08ba45846078b464a29708de06520988c963a8d68d297986dea5121fb3c7d9b2

Analysis

user interaction
yes
max time kernel
333s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
645CF4D0-A08C-40FE-96F8-9BC45BECD9D7.png
Size 2.2MB
Sample260826-e29lnsbf52
SHA256 08ba45846078b464a29708de06520988c963a8d68d297986dea5121fb3c7d9b2
MD5 deeab971554dddf4264c70e0c26d3302
SHA1 8d7fa94f1d2f185e56bb14d38b5b316c3ec62e93
SHA512 b3c99a3ba8acf53d24fd8f0d027694bb5b1b6d1862912471a0cc3e0e9e56d1984388806ebdd556f304050b5212391bd0401dd8f2742e4dda75907f47290391d8
SSDEEP 49152:/fUuxmf3EKQkhetI5yZT2YVob9TFnGHxyYo4RnnptfO5BFWwXp:/Ngf3EXkhsICT7G9IHk6nptYFWYp
TLSH
T1FDB5336E14940343D46E7B3540A12E145A42E3B3EEEDBAC68A8BD676F2FC3B17610F54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	WyvernLoader.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	WyvernLoader.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	1812	chrome.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	WyvernLoader.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	WyvernLoader.exe

Executes dropped EXE 1 IoCs

pid	Process
5908	WyvernLoader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5908	WyvernLoader.exe
5908	WyvernLoader.exe
5908	WyvernLoader.exe
5908	WyvernLoader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1812	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WyvernLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	WyvernLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	WyvernLoader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WyvernLoader.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321920606925227"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3792	mspaint.exe
3792	mspaint.exe
4716	chrome.exe
4716	chrome.exe
5908	WyvernLoader.exe
5908	WyvernLoader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5908	WyvernLoader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3792	mspaint.exe
3792	mspaint.exe
3792	mspaint.exe
3792	mspaint.exe
5908	WyvernLoader.exe
5908	WyvernLoader.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3816	4716	chrome.exe	90
PID 4716 wrote to memory of 1812	4716	chrome.exe	92
PID 4716 wrote to memory of 2192	4716	chrome.exe	93
PID 4716 wrote to memory of 2192	4716	chrome.exe	93
PID 4716 wrote to memory of 3336	4716	chrome.exe	94
PID 4716 wrote to memory of 3336	4716	chrome.exe	94
PID 4716 wrote to memory of 2488	4716	chrome.exe	96
PID 4716 wrote to memory of 884	4716	chrome.exe	95
PID 4716 wrote to memory of 2488	4716	chrome.exe	96
PID 4716 wrote to memory of 884	4716	chrome.exe	95
PID 4716 wrote to memory of 772	4716	chrome.exe	97
PID 4716 wrote to memory of 772	4716	chrome.exe	97
PID 4716 wrote to memory of 872	4716	chrome.exe	98
PID 4716 wrote to memory of 872	4716	chrome.exe	98
PID 4716 wrote to memory of 4180	4716	chrome.exe	103
PID 4716 wrote to memory of 3852	4716	chrome.exe	113
PID 4716 wrote to memory of 3852	4716	chrome.exe	113
PID 4716 wrote to memory of 4460	4716	chrome.exe	114
PID 4716 wrote to memory of 4460	4716	chrome.exe	114
PID 4716 wrote to memory of 2240	4716	chrome.exe	115
PID 4716 wrote to memory of 2240	4716	chrome.exe	115
PID 4716 wrote to memory of 4720	4716	chrome.exe	116
PID 4716 wrote to memory of 4720	4716	chrome.exe	116
PID 4716 wrote to memory of 5756	4716	chrome.exe	123
PID 4716 wrote to memory of 5764	4716	chrome.exe	124
PID 4716 wrote to memory of 5772	4716	chrome.exe	125
PID 4716 wrote to memory of 5928	4716	chrome.exe	126

