870cc8b3b6d202cd2f278ba5a6c5cb2a840013638e2e85a0bf0b9ca8cd9e6bdf

Resubmissions

24/08/2026, 23:15

260824-28qtgazyet

24/08/2026, 23:11

260824-26g4jsdk4x3

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealUI_v8.59.174.exe
Size 90.2MB
Sample260824-26g4jsdk4x
SHA256 870cc8b3b6d202cd2f278ba5a6c5cb2a840013638e2e85a0bf0b9ca8cd9e6bdf
MD5 7bb91ba0233a475835e14e92e1b0a26b
SHA1 bd15db50b13075d31a4f9cbc06183447d7a3fa4b
SHA512 5899e35e05c2fc59708ced40b98b6d5464cb93df94ff15257edc3ebe2d00d4885f774c8ad0d3955ace66e06607c2329e120a1f0a302ca8b9b588f02871a71a29
SSDEEP 1572864:2XIDflGhShfb6I1pdmaOuAPi/joIEBWsj3UBW4VC6HQNpAIecQUHAkS9w2j:yIDQhSoQuaOuAPxl3e3c+QzdpjCpj
TLSH
T11228331E31E9813DC76881F1D26623F0B556F4642277616BFE0EFAAA8533C316B19E31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3196	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320867819276211"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{2591CCD5-AC06-4CCF-A6EA-1E8F9FD6DD38}	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2156	RealUI_v8.59.174.exe
2156	RealUI_v8.59.174.exe
2156	RealUI_v8.59.174.exe
2156	RealUI_v8.59.174.exe
2156	RealUI_v8.59.174.exe
2156	RealUI_v8.59.174.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe
Token: SeShutdownPrivilege	432	chrome.exe
Token: SeCreatePagefilePrivilege	432	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe
432	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 1516	432	chrome.exe	95
PID 432 wrote to memory of 3932	432	chrome.exe	96
PID 432 wrote to memory of 3932	432	chrome.exe	96
PID 432 wrote to memory of 3196	432	chrome.exe	97
PID 432 wrote to memory of 1944	432	chrome.exe	98
PID 432 wrote to memory of 1944	432	chrome.exe	98
PID 432 wrote to memory of 4328	432	chrome.exe	100
PID 432 wrote to memory of 4328	432	chrome.exe	100
PID 432 wrote to memory of 3760	432	chrome.exe	101
PID 432 wrote to memory of 3760	432	chrome.exe	101
PID 432 wrote to memory of 4124	432	chrome.exe	102
PID 432 wrote to memory of 4124	432	chrome.exe	102
PID 432 wrote to memory of 1108	432	chrome.exe	103
PID 432 wrote to memory of 1108	432	chrome.exe	103
PID 432 wrote to memory of 4900	432	chrome.exe	107
PID 432 wrote to memory of 2944	432	chrome.exe	124
PID 432 wrote to memory of 3496	432	chrome.exe	125
PID 432 wrote to memory of 2584	432	chrome.exe	126
PID 432 wrote to memory of 4520	432	chrome.exe	130
PID 432 wrote to memory of 4520	432	chrome.exe	130
PID 432 wrote to memory of 3972	432	chrome.exe	131
PID 432 wrote to memory of 3972	432	chrome.exe	131
PID 432 wrote to memory of 2840	432	chrome.exe	135
PID 432 wrote to memory of 2840	432	chrome.exe	135
PID 432 wrote to memory of 1896	432	chrome.exe	136
PID 432 wrote to memory of 4256	432	chrome.exe	137
PID 432 wrote to memory of 4256	432	chrome.exe	137
PID 432 wrote to memory of 2624	432	chrome.exe	138
PID 432 wrote to memory of 3020	432	chrome.exe	139
PID 432 wrote to memory of 3020	432	chrome.exe	139
PID 432 wrote to memory of 1168	432	chrome.exe	140
PID 432 wrote to memory of 1168	432	chrome.exe	140

