remus_stealer | hxxp://pulse[.]chainfluxgrid3[.]lol

Resubmissions

28/08/2026, 13:17

260828-qjbsgayard6

28/08/2026, 13:00

260828-p83rtada3710

Analysis

user interaction
yes
max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pulse.chainfluxgrid3.lol
Sample260828-p83rtada37

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://vexdico.shop:8539/subscriptions
http://shhsift.click:7647/users
http://fezm.website:9048/reports

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 1 IoCs

pid	Process
5388	file.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323956656773052"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
5388	file.exe
5388	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
5200	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4508	3932	chrome.exe	85
PID 3932 wrote to memory of 3220	3932	chrome.exe	86
PID 3932 wrote to memory of 3220	3932	chrome.exe	86
PID 3932 wrote to memory of 4888	3932	chrome.exe	87
PID 3932 wrote to memory of 3636	3932	chrome.exe	88
PID 3932 wrote to memory of 3636	3932	chrome.exe	88
PID 3932 wrote to memory of 4900	3932	chrome.exe	90
PID 3932 wrote to memory of 3676	3932	chrome.exe	91
PID 3932 wrote to memory of 4900	3932	chrome.exe	90
PID 3932 wrote to memory of 3676	3932	chrome.exe	91
PID 3932 wrote to memory of 1808	3932	chrome.exe	92
PID 3932 wrote to memory of 1808	3932	chrome.exe	92
PID 3932 wrote to memory of 4172	3932	chrome.exe	96
PID 3932 wrote to memory of 4172	3932	chrome.exe	96
PID 3932 wrote to memory of 628	3932	chrome.exe	97
PID 3932 wrote to memory of 628	3932	chrome.exe	97
PID 3932 wrote to memory of 4316	3932	chrome.exe	99
PID 3932 wrote to memory of 4316	3932	chrome.exe	99
PID 3932 wrote to memory of 4504	3932	chrome.exe	100
PID 3932 wrote to memory of 2488	3932	chrome.exe	115
PID 3932 wrote to memory of 2488	3932	chrome.exe	115
PID 3932 wrote to memory of 4020	3932	chrome.exe	116
PID 3932 wrote to memory of 4020	3932	chrome.exe	116
PID 3932 wrote to memory of 808	3932	chrome.exe	118
PID 3932 wrote to memory of 4652	3932	chrome.exe	119
PID 3932 wrote to memory of 3684	3932	chrome.exe	120
PID 3932 wrote to memory of 4064	3932	chrome.exe	121
PID 3932 wrote to memory of 4064	3932	chrome.exe	121
PID 3932 wrote to memory of 4820	3932	chrome.exe	123
PID 3932 wrote to memory of 368	3932	chrome.exe	124
PID 3932 wrote to memory of 368	3932	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pulse.chainfluxgrid3.lol
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2f6ac728,0x7ffd2f6ac734,0x7ffd2f6ac740
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,10320257902666527055,10138579379544284876,262144 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3923333889528880567,7077015621056522302,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,12675074382957925374,7753937930283034282,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,4913528054121523656,2721929865175676625,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,10777858333183651133,17396615504457952554,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,4661801728763106043,8766185167542981723,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,1570018869595236047,6082786301143685737,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,3450040472437845949,5584039437046881058,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3400,i,457568180536140418,15123320547241732714,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,13072298860385767357,17872486756047356422,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5964,i,8298755614627400496,849240831940003480,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6024,i,4286496308081331084,2746703141997949871,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,15050321625811357942,9362548706603860262,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,13684850255234462702,2823416388723302363,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,5345209140110006539,11765386126497347527,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,11660294147857282002,17132387751434105952,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,877186897000828686,12527342002331793505,524288 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6608,i,14709860031195021542,12403707078248500825,2097152 --field-trial-handle=1988,i,8825385146698768076,2312404936200878706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\file\" -ad -an -ai#7zMap3603:68:7zEvent3930
1⤵
- Suspicious use of FindShellTrayWindow
PID:5200

