b2134519e3788b0bff839359de68a1a5a9d213e49401cfc452cfb1727d122f82

Analysis

user interaction
yes
max time kernel
900s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64-30dec764.exe
Size 11.9MB
Sample260816-2amn6aydla
SHA256 b2134519e3788b0bff839359de68a1a5a9d213e49401cfc452cfb1727d122f82
MD5 78d4f59e21db43bdb9c47f3324f715c6
SHA1 6a04eaa502227fafeb57a14fc28a4761209fa1e1
SHA512 38812ab17fd66028f1820513322d4c33d06fb2e0ed81a393e93e47b9f51feb47c9573892a6ce724f5a68768d4f8793fbbef1c1d24ded7db87f9204edc5be62e2
SSDEEP 98304:NRpZleByLCchV0HTDZTsq2FM4m8e58UnDnOLsyqi+E:HHcBcCcjN08eO6DnYR
TLSH
T134C65A17F96946E8C4ADD234C576A213BBB17C494B3123C72B50B7242F76BD0AEBA344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3484	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313925976558973"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 448	4312	chrome.exe	91
PID 4312 wrote to memory of 3484	4312	chrome.exe	92
PID 4312 wrote to memory of 3368	4312	chrome.exe	93
PID 4312 wrote to memory of 3368	4312	chrome.exe	93
PID 4312 wrote to memory of 2540	4312	chrome.exe	94
PID 4312 wrote to memory of 2540	4312	chrome.exe	94
PID 4312 wrote to memory of 4416	4312	chrome.exe	97
PID 4312 wrote to memory of 4416	4312	chrome.exe	97
PID 4312 wrote to memory of 3780	4312	chrome.exe	96
PID 4312 wrote to memory of 3780	4312	chrome.exe	96
PID 4312 wrote to memory of 4220	4312	chrome.exe	98
PID 4312 wrote to memory of 4220	4312	chrome.exe	98
PID 4312 wrote to memory of 1752	4312	chrome.exe	99
PID 4312 wrote to memory of 1752	4312	chrome.exe	99
PID 4312 wrote to memory of 1528	4312	chrome.exe	100
PID 4312 wrote to memory of 4548	4312	chrome.exe	110
PID 4312 wrote to memory of 4548	4312	chrome.exe	110
PID 4312 wrote to memory of 3008	4312	chrome.exe	111
PID 4312 wrote to memory of 3008	4312	chrome.exe	111
PID 4312 wrote to memory of 2024	4312	chrome.exe	112
PID 4312 wrote to memory of 3312	4312	chrome.exe	113
PID 4312 wrote to memory of 4196	4312	chrome.exe	114
PID 4312 wrote to memory of 3912	4312	chrome.exe	116
PID 4312 wrote to memory of 2944	4312	chrome.exe	117
PID 4312 wrote to memory of 2944	4312	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-30dec764.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-30dec764.exe"
1⤵
PID:4704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x324
1⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbe2e9c728,0x7ffbe2e9c734,0x7ffbe2e9c740
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,6205205105840911486,10734405661753471656,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,3214854939059413382,7974098701590101366,262144 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,7747261734124716797,9006169911658202355,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,12609770678963092975,5993686008431396829,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,13302352945507335211,557006955491320607,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,9510159180295011215,18276293752209517171,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,2405112466132346800,7116114398399556876,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,15748069375456406857,14061960482880140023,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5660,i,18169336479204767569,14789162537324666865,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5840,i,16925898086327270612,7240743121615258545,2097152 