C:\Users\Admin\AppData\Local\Temp\RealUI_v8.59.174.exe
"C:\Users\Admin\AppData\Local\Temp\RealUI_v8.59.174.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4d72c728,0x7fff4d72c734,0x7fff4d72c740
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1050731308575060026,2075962703972827730,262144 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,11578656755350319675,13408935330054498670,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,5960898692239077822,10405096244578908902,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,2926495064568936077,8480493780156818108,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,14714203024307383405,5925446774797042566,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,5600639508670749789,11198698320882590699,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,3936786785186076749,12120693458230901370,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,17789783446510799726,7742613985681019266,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,11570620378069100011,9052681028532224671,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,10931736868115784502,10017614863005671240,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,4620447712277735949,17601991249616408490,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5952,i,8512176299960854113,13992277708697319905,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3700,i,14458690756353311676,16308883725943959618,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3664,i,3701818969582846621,4492510320492237833,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4004,i,4570015715607130731,15011226072665002246,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,867465001522364204,7049410178411944566,524288 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4564,i,14391714075305726184,15538287637879840096,262144 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3544,i,11011889968023038860,18201746873861942800,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5836,i,16325001672287718327,14303575594087828296,2097152 --field-trial-handle=1916,i,10473932982378666884,44239240279020627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 741db7a93daa97643346e54a066934cada4d913c6e7bb0bb0664afdff28ef28c
MD5 78afd745877916c26d2bd2aacce7f7ab
SHA1 8ed345d0b8ff27b71408fd60ed1f7bf8b71df389
SHA512 b9a81a01ddb66ef3f202fbee4649e8377a93f69f47d33f09cf21abe04c905fa3555fa653fbb31e85ab927430086261136e1337f03bf702de776a70d2b8bb198d
TLSH
T14EE02BAACD21FC2B4CFD9B2D90940B46FEA013571B60955F373C811C8FB56A7018595C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 75af66d39940b7bde0e66f6c8b83c73e191d106d16873219780e5a2e1d4a71da
MD5 ef493ba5f53515ff68cc5f1388bc8dec
SHA1 0ff5ce70264cfcfc07ca20b9320d5952dfa2b57d
SHA512 de4bbb50ed0a78f7e71ec92310bbffd894e6e278e67024590a50741f455a4c931188101b41631cf3531655e37cd29049f4c944158b6553d8576c02f855136df4
TLSH
T115518BF7D7E4866D851196F49B247E1FCE2E0A28031C3C6688D4AF5B53E28B2D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0ba73ec19c4adbb89cb4903a4f34df8d83de221c298dc5250223cac87c237f6d
MD5 6f2cd59d2c387e08311e88c64bb06c50
SHA1 66b5dd5906eb05ca0e5314d10f744974e7ae11cb