C:\Users\Admin\Downloads\file\file.exe
"C:\Users\Admin\Downloads\file\file.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cc085429583be48fa9264ad014888f8c78232cd6ffe50e0e1ca28c3b52819ada
MD5 523fe7dcd621a57e154508630170ce23
SHA1 a43d7a4b4181aef46966b572a1db41457530bfb8
SHA512 8deab3e3d38fc878f4812014eca0c65fe964f9b2ce35ce704781b7450042aa8cb1b633eb56dd51fafa420744180b71bcebb77eaba1ece205bf86b1f837da6b6c
TLSH
T1B1E02BA5C975EC3714F9071AE0151782D755236B2A408D4F7A3D800C8FF16374585D1D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 4078a798bf3eaa6481e2e38a3c3a0b8326f1932f639dcaab855e28618e747eff
MD5 794bea9cdb19c2a02568dfd710d565d3
SHA1 85b87579e53a841c021d233472994dc3ffc38ac3
SHA512 fe26d7c7d3d04cf1234e9f657b818ddc096e6684b400fbd0642ac0c9450754a1c88d06643e44f5d2ba8dbdf90374f3c106907aa933e0212d67c3bc13ed325a27
TLSH
T17ED0A9CF38003003C721B1F09C422CC921B3342A00AB6E4379C4F292061A290B000D80
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 96d6b2f43eb57ac276e37ef2608808a43bfd50c59ce296564ab8d3e4595fefe2
MD5 f4b52f0bae04a8ab67979de9dded845a
SHA1 b6d21c09150a42e33cddf629c95b11a4a4ef4f1e
SHA512 cb595aac2abca2ca1248756514cd9dc19b780ad7975438416454de93d72f2d402e754f01be889ba0fad6cb80bc57c29b82e60c26cbc27b4bf231e1f17e4562cc
SSDEEP 192:Z0n8RP7yeYLkTQ0/tH+bF+UI3iWGVYWNkqp3ruJuzcBu1nuAWRPkaY:Z0nM7l9TQ0/tIkUI3ijVYWNkqpPWw
TLSH
T1B9F3746F5E282312DEAE413655E354A3893EF03F4BD365C49C7190B0CEE16A3A09D4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 6eb411fe330bbccd968639eafca8259de089d4fabe9840e47cab28b907cc1477
MD5 f3d3c372fedc7507c3cb74b22253fb94
SHA1 3d4cd59c5023c0284375e8069f1b5f0bf29a607a
SHA512 43f90af3294f3180d5d44f11280f534e48cd27fba4a40f41f901d8fec8d03692909a9d475a263bfb19ce87d3f5b8d7371ad00e10c5bdaf93dcb41817d7990256
TLSH
T15FE0269335BFC6AE5506801BB22DB70FCBF07804E7CEAE039B02E440B0D4908E7C1682
MD5 SHA1 SHA512 TLSH