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\645CF4D0-A08C-40FE-96F8-9BC45BECD9D7.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff983e9c728,0x7ff983e9c734,0x7ff983e9c740
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,6450249134413449644,14518282888492648750,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,10010621357802193158,10518051037042182872,262144 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,14213345071568949359,8178825470703666337,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,14300873023829865014,14591422868049093312,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,14287492952926790080,5254413689619281233,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,8633448751021034247,15268115684288536281,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,17088298345846959871,16774912421057493686,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,9656533254551520555,18330283233867994106,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5868,i,5179190790357498816,11292344453402522770,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3396,i,5494788869911040504,5532422498747877453,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6032,i,5173472888468868504,12964147478123918729,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3432,i,7590841680754363017,130605523349841777,2097152 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,5832359214154917481,1363962432829355160,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,12836146181525179571,3315660884180309259,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,3853561188666672772,1549720384260618598,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,17946746096442370960,9758962244248633396,524288 --field-trial-handle=2164,i,15474839206689979035,3664769439301025288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5900

C:\Users\Admin\Downloads\WyvernLoader.exe
"C:\Users\Admin\Downloads\WyvernLoader.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 45a4eb071c355e058ce7bd2de6e92e88520211789f7c5e21154ca481b1ab13a6
MD5 9c21f2581c88efbd688c4757bd512e92
SHA1 eedcbc7ca97cd9a789fbcde95d3b199b339240c9
SHA512 3a4d5ef251639288cf344cca1eddf74a8e4726ba7541aecbf3c801e0bc85cad30123f5b370138dc2eeaf74103c3c461191b4a7a8b6107f9bad3ab3e6f59199b7
TLSH
T179E02BA9CC21BC2708FD07189155464BE766135B2E81551F3A3D910CCFB0A2A91CBCBC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 1b70d9283709eaed7cec8e4bad55cc6e3f7d99a1c72e434dd31e3159e4aa6302
MD5 c082eac1ff4cfea09cb7a8623ab66aac
SHA1 5f9fbd43e20c8aea49c8067f960b7621aeeadc13
SHA512 bb0f314109460100d4b05ff4fd0bbe797d8b9a13a71177d3d7fdfd4fce13e990aa4d7a2a3e8deb8a8e7a65ce85cc26a0f7c62885c38c80c91e082fe95831920a
TLSH
T196F0AB0E700D0859CF381CF736FD45183432C68B26001EEF2CD0447C035E53E40228C9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 2e409f18024e2552b6cfb5f6bb833ea4818af25fc1b8a91273507dc01299ee5c
MD5 61088c4130f2b38e3476aed6e72aff67
SHA1 a81710d862e8c6985b03715c3d64b82258163ef2
SHA512 489202af9d8442195abca4f3be7e1e2902a14c58b0aa5985aa4ba7e08acf17d76b2e31486a476cb88f0a9752a0847a0044ca2deadb387522e8aaf9f9d542aa04
SSDEEP 3:MsEllllkEthXllkl2zEkl5K/:/M/xT02zn5a
TLSH
T11C4404077FC10407C54410305411C3500370D5510531574334D104335FC57450C10040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ce0d02e8001b5e86824908f61dfcbaa41a62a6e0e1810bf42e113d6544fe2510
MD5 da3d37dbdd35cfa6c04754636e257170
SHA1 817905b45407c5174f9b6a26a6d0d5c505e38168
SHA512 56aae6c0b61083151d5c3d84e4382c1a9709f8830e5827cd710238d0ef7cea3a53c2cd4fac16b6dd29d2f669d49ddef2d2519a567e053660881fe2753b47b62f
SSDEEP 192:DhQWlqQSfYaaqHwLw5y4De6zNPtaPhfPpvcz+HK:DhQWlqQSfYaaqHwLw5y4De6zN1aZfREZ
TLSH
T186D1ACF7C3E8862DC80156F49B166F2FCE290A14532C3D6688D8BF5B93F2871E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 9795d1d7f26d13feeb3a57a19d80913f9c2723f5aeb1116d17209ea02d545be4
MD5 9c34029881a6f86a3867249cb46244d9
SHA1 2bb81ecafbfb20caf0a85562fdf769a2f7027904