SHA512 2980e41ea355f11cb2e47b6e5fd4f2c4eb34d0eacb331d1d59def680faeee8160276d1f67ae9ecaf99a527ab43bbf4cfd2b5dbc00dfe87074067ff0e72893e1e
SSDEEP 192:tRSUpXiYM8L2cv7AhAPRp2l9qHsb+WNnaSdEWFdTkwwauVyIsnAUgtaJ:tRSUkYQIk8XmkwndHdQam8
TLSH
T10B42D72EFE14793BDCDAC22AFA157B63D7F5202521942E84E6FC892C14E75CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ae75a6e9f8c78ab0dc777b0d2824b1c421bc03a91dfe3bb4f6b6697d653f34b3
MD5 e981f4b682619119ddce75a63f289657
SHA1 920978c2e8ab2440414b0504bf92b916af17a472
SHA512 be5ced097205be0112f4af06000aa1eebb72a944f8c6e3facc956c0379087abc2e51ee99d1628a539f561e3fec070c50c5f862ded2a69057ed266d68f9761cae
SSDEEP 192:tRSUpXiYM8Lqov7AI8PRpml9qHsb+WNnMAlrWFdTkwwaEVyIsnAUgraJ:tRSUkYQ0kpX2kwPlQdQaAe
TLSH
T16652E72EFD14797BECDAD22AFA117B63E7F5202525942E84E6FC892C14E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d92d4cd00ebbf1da755c3ed1cf69d68a20de0e4cf4c4f24d9a1948f8257e4e54
MD5 d6bbe0d9771f7a61a3567cc9ce7a0fa2
SHA1 9dc91384e7ce11ee8c92e4e5828ba9050ee13759
SHA512 8521a09ea636cd81f6b3dbbf0bfd62d4a010571bca2feeb7a7b2cf345ed22b60ae6537e12e44525a92a65deb977b17e008188da1b4e6987d7573c7338fd41610
SSDEEP 192:tRSUpXiYM8LhWv7AI8PRpml9qHsb+WNnMAlrWFdTkwwaEVyIsnAUgraJ:tRSUkYjikpX2kwPlQdQaAe
TLSH
T1E752E72EED14797BECDBD229FA117B63E7F5202525902E84E6FC892C14E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b8275bccea6b9ec7de69445285094d7f0a1d94e8e099cd8ed3e864ab0ee77187
MD5 bd568bf94cfad3643d1e83a7af6b94ee
SHA1 23b9d1ece9f9a648e610a2663fbdbf316a124f9a
SHA512 714436faebeadf5d694d0abeb6b110721f8c113cc3c36ff15d6c1281503bd69124592ef4d28fce5b891bfd4f2ce4d2c95e1079a1418b4d643db76c9dee99919e
SSDEEP 192:tRicBzUpXiYM8LWlv7AI8PRpmGo09qHsb+WNnMAzzB2IWFdTkwwaEVyIsnAUgraJ:tRimzUkYwVkpXBkwPB2rdQaAe
TLSH
T12452E62EF910797BECDAC22AFA157B63E7F5202525942E84E6FC892C14E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2cb5858bc44a41d4304fa6248f3a4a8ea3a8b45aefdb75f83cd016e83f22dcf3
MD5 371d6d58eea7f18f131dea5291a0eabd
SHA1 66b435840d1f037f059b9329d63401a65007e93a
SHA512 d783ec8edcf93999d89f8c30d96c61582acbb58888b07d6c8498bb29579ca63608734c3939aeb509627c89df0575ca0cedb5e996124733b2a1e066bdf089edbc
SSDEEP 192:tRicBhUpXiYM8Lwlv7DI8PRpmGu/9qHsb+WNnMAzKYYdWFdTkwwaE8yIsnAUgraJ:tRimhUkYmV3pXMkwPVY2dQaPe
TLSH
T12D52E62AF914397BACDAC22AFA117B63E7F1202524942E84E6FC892C14E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee42c721e40ab5c68604b683ecb48c711ff12594b94df36e7992e0d7bee86b14
MD5 0ddc43891960836c7f66e305f9d4b3db
SHA1 6d74433711d115a856f80c4fbaba715cc2222ba8
SHA512 49c16685f91cf5389bc5ade9818a858f0a4510e2ac883eb6f30eeb552776243b3ba0529f5d9ce7efb56604e6d592a3533f435d1c61425f7f6fc214dac414792c
SSDEEP 192:tRSUpXiYM8L2cv7AIAPRp2l9qHsb+WNnMAlLWFdTkwwaoVyIsnAUgraJ:tRSUkYQIkJXmkwPlwdQaMe
TLSH
T11042E82EFD14793BECDAD22AFA117B63E7F5202525942E84E6FC892C14E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f39f7140267be8be1bee04a8c2b46d9833b700a5784d457ab3a8633e447bc643
MD5 9579041549b965918228552424c0f6b0
SHA1 57035ab30545aec070bd4be2b69e90f57e6d9064
SHA512 922f86a31553141a1d476e8eb93571d350cc0874101ceb1d22ede0e27f0c673f1ee39f01f0e433c5338aec0a0d8eb1e766b0182f6204c8cc4ff1a7ba564b0590
TLSH