Submit Download

6af31353-5364-4847-8f27-586d73a6ceb0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6af31353-5364-4847-8f27-586d73a6ceb0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 fb69234b70c9fc27d718575dc17cefa8cf13c3bd5737f0931daf7776d609406e
MD5 a95cda1171d24317de8b123d62f46116
SHA1 8d0adb06f72f1da6b7b84f8842419b85bc3defd7
SHA512 32255663ad7032a7d13901da63d192d97010d4f6e902e8d111e6251812d27e99c9d8bd033af2a58f825919a880bb7e611b4e782624856a86ebb69654a88f977b
SSDEEP 48:TL9aw/aHLopFMavU1iBpUUznjN3IdxK5QgzHlfsYD8zad9eN:HPareMaZGUTjN3IdxCQQsYD8t
TLSH
T1D69273CE6F243351C0BA163ADBC508674E7C111CA363AEC96D509CB27CE559BB60E2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b1d77fb20fd6d1829fff330cf015cd540e22429a4c71ab86c3077bb4a9d4319e
MD5 36c863176bbe7fc3313d6e9678715aa6
SHA1 e925dabeff06455e02e8fe5f774bc440daf36541
SHA512 d0410f8d2d60f804b69e56b7cd10cf3f48ba9a51a91ec5e74d3ef10fd0e45b07b7247709e3900c9064ceeb1c31e0bc5734b7a990096288a336b948fc18e6ba61
SSDEEP 48:YALlHmQUsBh0qi5q/quaXYfoKs6gmzsjfws/H+sVHCsF+ss1UCsI4szosbssnKs7:DnXCriLaIh8f33byPz44hIVLEWh2
TLSH
T114B17DF7C3E8CA6DC91166F49B252E2BCE6D0928522C3C16C8D9EF5B57E2472D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5f61eb60e84f74eb0ee1de1802b0eadddce6ccc2a00fdd20c9be2836534e0cab
MD5 dc7bfef6c9273bd446a48133fff2b4c3
SHA1 6f4ad51bc64e1aefaf0b996d41824471c1fcfccc
SHA512 ad4ab7c804484f3f2cdcfab2997a9bed3569724a6c88fad93bdec1ed7566b1a2c16f16d82c9abdcab69dce6ebaaf281bd7c11be8dad3f43977da284c6d6e39a4
SSDEEP 192:ERfl/OGrbkv70pAPRp2dxyWY9+Hsb+WN2szgX+9X+N2n6vkw4cDVpzVyIsnAUgE:ERfl/AgUX/8wswA26vjE
TLSH
T1F452856EAA20297B9CDFD229F9517767D7F6202225D11F80E6FC8A2C15D75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cd3a5d0749f864132c44a3b953a02896bba87ca829a60cbc0a7558e64f195f7
MD5 6725dad7d399602e6ae839292f7ca492
SHA1 11af80c7c6b7d98c1fbdd54f77d1dbe229031f7c
SHA512 d91f945e10399fd6587560362e0030d1815c4a1ab135161beab06387e3977f2a26690881c19c442f97d1c2844e1f7a5908882052b96230ffc87a099bece675c7
SSDEEP 192:IRfd/OGrJbv70pAPRp2dxyWY9+Hsb+WN2sDZm+92X6vkw4cDVp8VyIsnAUge:IRfdVjgUX/8wNN2Kv+e
TLSH
T12342952EAA20297B9CDFD229FD617767D7F6202225D11E80E6FC892C19D75CC312B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 430bd7083e9f7db3d08bc2b77dcdbd7cead71c72f5d8d9780a212bfeb41f002f
MD5 940d3796a266ac29974ed151cae6e50c
SHA1 42df9c496d2a658e1aae665df2d49b2d1b9d821d
SHA512 81d805a7dcf58ce33fd426f27e277dc77eb135a5b67c3085f479bb822653f180b41a13b76ab2a9d6247bd954f57bc41f2549f3b39ba7b74da18d2be1476bd795
TLSH
T15FB0120080415541C04702F019531888B1145F329A0F3B0143E46A26CCA71618014260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b60c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b60c.TMP
Size 96B
SHA256 f660acdf3be252afbc864e7e27ad04d12f6d7a70ca5438b9cef43f1e99b37d50
MD5 1a3fe52f43ec71b728103d4371865a90
SHA1 50d4e707aaef77d06f55793c52b63da62a42b75d
SHA512 b7faf7e4f6fc50685a1a70af5edba06a9e55b883d6bea9454251ec698c3f3651afe5c62c090c5b6e962887f2945ce2b32cfb8399801a8348d4ede7bb15e32b4b
TLSH
T19EB02208C2022202F00203F238A288E83220EF28C20F2203C2E20A32CC223300830030
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 23005cbeead0a3bf7080636c4e48ca3d0b964bb2ea3b5e24eb9b8093bff4b254
MD5 808ffd7f090729e893b5ef3bae3995be
SHA1 042b966c8e8cc8465ab1ceb69cb66b2445933d7a
SHA512 31d9a3fc739441a653003423c57f49b63b0b821303584c69cabd066b9abc352bc7314f1d0ec7becedbffc1196266afe75ad39ce48fca993c9c93d8d4f445251b