SHA512 01045c4aa5bee0b4522ca12a029f25cd64a1c4c38cf3511cf13eb0e4499937567eead50cfef18d3d1576468d952d342114433ebb8dfddc6cc756656c88178ea6
TLSH
T1DFF05067D679742750BA94FB0D04BC192575E431138119F1CE5B81ACA0984E31B16453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d3e24b371c7ee45071e0710b5aa28b8f44ee02a7d2866cbbd95722627465c93b
MD5 0a39313063a53a97e58c6430ced16114
SHA1 33a3c593d7a7d2c48dba32f21e0477444375f543
SHA512 04bd2ade4960560a0929ebf0a7eee655fa06aeda17787796650671efe8168df4914ec5f8c7407df1b20a9ed584ecb50ab68727be86c291af06346904d236f7a5
SSDEEP 192:CRkcBzP+hvwo7dpv7shAPRp22mga9wHsb+WNn8h4PY2lxe9FklTVyIsnAUgtaJ:CRkmzP8pY8X/qKwMR2AFkH8
TLSH
T1BB52D72EFA14797B5CDBD21AF9227B5BD7F1112121841D80EAFC892C18EB9CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9da8690142694174a38c497b8df06ccd09ba2545550e51b950e692973c2d6e37
MD5 d1d42785bf2726abaf4c91a549763850
SHA1 6587cfa5705764cc26e5fa4c7f1edb6ae3ecfc5a
SHA512 e1a44dea2641d66e40815d405e3c574a396ad875774d67a6590e8cc264a6f2caf05d3e81e21975f4018227af97aacbcb263564aa4abf2df60960f1b8b86a627b
SSDEEP 192:CRkcBzf+hvwo7dpv7shAPRp22mgG159wHsb+WNfGN8h4PY2bxe9FklJPyIsnAUge:CRkmzf8pY8X/gKwvR26Fkre
TLSH
T18752C52EF914797B5CDBD21AF9227B5BD7F1212221841E84EAFC892C19E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d269ecea3fe56fd8b279755a722b529923c6ed4c16c1ffecc921fcefca9548a8
MD5 dfe6e064c4cc1045791f803175c07855
SHA1 b0671f6e2d587c36cff80047f8b501e09c3edaeb
SHA512 bfd44ace62cb6cd2f86598a18cb1fca69b49c7a345ee12d277a59c8d7cbe56bcb7c200a3abc133c9b9e71448c8b69af7e54cb57bccb339dd12a6ac8957022a7a
TLSH
T1ACB02208C083A203C0C203B02A808CCC3222CF28C2032303C3E02A3ACE38A208020AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 365997f402a7f7349756ffa8d810a09c57ad73bde197ceda6eebcfd3a9315f8e
MD5 5cb49ff2f5ab6890501cd90456e893e2
SHA1 d2eaea7911429996ab33d238948fa1a881c797ee
SHA512 e685c03e05deee3b33ecb8284408b78cb4670f3699f7975766f7de5738906ad48e54699e69fabefe862f559c814b0ebe4c1b18da4fe8d6521839103dfb3b87bd
TLSH
T175B01294C0465602C00702F4354278987254DF21970B5B0143E0AD67893D1508414090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e0d8ff755b58275264026dd24a6affd3500049ca71cc43d7a9105b05a7335e89
MD5 a9a5d79141412d95aebe9cf780315363
SHA1 f1bb8392f81179e50de12793dd56cf40480c7f59
SHA512 cdc0fd5ac0a48b0d85271922bc4ec7648f04c43ad2ffcc9218f7987fa21a2752972f841a17743002942d8abbd1748661386351e6cbf75e8353113f08758198c6
TLSH
T1E3B0021C755158D3CE1813B039C184E97371FFA516876316E0A450F88E2735583A1C98
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9424954af32d78eb41a96beb0a38184d04566623f06b1d8ac07746a9ec6cae4a
MD5 a72ff9f0ac6204bee838a5a4b20328b2
SHA1 c6368af35ba5eea2d5b3f1fa4487b46366f81153
SHA512 8301d9c0a2a66c5339d1622f587185e5d7fc2f9ab341dd9caf75ca9fce85e1c44f27a4213e6a5347c0828219499bce44f2129dcdf589facdbef757784225984c
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:3m7Rkm1tYpBeh2BAoK
TLSH
T1CBC3123B5D65E8779979B70EB08E0B1F1EF149A2C920DE92C8D86A0437FA7CD0A04D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 7f08f8a8e9953a1a14f041a1000040131580ab00ea4111a6d69679dfb0ed5880
MD5 bad5074a97631bc1e9c44a57152f7b30
SHA1 809d0b664b8001e4290ae0b58d6fab20e1418e3c
SHA512 68f630b7161cb139ae3d4a8dadfac56b0792c1de1885ab79c77965c52366f8f6cf8a6b62f4e7f64a9edb6d315caf952a2532249263df9e6f1c597884aa74d1a5
SSDEEP 6144:CSrbKKpL/h1L1xKMsln6zQcJm7Rkm1tYpBeh2BAon:3bXjh1pEMsl6zw9oBGcAon
TLSH
T1EF34233B6F34BFBB0EA8376D704F3A0F0CF64593D9286BA985D922049794BC94A45630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 6fefeedc3335c21122173694508146088bec94975d427db0b3def5b824f0e34e
MD5 02e63e010b460f60e6cc354ac6c27568
SHA1 a2bae589b00030fc2613c9eb372f85c01d006782
SHA512 f1997d02c854c560915f538e42a5b6b5ca8824bd41febde33d974480ae40fe730743956bdf2e496e84be2b2a6ce7800590915261ffaa0a718f3c5e485a24f980
SSDEEP 6144:bSrbKKpL/h1L1xKMsln6zQcJm7Rkm1tYpBeh2BAon:UbXjh1pEMsl6zw9oBGcAon
TLSH
T17834233B6F34BFBB0EA8376E704F2A0F0CB64593D9286BA985D922049794BC94645630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f26c2204-b648-4c24-959a-1713bf4ef44f.bin