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,4904102338552084883,18070621140815427815,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,4420944449557333093,5187042835972157793,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3940,i,916384801783901245,11684947272180291335,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,8893368347645295946,6898684169094378969,262144 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,12011330989746451902,14806475221563196805,524288 --field-trial-handle=1824,i,3770368095911642644,14015748431035540038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:2944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0dbcffb537a27d65798dec23c8d916fad96058a9763e492099d4a6d3d45d3a2b
MD5 4f34d2a9709052fd87151863411bb906
SHA1 7fd30c04b3450558ac4d41d58fc2d40f21e40907
SHA512 56b55df1b240f16a538a9ca28883171a513ba48856cceb1cd6fa1e040e34e45d1b08e38b5a5291310bc1987cb33ba4f2573a94d38dd41be9eb194732968c8087
TLSH
T196E02BA9C961EC6714FD1719A0145746E754239B2B40894F7E3CD00C8FB56364985D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4165f40421f769d86875743fb619fe60d7dfef82569f504cd023e133034e650b
MD5 a1ac09871ed94e778075f293ef1dcda8
SHA1 6cb148723deef19cedd86d96ad5f475b037c4fd3
SHA512 632c0feb2c89df873298ee94cbaafb1492ea9cc1443d3cc326f6cffd366a0848b05a3abb6c5978f82c002832a7904e1fcab3d47d0cb047b96e1e1dfb1451d81c
TLSH
T133518BF7D3E499BD890156E4EB156E1FCD290A25132C3C62C8D4AE5B53F2872D21074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2f775dc3846630444120dc7ce137c4c1d029263b7b532eb0623b7c46411e5ba0
MD5 50873cbd4e055610a9c62f06f92e425f
SHA1 16128d0e40bc4bcbc88836e01703eb1458e64fe3
SHA512 4eca09531f009c26c628cc53e3564859d2348dc65853d6ffd0ea32cb2d3ee7f0a5f71eac587f66b720b8e2bcf6940efc3eec4a827be08e51345e532ca3943bb3
TLSH
T1BB518DF793E49AAD891152F4DB256E1FCD3D0A29122C3C62C9D4AE5B43F2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff275461cb2b44f6577beedc3f372915d51aa81c0d29b9f0c051cc5607be1f08
MD5 e6591d89c6fecc7b8235611b3ac39016
SHA1 ae6586559b0ffa6dc7ebee458a7ca724571348b0
SHA512 e2d2046bded33805f09dd814a09eb39e28c910b98d2f644ac6056c56c1341ccc569fe03e601a0a6a7821d21dfb2ef160bb8e226417ac1e48a07bdb1f4453781d
TLSH
T144618DF793E489BD891156F4EB256E2FDD3D0924132C3C6288D4AE5B93F2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b25c5d0b85392865846fc890f3c337698c217ab8ec882790232226a303a6971f
MD5 824888798c5b3d4d2bf8b7c744857f20
SHA1 20b96e693c45606acaf8530ab5b0d67cd8eedb43
SHA512 f1ff40fd3e6feeba1825a53d0e433993ec9edbc16ad435cc05fb4d6233e05227c2308e976f1e5bebae915e9eda5a8fce509285b370adc5b66cd7847ce2f588f9
TLSH
T18041A0F793E4997E890152F4EB156F1FCE2D0924131C3D66C8E4AE5B43E2872D11074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f6ea52e4e543b4f20f8607f23ef2bbc1579df6a5d71c61115691405b892ac711