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OOnRVumGne5:1nbZeMrv/hGtOAne5
TLSH
T16DD3A94B3A743006DDE68A722CE051BB5E3C716D8F55A5D528B620588EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2ab69ae523889e4a1d12673d6934f8b44ff098c8570946ec574426de6942e9f4
MD5 7480f9be5834f2ffd10f7919e1f3fbbe
SHA1 bd15705d5cf9aa321b8c7a6cd4ac0f189d297ad9
SHA512 56fb9dea8178c384e57acadfa1964ef8174ff8290e32f9e9f581b5b37ded4f8e1a24d74a808332963039477cb45f3c11294777b870d0d0f2290a75c813760562
SSDEEP 1536:yC3yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:RZqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1FAC30237ABC21E335ED3DF70B5130E9793F644A99034D305EEAD36BB6893591A88249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1233fa25409988047cc5fb3af5fff03b4dbe4ef04ff19c2ef01909b6c803485e
MD5 11dce141adc83102f93afda325c6e36b
SHA1 4460de4a0c79eb4e582d82831b9e9cc0499b9cb2
SHA512 27eca173ff305ad3b7188c5cbfcd611cc01151e69fc1be96db444fd7c9e5f24ee6e9ae7d04cebafa73dfdab072dee52a1ddc915543d092ae88902e006fb90d97
SSDEEP 1536:yufyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:lhqfd7NtZL8cHQRZEQ6Sps3
TLSH
T135C30237ABC21E335ED3DB70B5130E9793F644A99034D305EEAD3ABB6893551A88249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d6b26a16aa0b199b380d4e8c0e5b8e845565f6c40f45cf0e477c7b2dde72a3cc
MD5 3e6d7348e5d063023301508dc3900c8f
SHA1 b52a79bd632cea3828354f0932fc5bce7a6295a0
SHA512 418fcadbfe04fbdbfc0990b360a09502b4d94f3e003f28d854731e0e07deeb07439d0b76b7e6252b59e9fde777aefdac9a25c582b1e6c021fe9cecd952b07d99
SSDEEP 1536:LyhyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:G/qfd7NtZL8cHQRZEQ6Sps3
TLSH
T14DC30237ABC61F339E93CB74B5130FD797B644A99034D301ABAD3BBB6883591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 05ecfd7938a848cd101c100c3a9aa6cb3a246bf77b2de8039ce88a6473498387
MD5 76d1d5f801c2d1e32746279ea9f4e0b7
SHA1 8c2b3d5cbd60fa671546df7e8c93ba0410d834d4
SHA512 ff3532f11bb1db22552299ea782794de9de6ab4232b3c9934091d9c93c1cee6b98400863423ba4086d64f15466143cf964777b8c01a19d96433105ddd0b8b676
SSDEEP 1536:bsLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Qqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1E0C30237ABC21F339D92CF64B9130FD667B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0a5ba37c898b063c391cdbb5b3d9a9da5409e98ed809d72433377c57bc2c688d
MD5 c592fee7b5a3e0382384059f2c16ea55
SHA1 b9bc7101d53eee22842b7eddcf70b9f2ed363ff7
SHA512 280c6b54891be06d553102dba79a6527750c27bcee21f4222242e297c935cf4ac7bbe75c8f4afbeaba27f8762a62aa9d32df936fdf049e0e48d331d53a05a78b
SSDEEP 1536:yhhyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:W/qfd7NtZL8cHQRZEQ6Sps3
TLSH
T15EC30237ABC21F339E83CB74B5131FD7A7B644A99034D301ABAD37BB6883591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.7z.crdownload

Path C:\Users\Admin\Downloads\file.7z.crdownload
Size 17.3MB
SHA256 0d7665cf970cdbd66a87fc3d4f3b4baa62ad476539894d51c32d8e40d2d36138
MD5 397e8873fcee3e1935b4092f978240d1
SHA1 1f2c19247e615635046d6ef95903cae9cddd8179
SHA512 03fbaa4258bc2ce3564546345315fbb60cea90a26a6c163b44d19ef2aa01d2ac91ef8a4e4961e0b401e551d3c26b0884d95b59b91ee106dfd8786d7058d11358
SSDEEP 393216:76E1X3DC8LWwBr/0pKqUdY/MsAW9kqiv8SNDdZku:77zNiwe4BW9kFv8SNDAu
TLSH
T1650733F3D21D07F5162A9E2AF3A691E1C7595586CDF09820AD8E95E0FE518FC222EC43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5388-132-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/5388-162-0x0000000140000000-0x0000000140039000-memory.dmp

Download