T1D7B0120080029143C04202B41652648C71D4DF20A60B270743E46933CC292618024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59772a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59772a.TMP
Size 96B
SHA256 1ac1799c78327ab1d460a67bb42570d88d6f4adf472267c3baf0bffe634a6289
MD5 cae30e4b519966ec3a6ca0cf3de211f2
SHA1 9ce068721d6992dcf92b4839167234f525d13734
SHA512 1f4c99b11a91f988987c677c9b943ed648589eb3be8bdae1059d37a053bb827460f2dc68b9e615e591c1123af907e7fb5ee38fe6a4bc7bf726ca08381e9d5e96
TLSH
T1D0B00295C1066223C14243F02AB5D5DA7160DFB5C6472623D2E09B6BED356B55529160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 44cd12c685bc7e3527ed90c93041ebcca75c38ab72462fb694ffe32ac9ca79f9
MD5 14937e181cbe25792a74e3337b56c691
SHA1 6645e6c9e3f962d761e44fad20fda4560b84b868
SHA512 df7d3e96e01fa84c8b033e36780afcfcb0d629cbd07a126d24e9bea947e66f0b699341102ecec4df30ac9f6a4852de019d97e2cc5bffb45efdd39790e0bb56aa
TLSH
T12CB002583A406963CB05C3F01CC9C5457332BD35A2C387B6B0AC919E8812E9DF392890
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 e6fb41f1fc718e7c97bdf599e20baec46ccb6b91bd9e47f7a1259acc6703e82d
MD5 ae54f2bd506722a2db9417abb5dd7a53
SHA1 710128f54983f0d94751f3239f208430ec7f480b
SHA512 e8fdc81d93e90d75ffb8b2ef2ee1f612c8373227c6ef7f0a52b56c2429d4c301d49c93c303b64703eb2370de5d8db093c58758966d48f5d87f01635a1a543367
SSDEEP 6144:wgYlzzBxCkIkxy/sWm7Rkm1tYpBeh2BAoE:ClzWa5h9oBGcAoE
TLSH
T1313412277EB5AC3694BD6F0EF18E2F7F16F255968534D626C5C8AA0027A83DC190AC70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 cd32e2efbd821cad8eb28f361c13a0163c78f019953415f1e57355258bc796dd
MD5 7cd2be500cff8dadf22b950feb11e937
SHA1 d297a8362780a1126d7bf10637ce3b4cc2162d3d
SHA512 8be065443632f2023bf40aa925cd4fed877deae1d0abd4603e4d0fe115cd5f570b9a1de0e29aee116fd49898db9b656c732a8a66db0ac81b438bac254a79a919
SSDEEP 6144:gkgYlzzBxCkIkxy/sWm7Rkm1tYpBeh2BAoE:zlzWa5h9oBGcAoE
TLSH
T1B53412377EB5AC3198BD6F0EE14E2E7F19F29696C534DA15C5C8AE0027AD2981D0AC70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 8ab44f5d4437a9ec8823341893c4f6ddc3c9181c4c337bc3fc7b868a4283c52e
MD5 e5e42b766ead155cd7018b01e8ca17d9
SHA1 9084d8dcf116d25c7e2ccee9e1103202f3a31e70
SHA512 e05f2dfdef7c7f9ea6a2a96ddb907b12822e5c546073d3781fe7d16031b506aa8a2aa02f3807303ef4ef13103eb0395ca81cd85b8a19fe6f17dd8aa5cfdfe02b
SSDEEP 6144:fgYlzzBxCkIkxy/sWm7Rkm1tYpBeh2BAoE:blzWa5h9oBGcAoE
TLSH
T1ED3412277EB5AC3694BD6F0EF18E2F7F15F245968538D626C5C8AE0027A83DC190AC70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c72fb41c2dcbe37296be73245e12276ce133d6744b4230917cbf7265538d5ad9
MD5 5ca3a0086acc621855560702dcedb2aa
SHA1 8a701a71a85583d3c34fd19afe4d9c391cd4a7b0
SHA512 e7d82d4595bca625f8b1b102395caafbf38b9a6421b961ec061ee1707cd4ca30b159c53627ff38047d6f1c86aa8a25063a04050cb4ef497d225435cfcea081b3
SSDEEP 3072:AUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Em7Rkm1tYpBeh2BAog
TLSH
T188C3023B5D75EC3B9CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2156-0-0x0000016ECF750000-0x0000016ECF9E3000-memory.dmp

Download

memory/2156-8-0x00007FF720930000-0x00007FF720D73000-memory.dmp

Download

memory/2156-7-0x0000016ECF750000-0x0000016ECF9E3000-memory.dmp

Download

memory/2156-4-0x0000016ECF750000-0x0000016ECF9E3000-memory.dmp

Download