MD5 00f0510dca1dddd22164bfe4479c2c3e
SHA1 cb9880c51884bc664be65ccfd9683309342114ea
SHA512 634aec01b0df95061fa765e8da5ea033337fb67814d70911a46ee7e2d1c0bcfb9f1b59903e410720078b5ca7020ab928e629535a0855c0b6e9cbc6a24e87ec74
TLSH
T173519DF793E489BD891156F4EB256E2FCD3D0924132C3C6288D4AE5B83F2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 a8daecd207b8f3c0ac817edff27ad5d574ce9353220ef0347b6ff9e5cec63267
MD5 c81373c732cbbfe0e6116459261a00b1
SHA1 bb2e363ef17eb469c6f61b4d5783a020433ba83a
SHA512 fb89dfa9c5e73ab289704f63218199af307517a73785ab3508ca2e3ffc0be54b34ce9cd53187a2d8955e8a8335e812437a1d4beba89f36edd7877be87164aa2c
TLSH
T123F0C9B7E6BE302750BA01FB0D017C0E14B2B831028268F0CE6A827EE0C90F30B13883
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f2572cc863ce4a362c606cf6648f9be524fe3e53e5109661ede09d6c290bd06
MD5 0af6deb4cdf22f58e0754ff0e1dff4b9
SHA1 b6d1ced2ac6b8cacc4bbfef800a8e6b7949fe543
SHA512 3f8711c3c38d5368cbe1038e179552e59ca5a452097f720caa4ac28394985f4c161b28300dde990c2a02a7b0a2147c39678302757d430ec6989b0dc3ab58cdf4
SSDEEP 192:dRsz6qJxF/h1v70IAPRp2dj9+Hsb+WNnXztUxRnamQVyIsnAUgraJ:dRszzxzFgJX68wjtsaZe
TLSH
T1FE42E92EAA54697BACDED229FD117B63D7F6202121951E44EBFCCA2C05E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bdfa7a5dba6ea19127d9fe1c84410ab10af0778bf3ee974acf23bb1efc4beb89
MD5 910c04044ed0770f19719f5a3fb795c9
SHA1 e497184ed94961f5ac9c4195156d937c2cfea1a8
SHA512 463e0b4d52e03bce583778e7aceba078cafdcbd5ab4c2b87e0b1265ec0793a461363bb81a2f7a1fa0756f221bcbb74d22026642660211db8c22883f7359df872
SSDEEP 192:dRsz6qJxF/h0v70IrUPRpgvdj9+Hsb+WNnXztZxRnamkVyIsnAUgraJ:dRszzxzwgGGXgx8wjtdaje
TLSH
T1C852E92EAA54697BACDAD329FD517B63D7F6203121941E44EBFCCA2C05E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aaeb2eb922deebcb87a0a13ddd2569ab7755ab434c5245b00819d6748c98c951
MD5 8e4228d459e5703330e31d01bdadeae6
SHA1 a9776b2b786dc07335c2e19e5632722c4297066b
SHA512 3c9a034e675f94a4afc44aeaee7f8cb8e66594a455dd1f90c1c50f561eafe024f7c6e72e23077cba79150190c3b80b60b210271c74ee6ca0d9a7430020153bcc
SSDEEP 192:dRsz6qJxF/4Fcv70hAPRp2dj9+Hsb+WNn/p10DxRnamXVyIsnAUgtaJ:dRszzxGFIg8X68wT0DaQ8
TLSH
T17742E92EAA54697BACDED22AFD117753D7F6202121952E44EBFCCA2C04E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c03269a156f0643bc6d7d9fa25ea954beb094c28ba0dbfcfeeefa76e8cba60f3
MD5 a233840abbe7dfc9fd8a92ac55f46070
SHA1 40dcb48aaf0973511e16468667cc881a8725b63a
SHA512 d76b0dc7dacd344e0ef89d57d94246c5ae8e3eacdb70b0d96dd26012e6720f8ba09b7421677474d5369f4603289ddc49cdfae8873e81942683ff976c92e37835
SSDEEP 192:dRszHqJxF/h0v70IrUPRpgvdj9+Hsb+WNnXztZxRnamkVyIsnAUgraJ:dRsz6xzwgGGXgx8wjtdaje
TLSH
T18452E92EAA54697BACDAD329FD517B63D7F6203121941E44EBFCCA2C05E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fb69a1898e947de2f80e509a662e479e1196202a79f7958140d06027c5a1e736
MD5 36deb7860c130e40eff2cb60d5a6b153
SHA1 60ddd6f0f826b5a856fba9c73633be02aec3ead5
SHA512 259be3f3acd42d88ddb76e8d06573d33857b8aec9e6281b21943ee25ef47be7ab0a7fd619147c618b227a25338b6f7f879480933cace9bda48751a9ffcffbfa9