Path C:\Users\Admin\AppData\Local\Temp\f26c2204-b648-4c24-959a-1713bf4ef44f.bin
Size 29B
SHA256 7dbab5ddb0554c6f26383f290e37f907fafdc6a5738ce786bbda552cf0fa0b61
MD5 2366b42b1d34e48dfcfce938508d5f44
SHA1 d507a11ee7cac7f1c9133b2475cc62dab5aa23b5
SHA512 af3706cd9486e347b6cb315b0e3f8c60a40f29ea59fe7507f56e4c818cb998cc4e9d4bdb64a8cab0a74d98d3ed229ffbad77fd0969f2760efb06528bd0a3d3e8
MD5 SHA1 SHA512

Submit Download

WyvernLoader.exe

Path C:\Users\Admin\Downloads\WyvernLoader.exe
Size 19.5MB
SHA256 edc0bfaf490ebad6fed49519575efbb5585272c9710048953ec33b5145d72dd1
MD5 7eeecdaa6a62aac61d33d327db26e16f
SHA1 52a6f820f597efa70a0592424f6d65b55f676959
SHA512 929b9788831272bd234b7676537f6cc5fc860a5aa9c9dbfa438505dfc1f7c2eb2374c6db55144dc6af035cfa87ad3ef259c39cf0450b90cb82dde0715db48d36
SSDEEP 393216:StwKaXGYQI1bgbMDB+Y3vE+pDzLNdUeg8o9cyHIt:SrrYQ4TxvE+p36X9hK
TLSH
T1102723E634D051ADC886C671D34A5FEDF1E678760D7A682BBFC615012931E82CCBAD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5908-268-0x00007FF9A1270000-0x00007FF9A1272000-memory.dmp

Download

memory/5908-270-0x00007FF9A1290000-0x00007FF9A1292000-memory.dmp

Download

memory/5908-271-0x00007FF9A12A0000-0x00007FF9A12A2000-memory.dmp

Download

memory/5908-272-0x00007FF9A0610000-0x00007FF9A0612000-memory.dmp

Download

memory/5908-273-0x00007FF9A0620000-0x00007FF9A0622000-memory.dmp

Download

memory/5908-274-0x00007FF99EA90000-0x00007FF99EA92000-memory.dmp

Download

memory/5908-275-0x00007FF99EAA0000-0x00007FF99EAA2000-memory.dmp

Download

memory/5908-276-0x0000000140000000-0x00000001425AA000-memory.dmp

Download

memory/5908-280-0x0000000002060000-0x00000000020AE000-memory.dmp

Download

memory/5908-269-0x00007FF9A1280000-0x00007FF9A1282000-memory.dmp

Download