Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 17:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0qmww8k.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0qmww8k.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 0qmww8k.exe
- Size 145KB
- Sample260810-vl8bnsdn4x
- SHA256 3b7b1e2a9e2b401243e58c4c5342a55172e49796262f82db47ceb92c3554df3c
- MD5 7123d82db243ddad51e87aaa501640e5
- SHA1 a630d9554889637ec9b1238a72c0a8df8cbc5576
- SHA512 27b180a9a3d7da01ca90405479748534cfd36555e6de3dfe8bed30a6ea20e3bf54c4139d7ec75f402736c7259754373699845f79267714c19eb812995ee15ab2
- SSDEEP 3072:kf8BNytq6ZWsWG85KcXJr8LIhnYf0j6ATKI7Kp:kf8BD6Zp1zyOIhYfETo
- TLSH T1B8E35B57B2A530FDE077C135C8910A46E7B6B8760761ABDF03A4827A2F176E09D3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2324 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000a429b2003dae0d7f8d7ec7976332ff47fa4705008433d4a33ad6ca2a8737e3b1000000000e80000000020000200000000d248f7f68de7851e6bce3aaf3433affb3e4c3dc39cc62aacb935b0b2472caf42000000097a34ec0dd0e5bdc591c9e7a33f40e8b4152969410e072a67fb6a8e2ed40735640000000693dbbb9a11657dad8b379eff227fc8f745f85811939600ccb1915d0f1825a77e521a29ec5b0093ecf1c9652cb352686c91969811df61946ca2e87d6b8f801d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000289e0267d0f9a6715c4b0ce63bd7bed1b1a6c2ed84621eeba044e8aebc146d79000000000e800000000200002000000098bf66f2a6f56c52505e70f410da0c328082226921ec76f990150c47637f3d8a20000000dfa6e72e949576145126fb6f210e3783e817b5781f787cd0a198245b1312b3cf40000000c03f7b1150ee94ad137d8d89298b3ea8cd282dedb8757f41f70f55b29af5180d1bca3dba19de02182339fc54ba44818fa9d9b1fe75a907de2ab275666652dd12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fcf012f328dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b7f512f328dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2918121176" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D94EE261-94DD-11F1-9D43-F23C4AB2DE8F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271146" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308552956293053" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2404 0qmww8k.exe 2404 0qmww8k.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 5108 chrome.exe 5108 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1088 IEXPLORE.EXE - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2672 taskmgr.exe Token: SeSystemProfilePrivilege 2672 taskmgr.exe Token: SeCreateGlobalPrivilege 2672 taskmgr.exe Token: 33 2672 taskmgr.exe Token: SeIncBasePriorityPrivilege 2672 taskmgr.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1092 iexplore.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1092 iexplore.exe 1092 iexplore.exe 1088 IEXPLORE.EXE 1088 IEXPLORE.EXE 1088 IEXPLORE.EXE 1092 iexplore.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1088 1092 iexplore.exe 100 PID 5108 wrote to memory of 4112 5108 chrome.exe 109 PID 5108 wrote to memory of 2324 5108 chrome.exe 110 PID 5108 wrote to memory of 2204 5108 chrome.exe 111 PID 5108 wrote to memory of 2204 5108 chrome.exe 111 PID 5108 wrote to memory of 5000 5108 chrome.exe 113 PID 5108 wrote to memory of 5000 5108 chrome.exe 113 PID 5108 wrote to memory of 3292 5108 chrome.exe 114 PID 5108 wrote to memory of 2412 5108 chrome.exe 115 PID 5108 wrote to memory of 3292 5108 chrome.exe 114 PID 5108 wrote to memory of 2412 5108 chrome.exe 115 PID 5108 wrote to memory of 952 5108 chrome.exe 116 PID 5108 wrote to memory of 952 5108 chrome.exe 116 PID 5108 wrote to memory of 2132 5108 chrome.exe 118 PID 5108 wrote to memory of 2132 5108 chrome.exe 118 PID 5108 wrote to memory of 3444 5108 chrome.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\0qmww8k.exe"C:\Users\Admin\AppData\Local\Temp\0qmww8k.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2796
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb8a5fc728,0x7ffb8a5fc734,0x7ffb8a5fc7402⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14152638955332771566,8805655359323777926,524288 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:32⤵
- System Time Discovery
PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,11949411480065281723,7815194796950515781,262144 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,2899637883640835636,7617386153078713114,524288 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:82⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,9052484226534650805,570434247299257470,2097152 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,4522456647029112571,17184430585443808426,2097152 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,14247583489552094032,11413151214010810802,2097152 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:22⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3864,i,18376734863926213198,7607933421884387731,2097152 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3840 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,16654310297821247191,9149316638113108385,524288 --field-trial-handle=2176,i,611403729617101569,8204575345117487868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 a23df73fea36341f046778378b0a5c011303d597148ff00885f2741585936fd8
- MD5 b65c805be06555c2d97154e6515d2a5c
- SHA1 7d6cd40c0558d2f85ed27977d2ffbfecf1314435
- SHA512 414e67d980eee550b1890d7f01532e2688c22b5af116376ce89185765ac0f6f4e20ca55ca18cdfa3d3ed505f15e023bae9769541f675e187b1c27d4e0084317a
- TLSH T1FBE02BA5C922AC3B18FC172874A54705E75113172A409D1F373D540C4FB473A8686D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d76b0b8ed39f6066be6ddaf1c02c00c6a3a715325e1a453e2765b6a2891ccc98
- MD5 71edf67bf973b1a407fef1772b5edd63
- SHA1 36c47fb2f83c34e2f740067cae1fc4030a8f963f
- SHA512 2051a245b26257d653fb878e8202a95f08b4d91a50cee27e6907c30e048f099fd3e02a0d11e9133f581dd65f05a3a0694b4f2f261dbe424b94273d929c9c319b
- SSDEEP 192:yRyRvMmD9C+V0v7MF+pAPRp2S9HHsb+WNn/30lqWabazQVyIsnAUgtaJ:yRyRvBdwgoUX91wv0AWyaY8
- TLSH T12D42D62EEE11697B6CCBC229FD267B53D7F5102221D42E94EAFC892C15E76CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 d986404de59e18084f7f8ff87878dbfbade63cb3fa70c27a62ac3c6c33c822c5
- MD5 d2335714c22380bc5550e399d6693105
- SHA1 4a20a923e9f9d4eff7f0abb6836c570e4715b2d9
- SHA512 a5cfde4c95031c78c21a9e023b9f304f80ec3ffe6c06c8fdca5ab00152cf9feb754f42f597779b3a545c05d163efc0c0d820c72a57cb4e3bd7b9581120af759e
- SSDEEP 3072:/pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Im7Rkm1tYpBeh2BAoM
- TLSH T159C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86A0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 9779d9b3631c943fe81460958df3046f1c85dc82da099fc2ce290e285c3882cf
- MD5 6011d509c293b47bcd5b8a524c1493c3
- SHA1 9cbcbd809b23d8727fadda19f322679cda001229
- SHA512 8d562dc766e07fa1480cfd681d5f5b6de01f60f37edb9362586ccdad54d96e4a7913daab035097c403205e293726695d55824471e637de707de7ecf3d723d7ae
- SSDEEP 6144:/0Nhkw53G46j/7xsb7WeDKm7Rkm1tYpBeh2BAog:/gkI23LmWu9oBGcAog
- TLSH T12E341232AEBE8E73762C765AB48D172F1FF195A0C428D6D589DD4F0927CA3890D49B30
- MD5 SHA1 SHA512 SSDEEP TLSH