abaaf7976de8f15ce8c69d0c3a0a2253148bb3cbbbd210ea3eefd50cc4db511dd899ea35fa45124e23c9eb8a84b0c37e0464cf887a71cf6b348d
TLSH
T173B02202C203E223C80E03B03880B0C83030EF32C2030203A2F00E23EC302300A202A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 17eec1a80755674f1c3cbc36a7ee84f6470c7b43e570272a9a57350c6488c1e6
MD5 a5ee0f7b8de8890929e33a0732ca9994
SHA1 0d74b20f61f6c82abcb6bc304288679bedff59b3
SHA512 735a9b976da984e8d517e127f64cab7afdd14696e3bbe6173ad7be3b2f209afc476b44818e7b1b6335de1140b7cde2957ed6df52371f735d739a5b8739e74cb3
SSDEEP 1536:7SmD1yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bIC3:7VD7qfd7NtZL8cHQRZEQ6SpsY
TLSH
T13EC30237EBC21E335DD2CB70B9130FD7A7B544A99034D301ABBD2BBB689345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6bfdfca11d048951adf2637cdebd8f30187df5efc016f6372f3d460b7d0e90b1
MD5 3182e91135b0df17d6cfc04ef8f8970b
SHA1 98f849461988bd14c2738319393b26c7062d109a
SHA512 90e630a21b55b8d83891f21896279b02f9a2a0ca933b0b269fa4ba5eb4260739b047fc1535bde3f131c0bc0082691a968aa91fb116470cb5a1c84a3c36eeb368
SSDEEP 1536:7tmD1yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bIC3:7wD7qfd7NtZL8cHQRZEQ6SpsY
TLSH
T161C30237EBC21E335DD2CB70B9130FD7A7B544AA9034D301ABBD2BBB688345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3761bc5cc62756827c7e6c44d7b4af105ef4399fe60f0087543149b29478c62d
MD5 358f997eb0b2c610cde945af56443994
SHA1 b1402201c0d803bc649a8396ca9bd4b63cdfcf79
SHA512 358552b99675e86d7e8d27f502bd07c448f1eec7cd5566ae70fcafc9c456603756e8c92ee2afe09049fe6c3bc8cc9d839db0dd61f67e4ea0d878087a2d7aa63e
SSDEEP 1536:6byD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Qqfd7NtZL8cHQRZEQ6Sps9
TLSH
T169C30237EBC21E335D82CB647A534FDAA7B644A99030D301AABD3BFB6C53451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 322b7cc122bcf19f25f2719217c2d85d7468950f4a7794d04549a6dd038a8e56
MD5 7bfa8e2b9876f5fd26b2b154eb8fdbd9
SHA1 747859b28ff84277d721cb5b2d71680a19c83001
SHA512 6086c2790aaa76e559a2e4abf3bea44d2a9cde972b972916bf7510aea541df851aa3ec9adce84a0a8642c63d98c3bdc2f7817a63ee4d250a1ba43f2a6aa80f04
SSDEEP 6144:7wayX4NwhgqKR4ILo59R57lOYo8KqZ/ZLW3ExR:7w9oNweqYhLw/7lgqZ/piQR
TLSH
T1B53412B2EBA31F755CA6DFF830111FE58FF290DD91B8E201DAA53BAB340A454960587C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3804-4-0x00000185876C0000-0x00000185876C2000-memory.dmp

Download