TLSH
T1EEB01221C1419141C04207B01542249872199F129A0B170153E46E22C9652A18028060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d944.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d944.TMP
Size 96B
SHA256 0d47d30c14ecd97448153190dbf395a2eb941063870469f2b028845325cffd11
MD5 5ec42050029a999907e1f30fcd00ecb3
SHA1 95f4152b8bf28b46e83753ed8ab0585035fab8c3
SHA512 47a0ec56a59aeab6fa2485aacae3c581c419fe73d513cc32ac54ed0c0be83e2d3632e780fc74ea914bd730ab5846e671e7ae0c96247bd2eeed57089a557b55b1
TLSH
T1DDB00256D1067317C05203B0699696E871E0DF26C603521396E01AA6DC256F555A6165
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 481dc54401b023c6bc36d296cdaced0e32553fa99077c3352e5f2593229904e7
MD5 393560daa074f20f861c855984386fff
SHA1 a2e81c88f239eeb1ea56e2492a4957ab3a3b0f79
SHA512 8b183cc905619007c0c8f791b2feaada7fe68509c30a9ff35a3117eed44dae120b40aeaad7a8897513bfbabd654e109c3cd25f50dfa391d0d949f00db1d8b7f1
SSDEEP 6144:wu25N3BoXwUQlC0XQcLsUzI+/DqZ/ZLW3Exf:S5JrUKXcGb7qZ/piQf
TLSH
T12F3422739FD52F370DE78EA87D0207958FFA0097DC2CA7029A9527EB38D71849482C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 90029200f7f56d09e5771ebd9e5b43715a9052ae4fc1bf4152cf646a068a9c38
MD5 6985f01b20fe8d688253ba3a1da649d3
SHA1 0501c72f550647026e75f9b415650cf36dba93d1
SHA512 baf254b28c88b7bd4bb622bcd9bf4674803320898bc013907cfcc9f8f80b4e3f1a66d7d488d2484850adbced9b8767d57d49ab54d8a46b95b0983792f526c5a2
SSDEEP 6144:d25N3BoXwUQlC0XQcLsUzI+/DqZ/ZLW3Exf:A5JrUKXcGb7qZ/piQf
TLSH
T1E9342273DFD61F370CE78B687D0207D687FA0096986CE3029AD623EB78D75859482C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d8a5f23265a2fb1f1b2ff25d81acc02e6e62bf4bcb0998bd59ff67f26ba8eaee
MD5 ad721e2b5e05736283876d38f0fb9af2
SHA1 11cf55ed4b589db65950d43050cab234062461bd
SHA512 717317a623b27476ce64e94b7402a332aa8b5e26e9aca3936a0118cc34e8a877806410c8d79f51d384ac6bc2fa079d85c6e819449c81ddce602cf7c7298c8d4d
SSDEEP 1536:bgLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Mqfd7NtZL8cHQRZEQ6Sps3
TLSH
T129C30237ABC21F339D92CB64B9130FDA67B644A99034D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 fd7b12b10d1c58661332c74750f5942b4b70ac31b3463294363d39c204eed51c
MD5 d448d7e05f73bd10ce0f8374ffb7d535
SHA1 dcf02e666071b9406e6904f5982b666aea98baad
SHA512 fb127d7cef8fd980be6234e8e65969d35419b27d25c3303cc30b6008d92371cb0e8858b57e879381661d4a0a3cc1e81f7d3904eb7090f1ad0c2df62d32656243
SSDEEP 6144:Mu25N3BoXwUQlC0XQcLsUzI+/DqZ/ZLW3Exf:W5JrUKXcGb7qZ/piQf
TLSH
T1E53422739FD52F370DE78EA87D0207958FFA0097DC2CA7029A9527EB38D71859482C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 351beb4d0837a227f357ef35720d3d83cc938996602bdb83ecf89cbe4eeabdf1
MD5 ea8e787d319529cf317c9b47bf3dc1c3
SHA1 ce9d8cc345086e3e0d5cdc5b5b1a6e623231ebd2
SHA512 39d4ee436d9d438481f44a4972b0346b11d34d5d85fdbb402936753d063a560ab84428f43f4d2f8d0f096481694c4eeb4964dcb10a08c882c9a6feb32d0a5da1
SSDEEP 6144:s25N3BoXwUQlC0XQcLsUzI+/DqZ/ZLW3Exf:n5JrUKXcGb7qZ/piQf
TLSH
T110342273DFD61F370CE7CB687D02079697FA0096986CA3029AD623EB78D75859482C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download