a7479c3a4c702f2225a2ed343a8222bb36031f34474bf38d9a61f1a759fe3bf1

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Among.exe
Size 369KB
Sample260817-vs2sgawsfw
SHA256 a7479c3a4c702f2225a2ed343a8222bb36031f34474bf38d9a61f1a759fe3bf1
MD5 11fb8b77762947e113f6db67347b8633
SHA1 492288437caa9a0b2863880dfe927c8f8a5f8432
SHA512 802f2a6c226617eb58417e86149249bfa3d44aeee45284e6a5ad512f6e2ba3dc2c8c286ec48a87264fe3e7fcf30da41b8bca05c480a2d2a13fef30347c5e4f18
SSDEEP 6144:wjup8zxJneuxnCfqu9RhthXwwDc8XTbbGJDRkz3eKl0nnuU1EC2mmpAiuE6ZHGDf:Mup8jnCfRnHn8E6ZHGlIq
TLSH
T1A6847C9A664089E7DC21C73891C6A720E8F7BC825F73824BD9A2BE65CF771833D35548
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
872	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1676	4408	chrome.exe	93
PID 4408 wrote to memory of 872	4408	chrome.exe	95
PID 4408 wrote to memory of 2264	4408	chrome.exe	96
PID 4408 wrote to memory of 2264	4408	chrome.exe	96
PID 4408 wrote to memory of 1872	4408	chrome.exe	97
PID 4408 wrote to memory of 1872	4408	chrome.exe	97
PID 4408 wrote to memory of 3868	4408	chrome.exe	98
PID 4408 wrote to memory of 3868	4408	chrome.exe	98
PID 4408 wrote to memory of 1492	4408	chrome.exe	99
PID 4408 wrote to memory of 1492	4408	chrome.exe	99
PID 4408 wrote to memory of 2284	4408	chrome.exe	100
PID 4408 wrote to memory of 2284	4408	chrome.exe	100
PID 4408 wrote to memory of 852	4408	chrome.exe	103
PID 4408 wrote to memory of 852	4408	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\Among.exe
"C:\Users\Admin\AppData\Local\Temp\Among.exe"
1⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbbf70c728,0x7ffbbf70c734,0x7ffbbf70c740
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,17504658564804451041,2640602356187042516,524288 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,2200224395069639219,1543783649473917014,262144 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,6862609637029535993,12762181362672413510,524288 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11519722486239971375,4380614443710368080,2097152 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,7040772061876407530,6343355638637533052,2097152 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,17680227942580584387,7057235094058814792,2097152 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,10084056539782046859,602740895112643507,2097152 --field-trial-handle=2024,i,12103817772683391908,16047704888954881754,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 060b3f2b2b1edefc6e3de14039bef6355672f38b57d6c9097efe6b795f710be1
MD5 31a9c203a5a85a3e08f115a3d51f3197
SHA1 a9b1148bcfbfc9d79afffb0982a316e173a3b998
SHA512 9ab085360ead6aea3ac8830d2141bf2205007ca211dc8a79ab55b14da9ae537b9ab6d40d891dbc22e744551e599b72db2b87b95eb031121478796f72832d6821
TLSH
T11E3178FB53B4997E8A00D2E4EA156F1FCE690520131C78A689D46E2B83F29B2D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 610c453cb46b8353bb9cafe9a134827cc7ca90a9ea11e4546b69c06694bf5d0d
MD5 ed165a58851f985588eac1d3ba37aca8
SHA1 d26f02e3673d3f20f1dfa65d2e545475d0096354
SHA512 e7e57c8196d72481a26444b357f623acc38f028f3b6c832ab8c382e92a2dad397f9263e9b7bcf5d916bee80b4cc3d5b0b2cbdd47db056d212899aae2ef896414
TLSH
T1B1F059A7A26DB06350B949FB1E00BC0E65BAB83002816CE4DFAEC1BCE0995F30B12057
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 19fb90567fe3636f1fc1c5ab28da2d0b2b4467291f9fed708f892c7f00fd1395
MD5 f1d45517cbcdfd4c41eff688e28a0309
SHA1 b4106a7c6e63e93fd267c154fa205a40a95a675a
SHA512 e8664bf069d71ff5a955eef269d5dd6f8f344d92ba593b0dbb3b5b70dcb7e68f4927db7b9885cb45ddd0b5cd8b9f22c33bf585a57427b26ccfc223f73ff669f4
TLSH
T162B0124080029181C04201F4190318D87208DF50D909270543F46D229C290A18014052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5899da.TMP
Size 96B
SHA256 a01927a61ce8d3c36feb8d3c3dac697a8be5a8a57f9289f02ba1ab82a118d0e7
MD5 1bed4b84388680d3abbc74fcd35027a1
SHA1 7bd331a1c8fa4aa86874b71c2f8eb0835287b2e4
SHA512 e8232a60fa18ef5551eefbd9dcda5818ff2a7fe53561122ba2af726187644916642e3458e746f956dcc6f54a6adb1786fbb8aa463603e8316b5c28c28f47fbdc
TLSH
T1C5B02280C2C2A382C20303B0308082C83030CF20C303E20382F00E33CC2E3B208300A0
MD5 SHA1 SHA512 TLSH

Submit Download

c4d45ed0-dade-43fa-ac79-58c504cac4f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c4d45ed0-dade-43fa-ac79-58c504cac4f9.tmp
Size 11KB
SHA256 2dc5b8ae25f92431dba7a8be99e51d59afc99adbc1706d0fbf78a95dd020f69a
MD5 8fc7a2d1a9fdc7ac560b0eafa8e635b3
SHA1 32e0194e98300685741736240ee2b9234b467b10
SHA512 f4d39c151dc030cc982dd82d235fc43685fd7452f8ff5afef86725881895fc58a76d2da4c394eeba89b8abb0a3910bbe8785672236026cdc9ceec929877caf45
SSDEEP 192:6R8D/I5RjyDBWv7MF+pAPRp2S9HHsb+WNn9a0ZhPyIsnAUge:6R8DERwBigoUX91wM0De
TLSH
T16E32A51EAD15697B6CCBD22DFA267B53E7F5102125C12E44EAFCCA2C15E7ACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2247446ba37067ec9890d2d41d6ac229dbc512b10e1ce15b2f678fff60c9bbe1
MD5 1c779991fa6af7919e5c33f63d9ea9a3
SHA1 bfac43b357d64e6b14941d1aa86999a29c8e6e2d
SHA512 253f5a7feceb93af05692a7c7926c3f282c7202908bd6921fb53e40a1abd6a7e157aa7cd1751b059b9633952cfe8226c9fcb7eef8d88e468fe30d1d24cdba747
SSDEEP 3072:/hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/wm7Rkm1tYpBeh2BAoM
TLSH
T180C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 96300fcd8f8b8f5b1c7dd95005332290382da40c7fa838d472a96e6c1fa4689e
MD5 bff99d5b260fb6bdfbe424bfa68e9639
SHA1 7108754d1b11ef1b58ec35404885c8b0e50bfccf
SHA512 a9229c59717abb3d5119afc8e12c05ce87e79542c70a4deb9d7a3f3292d836a5156388700a776fb65a83be7b7e6d6fc1afb447dabe0c34a4042f0f4d09e5c1ca
SSDEEP 3072:pIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:pjm7Rkm1tYpBeh2BAox
TLSH
T1D3C312275D75AC3758B9BB5EB04E0B1F1EF14A66D820DA92C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download